crypto/ascon/mod.rs
1//! # Ascon lightweight cryptography (NIST SP 800-232)
2//!
3//! Ascon is a family of authenticated encryption and hashing algorithms selected by NIST
4//! for constrained environments. This module provides the four NIST-standardized,
5//! little-endian variants:
6//!
7//! - [`AsconAead128`] — authenticated encryption with associated data (AEAD)
8//! - [`AsconHash256`] — 256-bit cryptographic hash function
9//! - [`AsconXof128`] — extensible-output function (XOF)
10//! - [`AsconCxof128`] — customizable XOF (accepts a customization string)
11//!
12//! With a state representation optimized for both 32-bit and 64-bit CPUs: the
13//! 64-bit implementation is compiled on 64-bit targets and the 32-bit
14//! bit-interleaved one everywhere else, behind the same API.
15//!
16//! # Usage limits
17//!
18//! Per NIST SP 800-232 §4.3:
19//! - Max data per key: 2^54 bytes
20//! - Nonces must be distinct per key (up to 2^8 repetitions tolerated)
21//! - Tag lengths below 64 bits are discouraged; below 32 bits are not allowed
22
23// Ascon permutation round constants (only the low byte of word 2 is touched).
24// Shared by both the 32-bit and 64-bit implementations.
25const RC4: u8 = 0xf0;
26const RC5: u8 = 0xe1;
27const RC6: u8 = 0xd2;
28const RC7: u8 = 0xc3;
29const RC8: u8 = 0xb4;
30const RC9: u8 = 0xa5;
31const RC10: u8 = 0x96;
32const RC11: u8 = 0x87;
33const RC12: u8 = 0x78;
34const RC13: u8 = 0x69;
35const RC14: u8 = 0x5a;
36const RC15: u8 = 0x4b;
37
38#[cfg(target_pointer_width = "32")]
39mod ascon_32b;
40#[cfg(not(target_pointer_width = "32"))]
41mod ascon_64b;
42
43mod ascon_aead128;
44mod ascon_cxof128;
45mod ascon_hash256;
46mod ascon_xof128;
47
48#[cfg(target_pointer_width = "32")]
49pub(crate) use ascon_32b::{State, p8, p12};
50#[cfg(not(target_pointer_width = "32"))]
51pub(crate) use ascon_64b::{State, p8, p12};
52pub use ascon_aead128::AsconAead128;
53pub use ascon_cxof128::AsconCxof128;
54pub use ascon_hash256::AsconHash256;
55pub use ascon_xof128::AsconXof128;