Requirements for listing

[tristanitschner]

Hello,

I implemented Ascon 128 in Verilog:

https://github.com/tristanitschner/ascon_cipher_verilog

I would like to be listed in your collection. What are the requirements?

Best regards

[meichlseder]

Hi,

Thanks for sharing your implementation!

Could you clarify in your README file which version of Ascon you actually implemented? Currently it just says "Ascon AEAD 128a" (or above: "Ascon 128"), but this might refer to different AEAD algorithms:

• Ascon-AEAD128, the standardized version from NIST SP 800-232 (the most recent implementations in ascon-c implement this version)
• Ascon-128a, the secondary candidate version submitted to NIST (v1.2), which is similar but not identical to Ascon-AEAD128; notable differences include the IV value and the endianness (big-endian vs. little-endian)
• Ascon-128, the primary candidate version submitted to NIST (v1.2), which has a smaller rate of 64 bits and different round numbers, but is otherwise similar to Ascon-128a.

Our "Hardware" section is unfortunately still under construction, but sooner or later, we'll move the list from the Ascon website to this overview page. We can then consider adding your implementation to the list as well; we decide this based on several criteria, including

1. it is clear which versions are implemented (see above) and for which context (what is the goal of the implementation? what interface is provided?);
2. we have an understanding of how the implementation was verified to be correct and that it is useful/attractive for other users;
3. the implementation provides some degree of novelty to the list (for example, good performance benchmarks, or targeting a new platform/API, or being particularly readable, etc; in your case, it might be interesting if the code corresponds to the standardized version, since most previous implementations don't?)

[tristanitschner]

1. I think I implemented the version as standardized by NIST. I started my implementation at the start of this year and used the same testvectors as ascon-c, so if they had no change since then, it is the NIST version. I have clarified my README.

Here's the sha512 hash of the testvector file just to make sure:

8e1462a7eed364d23c442b776c511bef2e1430f0b9fc96f8705a15ec2bf6e7f95b2104f537947cbeb8f5563339d457ad5bc2b2dfe03e4bb20924d862d01ea19c  assets/LWC_AEAD_KAT_128_128.txt

2. My implementation has a full formal regression testbench (bound model check and cover check) for each testvector (using yosys / sby). Also there is a simple Verilog testbench that encrypts and decrypts random data. All testbenches make sure that the backpressure-capable AXI stream interfaces work as intended.

3. The implementation has been optimized for speed (timing / logic depth) and performance. I think it currently outperforms all other available implementations. Also it can be customized with regard to byte width and the number of round per clock of the Ascon-p primitive through generics. But it only supports AEAD. It is intended to be used for hardware offload in the context of packet processing. The top level AXIS wrapper provides very simple AXI stream interfaces, that make it easy to integrate in a larger design. Therefore I also chose a very permissive BSD license, because I would like to see my core be used very much.

[meichlseder]

Thanks for the details, sounds good!
(I'll leave this issue open until we create the hardware list, so that we can include your implementation at that time)

[tristanitschner]

Awesome :)

[tristanitschner]

Any news on this?

If you'd like, I can open a pull request. I would include your and a few other implementations I have spotted. Just asking as to prevent double work.

Also if you struggle with understanding my testing strategy, I can also implement a classic testbench using the testvectors from ascon-c. Not many people use formal verification as extensively as I do, so I can relate that it may be difficult to understand. Especially since I was lazy and used a Verilog code generator for the formal testvectors.

My implementation is genuine, high-performance and has full byte support. I'm willing to provide any proof of that you put up as a requirement for listing.

Also I hope that it is no problem, that my implementation does not come with a paper or is funded by any research project. I simply had two free weeks at the start of this year, and found Ascon interesting after reading about the NIST standardization a few weeks prior.