# Study About the Performance of Ascon in Arduino Devices
## 4 Security Analysis
### Algebraic Attacks  
#### 4.1.1 Differential and Linear Cryptanalysis  
As it is well known, differential cryptanalysis is the most commonly type of attack used to break block and stream ciphers, as well as hash functions. This cryptanalysis method consists of studying how certain changes in the input of an algorithm affect the output. That is, the goal is to find a collection of strategies to identify differences in the output through a network of input transformations in order to determine at which points the encryption algorithm exhibits non-random behavior. Linear cryptanalysis, similarly to differential analysis, is a type of cryptanalysis based on finding close approximations to the action of an encryption algorithm. The most common algorithms to which this type of attack is applied are block ciphers. The Ascon permutation is built upon two lightweight operations which, individually, do not possess properties that ensure strong resistance against differential or linear attacks. However, when combined, they effectively guarantee the Ascon security. To understand how this type of attack can be executed, it is necessary to review some concepts and definitions that can be extended in [21], such as a differential distribution table or linear approximation table. For example, differential and linear cryptanalysis are very useful in distinguishing attacks, where an attempt is made to distinguish encrypted data from random data. Furthermore, an algorithm is considered more secure if an attacker cannot distinguish the cryptographic operations of the algorithm from that of a random oracle. Thus, if an attacker could find sufficient relationships between the inputs and outputs, he could use this knowledge to recover parts of the secret key used by the algorithm. A collection of such attacks on the Ascon permutation is compiled in the algorithm's official submission, see [10]. In [22], the main attacks that have been carried out against Ascon, both in its block cipher and hash function aspects, are discussed. In this case, the most important recommendations point out that the same nonce should not be repeated for two encryptions under the same key. When the same nonce is reused, the initial internal state of the cipher becomes fixed for every encryption under the same key. This breaks the assumption of input uniqueness required by Ascon's security model and enables an attacker to treat the cipher as a deterministic Boolean function. In this scenario, algebraic techniques such as cube attacks become applicable, where the cipher is modeled as a multivariate polynomial over the finite field of 2 elements, \(\mathbb{F}_{2}\). By evaluating the encryption function over a chosen set of plaintexts (called a cube) and computing the XOR sum of the corresponding outputs (cube-sum vector), the attacker can extract linear or low-degree relations involving internal state bits. Mathematically, if the cipher behaved like a pseudorandom function, the output vector would appear statistically indistinguishable from random--its Hamming weight would follow a binomial distribution \(B(64,0.5)\). However, experiments reported in [23] show that, under nonce reuse and reduced-round conditions, this vector becomes all-zero in approximately 25% of random internal states. This low-probability event does not occur by chance; rather, it reveals specific internal state configurations (e.g., fixed values for the initial bits) that correlate with the algebraic structure of the cipher. In those cases, the attacker can deduce parts of the internal state with high confidence--empirically, with 100% success in the experiments. These patterns allow for an adaptive chosen-plaintext attack capable of recovering the full 256-bit capacity of Ascon's internal state, with an online data and time complexity below \(2^{40}\).