Authenticated Encryption With Associated Data Research Articles

Depth-Optimized Quantum Circuits for ASCON: AEAD and HASH

Quantum computing advancements pose security challenges for cryptography. Specifically, Grover’s search algorithm affects the reduction in the search complexity of symmetric-key encryption and hash functions. Recent efforts have been made to estimate the complexity of Grover’s search and evaluate post-quantum security. In this paper, we propose a depth-optimized quantum circuit implementation for ASCON, including both symmetric-key encryption and hashing algorithms, as a part of the lightweight cryptography standardization by NIST (National Institute of Standards and Technology). As far as we know, this is the first implementation of a quantum circuit for the ASCON AEAD (Authenticated Encryption with Associated Data) scheme, which is a symmetric-key algorithm. Also, our quantum circuit implementation of the ASCON-HASH achieves a reduction of more than 88.9% in the Toffoli depth and more than 80.5% in the full depth compared to the previous work. As per our understanding, the most effective strategy against Grover’s search involves minimizing the depth of the quantum circuit for the target cipher. We showcase the optimal Grover’s search cost for ASCON and introduce a proposed quantum circuit optimized for depth. Furthermore, we utilize the estimated cost to evaluate post-quantum security strength of ASCON, employing the relevant evaluation criteria and the latest advancements in research.

Analysis of Cryptographic Algorithms to Improve Cybersecurity in the Industrial Electrical Sector

This article provides a general overview of the communication protocols used in the IEC61850 standard for the automation of electrical substations. Specifically, it examines the GOOSE and R-GOOSE protocols, which are used for exchanging various types of information. The article then presents real cases of cyber attacks on the industrial sector, highlighting the importance of addressing cybersecurity in the IEC61850 standard. The text presents security drawbacks of the communication protocols mentioned earlier and briefly explains two algorithms defined in the IEC61850 standard to address them. However, the authors suggest that having only a couple of algorithms may not be sufficient to ensure digital security in substations. This article presents a study on the cryptographic algorithms ChaCha20 and Poly1305. The purpose of the study is to experimentally verify their adaptation to the strict time requirements that GOOSE must meet for their operation. These algorithms can operate independently or in combination, creating an Authenticated Encryption with Associated Data (AEAD) algorithm. Both algorithms were thoroughly reviewed and tested using GOOSE and R-GOOSE frames generated by the S-GoSV software. The computational time required was also observed. The frames were analysed using the Wireshark software. It was concluded that the algorithms are suitable for the communication requirements of electrical substations and can be used as an alternative to the cryptographic algorithms proposed under the IEC61850 standard.

Key Committing Attacks against AES-based AEAD Schemes

Recently, there has been a surge of interest in the security of authenticated encryption with associated data (AEAD) within the context of key commitment frameworks. Security within this framework ensures that a ciphertext chosen by an adversary does not decrypt to two different sets of key, nonce, and associated data. Despite this increasing interest, the security of several widely deployed AEAD schemes has not been thoroughly examined within this framework. In this work, we assess the key committing security of several AEAD schemes. First, the AEGIS family, which emerged as a winner in the Competition for Authenticated Encryption: Security, Applicability, and Robustness (CAESAR), and has been proposed to standardization at the IETF. A now outdated version of the draft standard suggested that AEGIS could qualify as a fully committing AEAD scheme; we prove that it is not the case by proposing a novel attack applicable to all variants, which has been experimentally verified. We also exhibit a key committing attack on Rocca-S. Our attacks are executed within the FROB game setting, which is known to be one of the most stringent key committing frameworks. This implies that they remain valid in other, more relaxed frameworks, such as CMT-1, CMT-4, and so forth. Finally, we show that applying the same attack techniques to Rocca and Tiaoxin-346 does not compromise their key-committing security. This observation provides valuable insights into the design of such secure round update functions for AES-based AEAD schemes.

Customized FPGA Implementation of Authenticated Lightweight Cipher Fountain for IoT Systems

Authenticated Encryption with Associated-Data (AEAD) can ensure both confidentiality and integrity of information in encrypted communication. Distinctive variants are customized from AEAD to satisfy various requirements. In this paper, we take a 128-bit lightweight AEAD stream cipher Fountain as an example. We provide a general cryptographic solution with three Fountain variants. These three variants are for encryption, message authentication code (MAC) generation, and authenticated encryption with associated data, respectively. Besides, we propose area-saved and throughput-improved strategies for the FPGA implementation of Fountain. The conventional paralleled hardware implementation leads to much resource-consuming with higher parallel width. We propose a hybrid architecture with parallel and serial update modes simultaneously. We also analyze the trade-off between area occupation and authentication latency for those two architectures. According to our discussion, hybrid architectures can perform efficiently with higher throughput than most ciphers, including Grain-128 x32. Our Fountain keystream generator occupies 46 slices on Spartan-3 FPGAs, smaller than most ciphers with the same security level, and even smaller than the 80-bit security level cipher Trivium. In summary, the customized Fountain with optimized implementations on FPGA is suitable for various applications in the field of IoT.

Key Committing Security of AEZ and More

For an Authenticated Encryption with Associated Data (AEAD) scheme, the key committing security refers to the security notion of whether the adversary can produce a pair of distinct input tuples, including the key, that result in the same output. While the key committing security of various nonce-based AEAD schemes is known, the security analysis of Robust AE (RAE) is largely unexplored. In particular, we are interested in the key committing security of AEAD schemes built on the Encode-then-Encipher (EtE) approach from a wide block cipher. We first consider AEZ v5, the classical and the first dedicated RAE that employs the EtE approach. We focus our analysis on the core part of AEZ to show our best attacks depending on the length of the ciphertext expansion. In the general case where the Tweakable Block Cipher (TBC) is assumed to be ideal, we show a birthday attack and a matching provable security result. AEZ adopts a simpler key schedule and the prove-then-prune approach in the full specification, and we show a practical attack against it by exploiting the simplicity of the key schedule. The complexity is 227, and we experimentally verify the correctness with a concrete example. We also cover two AEAD schemes based on EtE. One is built on Adiantum, and the other one is built on HCTR2, which are two wide block ciphers that are used in real applications. We present key committing attacks against these schemes when used in EtE and matching proofs for particular cases.

Enhanced lightweight and secure certificateless authentication scheme (ELWSCAS) for Internet of Things environment

The Internet of Things (IoT) is a fast-growing technology that enable existing systems to communicate with one another by using new devices such as sensors and other smart devices. The IoT devices such as wireless sensors and other smart devices are often very cheap, very small, and have limited power sources, memories, and processing capabilities. These devices are used in numerous critical applications, in which confidential information is sent across wireless channels among other devices participating in the system. This communication is vulnerable to multiple cyber-attacks due to the insecure wireless channel between them and without strong security mechanism, the important credential can be stolen by network attackers. One of the most important aspects of securing IoT communication is the authentication mechanism, used to validate the identity of authorized devices and users in IoT networks and to ensure data confidentiality, integrity, and authenticity for secure communication. Several authentication schemes for IoT environment have been proposed in the literature, none of these approaches entirely fulfil the necessary security and lightweight feature requirements. Some schemes fulfill the required security features but are unable to provide lightweight features. Similarly, other schemes provide lightweight features, but their security features are unsatisfactory. Therefore, it is necessary to design an effective security mechanism to ensure secure communication in IoT environments. In this paper, we propose Authenticated Encryption with Associated Data (AEAD) and Elliptic Curve Cryptography (ECC) based Enhanced Lightweight and Secure Certificateless Authentication Scheme (ELWSCAS) for IoT environment to fulfill the required security and lightweight performance features. The security of the proposed solution is evaluated using formal and informal security analysis. For formal security analysis we used RoR model and AVISPA tool. We have implemented the proposed solution in network simulator (NS3.35) by using Python and C++ to measure the network parameters such as throughput and packet delivery ratio (PDR). The computational and communication cost of the proposed scheme shows that in comparison to the existing state-of-the-art, our approach is considerably less costly and is a viable option for constrained IoT environment.

Security Evaluation of Initialization Phases and Round Functions of Rocca and AEGIS

Authenticated-Encryption with Associated-Data (AEAD) plays an important role in guaranteeing confidentiality, integrity, and authenticity in network communications. To meet the requirements of high-performance applications, several AEADs make use of AES New Instructions (AES-NI), which can conduct operations of AES encryption and decryption dramatically fast by hardware accelerations. At SAC 2013, Wu and Preneel proposed an AES-based AEAD scheme called AEGIS-128/128L/256, to achieve high-speed software implementation. At FSE 2016, Jean and Nikolić generalized the construction of AEGIS and proposed more efficient round functions. At ToSC 2021, Sakamoto et al. further improved the constructions of Jean and Nikolić, and proposed an AEAD scheme called Rocca for beyond 5G. In this study, we first evaluate the security of the initialization phases of Rocca and AEGIS family against differential and integral attacks using MILP (Mixed Integer Linear Programming) tools. Specifically, according to the evaluation based on the lower bounds for the number of active S-boxes, the initialization phases of AEGIS-128/128L/256 are secure against differential attacks after 4/3/6 rounds, respectively. Regarding integral attacks, we present the integral distinguisher on 6 rounds and 6/5/7 rounds in the initialization phases of Rocca and AEGIS-128/128L/256, respectively. Besides, we evaluate the round function of Rocca and those of Jean and Nikolić as cryptographic permutations against differential, impossible differential, and integral attacks. Our results indicate that, for differential attacks, the growth rate of increasing the number of active S-boxes in Rocca is faster than those of Jean and Nikolić. For impossible differential and integral attacks, we show that the round function of Rocca achieves the sufficient level of the security against these attacks in smaller number of rounds than those of Jean and Nikolić.

Resistance of Ascon Family Against Conditional Cube Attacks in Nonce-Misuse Setting

Ascon family is one of the finalists of the National Institute of Standards and Technology (NIST) lightweight cryptography standardization process. The family includes three Authenticated Encryption with Associated Data (AEAD) schemes: Ascon-128 (primary), Ascon-128a, and Ascon-80pq. In this paper, we study the resistance of the Ascon family against conditional cube attacks in nonce-misuse setting, and present new state- and key-recovery attacks. Our attacks recover the full state and the secret key of Ascon-128a when reduced to 7 out of 8 rounds of Ascon-permutation for the encryption phase, with 2117 data and 2116.2 time. These are the best known attack results for Ascon-128a as far as we know, while violating the data limit 264 imposed by designers. We also show that the partial state information of Ascon-128 can be recovered with 244.8 data. Finally, by assuming that the full state information of Ascon-80pq was recovered by Baudrin et al.’s attack, we show that the 160-bit secret key of Ascon-80pq can be recovered with 2128 time. Although our attacks do not invalidate designers’ security claim. those allow us to understand the security of Ascon in nonce-misuse setting.

Exploring Integrity of AEADs with Faults: Definitions and Constructions

Implementation-based attacks are major concerns for modern cryptography. For symmetric-key cryptography, a significant amount of exploration has taken place in this regard for primitives such as block ciphers. Concerning symmetric-key operating modes, such as Authenticated Encryption with Associated Data (AEAD), the stateof-the-art mainly addresses the passive Side-Channel Attacks (SCA) in the form of leakage resilient cryptography. So far, only a handful of work address Fault Attacks (FA) in the context of AEADs concerning the fundamental properties – integrity and confidentiality. In this paper, we address this gap by exploring mode-level issues arising due to FAs. We emphasize that FAs can be fatal even in cases where the adversary does not aim to extract the long-term secret, but rather tries to violate the basic security requirements (integrity and confidentiality). Notably, we show novel integrity attack examples on state-of-the-art AEAD constructions and even on a prior fault-resilient AEAD construction called SIV$. On the constructive side, we first present new security notions of fault-resilience, for PRF (frPRF), MAC (frMAC) and AEAD (frAE), the latter can be seen as an improved version of the notion introduced by Fischlin and Gunther at CT-RSA’20. Then, we propose new constructions to turn a frPRF into a fault-resilient MAC frMAC (hash-then-frPRF) and into a fault-resilient AEAD frAE (MAC-then-Encrypt-then-MAC or MEM).

Plaintext recovery and tag guessing attacks on authenticated encryption algorithm COLM

There are three main approaches related to cryptanalysis of Authenticated Encryption with Associated Data (AEAD) algorithms: Simulating the encryption oracle (universal forgery attack), simulating the decryption oracle (plaintext recovery attack) and producing the valid tag of a given ciphertext (tag guessing attack). In this work, we analyze the security of COLM in these approaches. COLM is one of the AEAD algorithms chosen in the final portfolio for defense-in-depth use case of the CAESAR competition. The ciphers in this portfolio are supposed to provide robust security with their multiple layered defense mechanisms. The main motivation of this work is to examine if COLM indeed satisfies defense-in-depth security. We make cryptanalysis of COLM, particularly in the chosen ciphertext attack (CCA) scenario, once its secret whitening parameter L=EK(0) is recovered. To the best of our knowledge, we give the first example of querying an EME/EMD (Encrypt-linearMix-Encrypt/Decrypt) AEAD scheme in its decryption direction for arbitrary ciphertexts, not produced previously by the oracle, namely either a forgery or tag guessing attack. We construct SEBC/SDBC (Simulation models of the Encryption/Decryption oracles of the underlying Block Cipher) of COLM, thereby forming the first examples of these models of an authenticated EME scheme simultaneously. The combination of our SEBC/SDBC is a powerful tool to mount a universal forgery attack, a tag guessing attack and a plaintext recovery attack. All of these attacks have polynomial time complexities once L is recovered in the offline phase, indicating that the security of COLM against plaintext recovery and tag guessing attacks is limited by the birthday bound. Apart from exploiting SEBC/SDBC, we mount a pair of plaintext recovery attacks and another universal forgery attack. Finally, we make some suggestions to prevent our attacks.

ChaCha20–Poly1305 Authenticated Encryption with Additional Data for Transport Layer Security 1.3

Transport Layer Security (TLS) provides a secure channel for end-to-end communications in computer networks. The ChaCha20–Poly1305 cipher suite is introduced in TLS 1.3, mitigating the sidechannel attacks in the cipher suites based on the Advanced Encryption Standard (AES). However, the few implementations cannot provide sufficient speed compared to other encryption standards with Authenticated Encryption with Associated Data (AEAD). This paper shows ChaCha20 and Poly1305 primitives. In addition, a compatible ChaCha20–Poly1305 AEAD with TLS 1.3 is implemented with a fault detector to reduce the problems in fragmented blocks. The AEAD implementation reaches 1.4-cycles-per-byte in a standalone core. Additionally, the system implementation presents 11.56-cycles-per-byte in an RISC-V environment using a TileLink bus. The implementation in Xilinx Virtex-7 XC7VX485T Field-Programmable Gate-Array (FPGA) denotes 10,808 Look-Up Tables (LUT) and 3731 Flip-Flops (FFs), represented in 23% and 48% of ChaCha20 and Poly1305, respectively. Finally, the hardware implementation of ChaCha20–Poly1305 AEAD demonstrates the viability of using a different option from the conventional cipher suite based on AES for TLS 1.3.

Hardware Constructions for Error Detection in Lightweight Authenticated Cipher ASCON Benchmarked on FPGA

Lightweight cryptography plays a vital role in securing resource-constrained embedded systems such as deeply-embedded systems, RFID tags, sensor networks, and the Internet of nano-Things. ASCON is one of the finalists for the National Institute of Standards and Technology (NIST) lightweight cryptography standardization competition advanced to the final round in April 2021. It is designed to provide authenticated encryption with associated data (AEAD) and hashing functionalities in hardware and software implementations. ASCON’s lightweight design utilizes a 320-bit permutation, bit-sliced into five 64-bit register words, providing 128-bit level security. This brief, for the first time, proposes error detection mechanisms for secure hardware implementations of ASCON. The proposed schemes, i.e., signature, interleaved signature, and cyclic redundancy check approaches are presented for both LUT and logic-based implementations of ASCON. The proposed error detection schemes are also benchmarked on two FPGA families (Spartan-7 and Kintex-7), achieving acceptable area, power, and delay overheads. The proposed mechanisms also provide a high error coverage (99.99%) shown via simulations performed for 640,000 injected faults. Hence, these approaches aim to make the respective ASCON architectures more reliable.

Security of COFB against Chosen Ciphertext Attacks

COFB is a lightweight Authenticated Encryption with Associated Data (AEAD) mode based on block ciphers. It was proposed in CHES 2017 and is the basis for GIFT-COFB, a finalist in the NIST lightweight standardization project. It comes with provable security results that guarantee its security up to the birthday bound in the nonce-respecting model. However, the designers offer multiple versions of the analysis with different details and the implications of attacks against the scheme are not discussed deeply. In this article, we look at a group of possible forgery and privacy attacks against COFB. We show that the security for both forgery and privacy is bounded by the number of forgery attempts. We show the existence of forgery and privacy attacks with success probability qd/2n/2, given qd forgery attempts. In particular, we show an attack with 2n/2 attempts using only a single known-plaintext encryption query against COFB. While these attacks do not contradict the claims made by the designers of GIFT-COFB, they show its limitations in terms of the number of forgery attempts. They also show that, while COFB generates a 128-bit tag, it behaves in a very similar manner to an AEAD scheme with 64-bit tag. As a result of independent interest, our analysis provides a contradiction to the main theorem of Journal of Cryptology volume 33, pages 703–741 (2020), which includes an improved security proof of COFB compared to the CHES 2017 version. Finally, we discuss the term nqd/2n/2 that appears in the security proof of GIFT-COFB and CHES 2017, showing why there is a security gap between the provable results and the attacks. We emphasize that the results in this article do not threaten the security of GIFT-COFB in the scope of the NIST lightweight cryptography requirements or the claims made by the designers in the specification document of the design.

The mF mode of authenticated encryption with associated data

Abstract In recent years, the demand for lightweight cryptographic protocols has grown immensely. To fulfill this necessity, the National Institute of Standards and Technology (NIST) has initiated a standardization process for lightweight cryptographic encryption. NIST’s call for proposal demands that the scheme should have one primary member that has a key length of 128 bits, and it should be secure up to 2 50 − 1 {2}^{50}-1 byte queries and 2 112 {2}^{112} computations. In this article, we propose a tweakable block cipher (TBC)-based authenticated encryption with associated data (AEAD) scheme, which we call mF {\mathsf{mF}} . We provide authenticated encryption security analysis for mF {\mathsf{mF}} under some weaker security assumptions (stated in the article) on the underlying TBC. We instantiate a TBC using block cipher and show that the TBC achieves these weaker securities, provided the key update function has high periodicity. mixFeed {\mathsf{mixFeed}} is a round 2 candidate in the aforementioned lightweight cryptographic standardization competition. When we replace the key update function with the key scheduling function of Advanced Encryption Standard (AES), the mF {\mathsf{mF}} mode reduces to mixFeed {\mathsf{mixFeed}} . Recently, the low periodicity of AES key schedule is shown. Exploiting this feature, a practical attack on mixFeed {\mathsf{mixFeed}} is reported. We have shown that multiplication by primitive element satisfies the high periodicity property, and we have a secure instantiation of mF {\mathsf{mF}} , a secure variant of mixFeed {\mathsf{mixFeed}} .

Sycon: a new milestone in designing ASCON-like permutations

ASCON is one of the elegant designs of authenticated encryption with associated data (AEAD) that was selected as the first choice for lightweight applications in the CAESAR competition, which also has been submitted to NIST lightweight cryptography standardization. ASCON has been in the literature for a while; however, there has been no successful AEAD which is secure and at the same time lighter than ASCON. In this article, we have overcome the challenge of constructing a permutation that is lighter than the ASCON permutation while ensuring a similar performance, and based on which we achieve a more lightweight AEAD which we call Sycon. Extensive security analysis of Sycon confirms that it provides the same level of security as that of ASCON. Our hardware implementation result shows that the Sycon permutation has 5.35% reduced area, compared to the ASCON permutation. This leads to a remarkable area reduction for Sycon AEAD which is about 14.95% as compared to ASCON AEAD. We regard Sycon as a new milestone as it is the lightest among all the AEADs belonging to the ASCON family.

Power Yoga: Variable-Stretch Security of CCM for Energy-Efficient Lightweight IoT

The currently ongoing NIST LWC project aims at identifying new standardization targets for lightweight authenticated encryption with associated data (AEAD) and (optionally) lightweight cryptographic hashing. NIST has deemed it important for performance and cost to be optimized on relevant platforms, especially for short messages. Reyhanitabar, Vaudenay and Vizár (Asiacrypt 2016) gave a formal treatment for security of nonce-based AEAD with variable stretch, i.e., when the length of the authentication tag is changed between encryptions without changing the key. They argued that AEAD supporting variable stretch is of practical interest for constrained applications, especially low-power devices operated by battery, due to the ability to flexibly trade communication overhead and level of integrity.In this work, we investigate this hypothesis with affirmative results. We present vCCM, a variable-stretch variant of the standard CCM and prove it is secure when used with variable stretch. We then experimentally measure the energy consumption of a real-world wireless sensor node when encrypting and sending messages with vCCM and CCM, respectively. Our projections show that the flexible trade of integrity level and ciphertext expansion can lead up to 21% overall energy consumption reduction in certain scenarios. As vCCM is obtained from the widely-used CCM by a black-box transformation, allowing any existing CCM implementations to be reused as-is, our results can be immediately put to use in practice. vCCM is all the more relevant because neither the NIST LWC project, nor any of the candidates give a consideration for the support of variable stretch and the related integrity-overhead trade-off.

Hardware Constructions for Error Detection in Lightweight Welch-Gong (WG)-Oriented Streamcipher WAGE Benchmarked on FPGA

Providing an acceptable level of security at low cost becomes a challenge in embedded systems that have limited resources, e.g., the devices used in the Internet of Things applications. Lightweight cryptography aims to overcome this challenge by adopting security measures which are well suited for resource-constrained usage models. As we move towards standardizing the approach for lightweight cryptography, several cipher implementations were proposed to NIST, out of which WAGE is one of the algorithms advanced to the next round. WAGE is a 259-bit lightweight stream cipher that derives its cryptographic properties from the WG stream cipher and is designed to provide Authenticated Encryption with Associated Data (AEAD) in hardware implementation. In this paper, the error detection schemes for the nonlinear sub-blocks of WAGE cipher have been presented for reliable implementations of the cipher on hardware. The signature-based error detection schemes presented in this paper are platform oblivious. Derivations for signature and interleaved signature schemes for both logic- and LUT-based implementations are presented for the 7-bit S-Box and Welch- Gong permutation (WGP) of WAGE. The presented schemes are evaluated for error coverage and are benchmarked on field-programmable gate array (FPGA) to show acceptable overheads and practical error coverage.

HANMRE - An authenticated encryption secure against side-channel attacks for nonce-misuse and lightweight approaches

Side-channel threat is a form of cryptanalysis that takes advantage of secret information leaked during program implementations, through measurement and evaluation of systematic parameters, such as execution time, power consumption and electromagnetic field (EMF) radiation. Since various side-channel analysis techniques have applied successfully in gathering data and extracting cryptographic keys on variety of devices and platforms, including smartphones, smart cards, tablets, TVs, FPGAs and CPUs, these attacks constitute a significant risk to the security of cryptographic systems. Eliminating serious leakages is a major approach to mitigate side-channel vulnerabilities, in particular Simple Power Analysis (SPA) and Differential Power Analysis (DPA). During the last decade, several research aimed at securing cryptographic primitive algorithms against side-channel attacks, and validating possible countermeasures under assumption which its computational complexity can be estimated precisely. In this paper, we propose a hash-based authenticated nonce-misuse resistant encryption, namely HANMRE which is adaptable for a lightweight leakage resilient authenticated encryption with associated data (AEAD) scheme. The HANMRE construction has been designed for the side-channel security achievement (including SPA and DPA attacks) and highly integrated for restrained environments with limited resource. The advantage of this scheme is ensuring the strong security developed in misuse-resistant schemes against general adversaries for authenticated encryption [1]. It also presents reasonable implementation results (especially long message handling) compared to existing authenticated encryption schemes and is expected to be a novel idea for better approaches of authenticated encryption mechanisms design in the future.

A Method for Achieving Confidentiality and Integrity in IEC 61850 GOOSE Messages

IEC 62351-6 standard stipulates the use of digital signatures for ensuring integrity and authenticity in IEC 61850 Generic Object-Oriented Substation Events (GOOSE) message exchanges. Yet, it does not specify any method for ensuring confidentiality in GOOSE messages. With rapid growth of IEC 61850 from substation automation to power management domain, sensitive data that requires privacy is carried over GOOSE messages. In this letter, a novel method employing Authenticated Encryption with Associated Data (AEAD) algorithms is proposed to achieve both confidentiality and integrity of GOOSE messages. Further, lab tests are run to observe the timing performance and applicability of these algorithms to GOOSE messages with strict timing requirements.

A New Automatic Tool Searching for Impossible Differential of NIST Candidate ACE

The ACE algorithm is a candidate of the Lightweight Cryptography standardization process started by the National Institute of Standards and Technology (NIST) of the USA that passed the first round and successfully entered the second round. It is designed to achieve a balance between hardware cost and software efficiency for both authenticated encryption with associated data (AEAD) and hashing functionalities. This paper focuses on the impossible differential attack against the ACE permutation, which is the core component of the ACE algorithm. Based on the method of characteristic matrix, we build an automatic searching algorithm that can be used to search for structural impossible differentials and give the optimal permutation for ACE permutation and other SPN ciphers. We prove that there is no impossible differential of ACE permutation longer than 9 steps and construct two 8-step impossible differentials. In the end, we give the optimal word permutation against impossible differential cryptanalysis, which is π′=(2,4,1,0,3), and a safer word XOR structure of ACE permutation.