ASCON is the NIST-selected standard (2023) for lightweight cryptography — authenticated encryption built for the tiny 8/16/32-bit microcontrollers inside battery-powered IoT sensors, where full AES-128 costs too much energy and RAM. This page runs the real ASCON permutation p on a 320-bit state split into five 64-bit words (x0…x4) — the bit grid below is every one of those 320 bits, computed live with BigInt 64-bit arithmetic, not a canned animation.
Each round r:
x2 ^= round_constant(r) — add round constant
S-box: x0^=x4; x4^=x3; x2^=x1;
t_i = (~x_i) & x_(i+1 mod 5); x_i ^= t_(i-1 mod 5);
x1^=x0; x0^=x4; x3^=x2; x2 = ~x2 — 5-bit nonlinear S-box, bit-sliced across words
Linear layer (per word, rotate-XOR):
x0^=ROTR(x0,19)^ROTR(x0,28) x1^=ROTR(x1,61)^ROTR(x1,39)
x2^=ROTR(x2, 1)^ROTR(x2, 6) x3^=ROTR(x3,10)^ROTR(x3,17)
x4^=ROTR(x4, 7)^ROTR(x4,41)
Initialization runs the full 12-round permutation pa; each 8-byte (64-bit) message block absorbed into the "rate" then costs a lighter 6-round pb before squeezing out ciphertext — exactly the sponge/duplex construction the real cipher uses. The round-constant timeline strip shows where you are in that init → absorb → squeeze pipeline.
- Message size — sets how many 64-bit blocks must be absorbed, which sets total rounds and total energy.
- MCU clock — a faster clock finishes sooner but a real embedded MCU also draws more current per MHz, so total energy per round is treated as clock-independent here (time-to-finish scales, energy does not) — matching published lightweight-crypto benchmarking practice.
- Energy comparison — per-round/per-byte energy figures (≈ 0.15 µJ/round ASCON vs ≈ 0.9 µJ/16-byte-block AES-128 on a Cortex-M-class MCU) are illustrative values drawn from published lightweight-cryptography energy benchmarks, scaled to this message's block count, to show why constrained IoT hardware needs a lighter cipher rather than reusing AES.
- Coin-cell battery — models a typical 220 mAh 3 V CR2032 cell continuously running this workload, to make the energy numbers tangible.
- Hover the grid — move the mouse over any cell to read its word/bit index; the S-box tint toggle colours the three words (x_i, x_(i+1), x_(i-1)) the bit-sliced nonlinear layer reads together for whichever row you hover.