Truncated, Impossible, and Improbable Differential Analysis of ASCON

Abstract

ASCON is an authenticated encryption algorithm which is recently qualified for the second-round of the Competition for Authenticated Encryption: Security, Applicability, and Robustness. So far, successful differential, differential-linear, and cube-like attacks on the reduced-round ASCON are provided. In this work, we provide the inverse of ASCON’s linear layer in terms of rotations which can be used for constructing impossible differentials. We show that ASCON’s S-box contains 35 undisturbed bits and we use them to construct 4 and 5round truncated, impossible, and improbable differential distinguishers. Our results include practical 4-round truncated, impossible, and improbable differential attacks on ASCON. Our best attacks using these techniques break 5 out of 12 rounds. These are the first successful truncated, impossible, and improbable differential attacks on the reduced-round ASCON.