NIST Selects ‘Lightweight Cryptography’ Algorithms to Protect Small Devices

There are currently seven members of the Ascon family, some or all of which may become part of NIST’s published lightweight cryptography standard. As a family, the variants give a range of functionality that will offer designers options for different tasks. Two of these tasks, McKay said, are among the most important in lightweight cryptography: authenticated encryption with associated data (AEAD) and hashing. 

AEAD protects the confidentiality of a message, but it also allows extra information — such as the header of a message, or a device’s IP address — to be included without being encrypted. The algorithm ensures that all of the protected data is authentic and has not changed in transit. AEAD can be used in vehicle-to-vehicle communications, and it also can help prevent counterfeiting of messages exchanged with the radio frequency identification (RFID) tags that often help track packages in warehouses.

Hashing creates a short digital fingerprint of a message that allows a recipient to determine whether the message has changed. In lightweight cryptography, hashing might be used to check whether a software update is appropriate or has downloaded correctly. 

Currently, the most efficient NIST-approved technique for AEAD is the Advanced Encryption Standard (defined in FIPS 197) used with the Galois/Counter Mode (SP 800-38D), and for hashing, SHA-256 (defined in FIPS 180-4) is widely used. McKay said that these standards remain in effect for general use. 

“The goal of this project is not to replace AES or our hash standards,” she said. “NIST still recommends their use on devices that don’t have the resource constraints that these new algorithms address. There are native instructions in many processors, which support fast, high-throughput implementations. In addition, these algorithms are included in many protocols and should continue to be supported for interoperability purposes.”

Neither are the new algorithms intended to be used for post-quantum encryption, another current concern of the cryptography community that NIST is working to address using a similar public review process for potential algorithms.  

“One of the Ascon variants offers a measure of resistance to the sort of attack a powerful quantum computer might mount. However, that’s not the main goal here,” McKay said. “Post-quantum encryption is primarily important for long-term secrets that need to be protected for years. Generally, lightweight cryptography is important for more ephemeral secrets.” 

The specification of Ascon includes multiple variants, and the finalized standard may not include all of them. The NIST team plans to work with Ascon’s designers and the cryptography community to finalize the details of standardization. Additional information may be found on NIST’s project website.