Skip to content

EVP_CIPHER-ASCON-AEAD128

NAME

EVP_CIPHER-ASCON-AEAD128 - The Ascon-AEAD128 EVP_CIPHER implementations

DESCRIPTION

Support for Ascon-AEAD128 (NIST SP 800-232) symmetric authenticated encryption using the EVP_CIPHER API

Algorithm Names

The following algorithms are available in the default provider:

  • "ASCON-AEAD128"
  • "ascon-aead128"

Parameters

This implementation supports the parameters described in "PARAMETERS" in EVP_EncryptInit(3).

NOTES

Ascon-AEAD128 is the NIST-standardized authenticated encryption algorithm specified in NIST SP 800-232. It is based on the Ascon128a variant of the Ascon family of algorithms, suitable for lightweight and constrained environments.

The algorithm supports associated data (AAD) that is authenticated but not encrypted. AAD can be provided before encryption/decryption operations begin.

Ascon-AEAD128 uses a 128-bit key, 128-bit nonce, and produces a 128-bit authentication tag. The implementation processes data in 128-bit (16-byte) blocks using the Ascon-p[8] permutation for data processing and Ascon-p[12] for initialization and finalization.

The nonce (IV) must be unique for each encryption under a given key. Reusing a nonce with the same key can compromise confidentiality and/or integrity. Ascon-AEAD128 is not misuse-resistant.

When decrypting, applications must verify that the final step succeeds (for example EVP_DecryptFinal_ex(3) returns success). If finalisation fails, authentication must be treated as failed and any produced plaintext must not be trusted or used. Streaming decryption output is not authenticated until the tag is verified.

CONFORMING TO

  • NIST SP 800-232

SEE ALSO

provider-cipher(7), OSSL_PROVIDER-default(7)

HISTORY

Ascon-AEAD128 was added in OpenSSL 4.1

This implementation conforms to the NIST SP 800-232 specification for Ascon-AEAD128, which defines the authenticated encryption scheme using the Ascon128a algorithm variant. The NIST draft specification used the Ascon128 algorithm variant.

Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.