NIST SP 800-232 - Ascon-Based Hash and XOF Functions
Overview
NIST Special Publication 800-232 specifies the Ascon-based hash and extendable-output functions that are standardized for use in lightweight cryptographic applications.
- Ascon-Hash256 - Fixed-output hash function producing 256-bit digests
- Ascon-XOF128 - Extendable-output function with 128-bit security
Official Reference
- Document: NIST SP 800-232
- Title: Ascon-Based Hash and Extendable-Output Functions
- URL: csrc.nist.gov/pubs/sp/800/232/final
- Status: Final (December 2024)
Background
Ascon was the winner of the NIST Lightweight Cryptography competition (2023). It is designed for constrained environments including:
- IoT devices
- Embedded systems
- Smart cards
- RFID tags
The Ascon family provides:
- Authenticated encryption (AEAD)
- Hash functions
- Extendable-output functions (XOF)
Implementation Status
| Algorithm | Status | Class |
|---|---|---|
| Ascon-Hash256 | ✅ Implemented | AsconHash256 |
| Ascon-XOF128 | ✅ Implemented | AsconXof128 |
| Ascon-AEAD128 | ⬜ Not implemented | - |
Ascon-Hash256
Description
Ascon-Hash256 is a sponge-based hash function using the Ascon permutation. It provides 256-bit hash output with 128-bit security.
Parameters
| Parameter | Value |
|---|---|
| Hash output | 256 bits (32 bytes) |
| Rate | 64 bits (8 bytes) |
| Capacity | 256 bits |
| Security level | 128 bits |
| Rounds (absorption) | 12 |
| Rounds (squeezing) | 12 |
Usage
using CryptoHives.Foundation.Security.Cryptography.Hash;
// Zero-allocation one-shot hashing
using var hash = AsconHash256.Create();
Span<byte> digest = stackalloc byte[32];
hash.TryComputeHash(data, digest, out _);
// Incremental hashing
using var hashInc = AsconHash256.Create();
hashInc.TransformBlock(chunk1, 0, chunk1.Length, null, 0);
hashInc.TransformBlock(chunk2, 0, chunk2.Length, null, 0);
hashInc.TransformFinalBlock(chunk3, 0, chunk3.Length);
byte[] digestInc = hashInc.Hash;
Ascon-XOF128
Description
Ascon-XOF128 is an extendable-output function (XOF) based on the Ascon permutation. It can produce arbitrary-length output.
Parameters
| Parameter | Value |
|---|---|
| Default output | 256 bits (32 bytes) |
| Variable output | Any length ≥ 1 byte |
| Rate | 64 bits (8 bytes) |
| Capacity | 256 bits |
| Security level | 128 bits |
| Rounds | 12 |
Usage
using CryptoHives.Foundation.Security.Cryptography.Hash;
// Default output size (32 bytes)
using var xof = AsconXof128.Create();
Span<byte> output = stackalloc byte[32];
xof.TryComputeHash(data, output, out _);
// Custom output size (64 bytes)
using var xof64 = AsconXof128.Create(64);
Span<byte> output64 = stackalloc byte[64];
xof64.TryComputeHash(data, output64, out _);
// Large output (256 bytes)
using var xof256 = AsconXof128.Create(256);
Span<byte> output256 = stackalloc byte[256];
xof256.TryComputeHash(data, output256, out _);
Ascon Permutation
Both Ascon-Hash256 and Ascon-XOF128 use the 320-bit Ascon permutation with 12 rounds.
State Structure
The state consists of 5 × 64-bit words: S₀, S₁, S₂, S₃, S₄
Round Function
Each round consists of three layers:
- Addition of round constant to S₂
- Substitution layer (5-bit S-box applied bit-sliced)
- Linear diffusion layer (rotations and XORs)
Round Constants
| Round | Constant |
|---|---|
| 0 | 0xf0 |
| 1 | 0xe1 |
| 2 | 0xd2 |
| 3 | 0xc3 |
| 4 | 0xb4 |
| 5 | 0xa5 |
| 6 | 0x96 |
| 7 | 0x87 |
| 8 | 0x78 |
| 9 | 0x69 |
| 10 | 0x5a |
| 11 | 0x4b |
Test Vectors
Test vectors are validated against the BouncyCastle reference implementation which follows NIST SP 800-232.
Empty Input
Ascon-Hash256(""):
eb47d194e494e9b99b1e5494e934d681
4bc3a01e333751d2ae65396c6b34b81a
...
Single Byte
Ascon-Hash256([0x00]):
...