Ascon is the algorithm NIST standardised in 2025 for lightweight authenticated encryption and hashing. For its permutation, the fewest active S-boxes a differential characteristic can have over a given number of rounds is a quantity cryptanalysts track: the designers reported 44 for four rounds and 78 for five, the best published values found were 43 and 72, and the proven lower bound for four rounds is 36. This work lowers the best known characteristics to 42 and 68. Neither threatens the security of Ascon.
The open values
Between the proven lower bound (36 active S-boxes over four rounds, Erlacher, Mendel and Eichlseder, ToSC 2022) and the best characteristic found (43, Makarim and Rohit, ToSC 2022) there is a gap, and for five rounds only the characteristic side (72) was known. Whether the characteristic side could be brought down was an open question with a checkable answer.
How it was shown
A bit-level SAT model of the permutation and a descending search found a 4-round characteristic with 42 active S-boxes (15-11-9-7 per round) and, by one-round extension, a 5-round characteristic with 68 (15-11-9-7-26). For the 4-round characteristic there is one concrete pair of 320-bit states that follows all four rounds through the reference permutation; verify/check.py holds the pair written out in full, runs both states through rounds 8..11 with the round function written from SP 800-232, and prints the active S-box count of each round and the total 42. It has no dependencies and takes about a minute to read and run. For the 5-round characteristic there is only a per-round check and no such pair.
Both characteristics were also checked against the official pyascon implementation and verified in Lean 4 (kernel-checked, no native_decide). They have weight 138 and 226, move neither the proven lower bound nor the best known weight, and do not threaten Ascon.
Check it yourself
Status
The characteristics, the search and the checks were released on 28 Oct 2026; the note and the code at tag v1.1 are archived on Zenodo (1 Nov 2026). The note proposes no new construction and claims no attack. Corrections are welcome at the address in the footer.
Links
Cite as
Nobuo Otoi (ba-cybersecurity.com). Differential Characteristics of the NIST Lightweight Cryptography Standard Ascon: 42 Active S-boxes over 4 Rounds and 68 over 5 Rounds. 2026. https://doi.org/10.5281/zenodo.23858337.
@misc{otoi2026ascon,
author = {Otoi, Nobuo},
title = {Differential Characteristics of the NIST Lightweight Cryptography Standard Ascon: 42 Active S-boxes over 4 Rounds and 68 over 5 Rounds},
year = {2026},
doi = {10.5281/zenodo.23858337},
publisher = {Zenodo},
howpublished = {\url{https://ba-cybersecurity.com/research/ascon-active-sboxes/}},
note = {Preprint, version 1. Code and proofs: https://github.com/otoinobuo/ascon-trails}
}
Released 28 Oct 2026 · Preprint published 1 Nov 2026 · This page: updated 7 Nov 2026 · Permanent address: https://ba-cybersecurity.com/research/ascon-active-sboxes/