gh-Mbed-TLS/TF-PSA-Crypto
Watch
1
0
Fork
You've already forked TF-PSA-Crypto
 0
Code Issues 167 Pull requests 92 Releases 5 Activity

WIP: Ascon implementation #626

Draft
gilles-peskine-arm wants to merge 39 commits from gilles-peskine-arm/ascon-prototype into development
pull from: gilles-peskine-arm/ascon-prototype
merge into: gh-Mbed-TLS:development
Conversation 0 Commits 39 Files changed 42 +4742 -92
gilles-peskine-arm commented 2026-01-03 15:51:28 -06:00 (Migrated from github.com)

This is a complete implementation of Ascon as defined in SP800-232 (except restricted to octet strings).

Contents:

  • Ascon-Hash256
  • Generic XOF interface
  • Ascon-XOF128
  • Ascon-CXOF128
  • Ascon-AEAD128
  • Ascon-AEAD128 with nonce masking
  • Two implementations: a somewhat faster one (at least on my PC) with larger code size (default), and a smaller but slower one (enable MBEDTLS_ASCON_SMALLER).

Integration notes:

  • Built-in implementation (no public interface).
  • Test data mostly generated with https://github.com/GiacomoPope/dilithium-py
  • XOF built-in driver.
  • XOF driver wrapper.
  • XOF test driver — should work but that's not a priority for me.
  • XOF API.
  • psasim builds will be broken until we resolve some technical debt there (we can't easily add new API functions).

Note to potential users: This is a prototype, with everything packaged in a single branch for convenience. I intend to rebase it on top of TF-PSA-Crypto 1.1 once that is released, and then let it go dormant until we officially implement Ascon (check our roadmap).

Note to maintainers: this is not intended for review. When we implement Ascon, we should split this branch (probably into three parts: hash, XOF, AEAD). This branch has generic support for XOF as well, which I presume we'll add for SHAKE well before we work on Ascon.

Legal notice: I worked on this almost entirely in my spare time, the exception being part of the generic XOF interface (which is also relevant for SHAKE, which we will add in 2026Q1). I did, however, use Arm resources. For the avoidance of doubt, I hereby allow Arm to dispose of this work as a work for hire. Note that for recipients of TF-PSA-Crypto, this code is nothing special: it is provided under the usual license of TF-PSA-Crypto.

PR checklist

  • changelog provided | not required because:
  • framework PR TODO (to handle the mechanisms, the new algorithm category for XOF, and the XOF functions in the test driver code)
  • mbedtls development PR not required because: crypto only
  • mbedtls 3.6 PR not required because: new feature
  • tests provided
This is a complete implementation of Ascon as defined in SP800-232 (except restricted to octet strings). Contents: * Ascon-Hash256 * Generic XOF interface * Ascon-XOF128 * Ascon-CXOF128 * Ascon-AEAD128 * Ascon-AEAD128 with nonce masking * Two implementations: a somewhat faster one (at least on my PC) with larger code size (default), and a smaller but slower one (enable `MBEDTLS_ASCON_SMALLER`). Integration notes: * Built-in implementation (no public interface). * Test data mostly generated with https://github.com/GiacomoPope/dilithium-py * XOF built-in driver. * XOF driver wrapper. * XOF test driver — should work but that's not a priority for me. * XOF API. * psasim builds will be broken until we resolve some technical debt there (we can't easily add new API functions). Note to potential users: This is a prototype, with everything packaged in a single branch for convenience. I intend to rebase it on top of TF-PSA-Crypto 1.1 once that is released, and then let it go dormant until we officially implement Ascon (check our [roadmap](https://mbed-tls.readthedocs.io/en/latest/project/roadmap/)). Note to maintainers: this is not intended for review. When we implement Ascon, we should split this branch (probably into three parts: hash, XOF, AEAD). This branch has generic support for XOF as well, which I presume we'll add for SHAKE well before we work on Ascon. Legal notice: I worked on this almost entirely in my spare time, the exception being part of the generic XOF interface (which is also relevant for SHAKE, which we will add in 2026Q1). I did, however, use Arm resources. For the avoidance of doubt, I hereby allow Arm to dispose of this work as a work for hire. Note that for recipients of TF-PSA-Crypto, this code is nothing special: it is provided under the usual license of TF-PSA-Crypto. ## PR checklist - [x] **changelog** provided | not required because: - [ ] **framework PR** TODO (to handle the mechanisms, the new algorithm category for XOF, and the XOF functions in the test driver code) - [x] **mbedtls development PR** not required because: crypto only - [x] **mbedtls 3.6 PR** not required because: new feature - **tests** provided
This pull request has changes conflicting with the target branch.
  • core/psa_crypto.c
  • drivers/builtin/include/mbedtls/config_adjust_legacy_crypto.h
  • drivers/builtin/include/mbedtls/private/crypto_adjust_config_enable_builtins.h
  • drivers/builtin/include/mbedtls/private/crypto_builtin_primitives.h
  • drivers/builtin/src/psa_crypto_xof.c
  • drivers/builtin/src/psa_crypto_xof.h
  • framework
  • include/psa/crypto.h
  • include/psa/crypto_driver_contexts_primitives.h
  • include/psa/crypto_values.h
  • tests/configs/crypto_config_test_driver_extension.h
  • tests/suites/test_suite_psa_crypto.data
  • tests/suites/test_suite_psa_crypto_metadata.data
  • tests/suites/test_suite_psa_crypto_xof.data
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin 'gilles-peskine-arm/ascon-prototype:gilles-peskine-arm/ascon-prototype'
git switch 'gilles-peskine-arm/ascon-prototype'

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch 'development'
git merge --no-ff 'gilles-peskine-arm/ascon-prototype'
git switch 'gilles-peskine-arm/ascon-prototype'
git rebase 'development'
git switch 'development'
git merge --ff-only 'gilles-peskine-arm/ascon-prototype'
git switch 'gilles-peskine-arm/ascon-prototype'
git rebase 'development'
git switch 'development'
git merge --no-ff 'gilles-peskine-arm/ascon-prototype'
git switch 'development'
git merge --squash 'gilles-peskine-arm/ascon-prototype'
git switch 'development'
git merge --ff-only 'gilles-peskine-arm/ascon-prototype'
git switch 'development'
git merge 'gilles-peskine-arm/ascon-prototype'
git push origin 'development'
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
api-break
This issue/PR breaks the API and must wait for a new major version

  
approved
Design and code approved - may be waiting for CI or backports

  
bug
Something isn't working

  
component-docs
Docs / website issues filed here for tracking

  
component-platform
Portability layer and build scripts

  
component-test
Test framework and CI scripts

  
dependencies
Pull requests that update a dependency file

  
deprecation
needs deprecation announcement

  
DO-NOT-MERGE

   
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
This issue is not being actively worked on, but PRs welcome.

  
needs-adoption
stalled PR that someone should pick up and complete

  
needs-backports
Backports are missing or are pending review and approval.

  
needs-ci
Needs to pass CI tests

  
needs-design-approval
Needs design discussion / approval

  
needs-info
An issue or PR which needs further info from the reporter / author

  
needs-preceding-pr
Requires another PR to be merged first

  
needs-review
Every commit must be reviewed by at least two team members

  
needs-reviewer
This PR needs someone to pick it up for review

  
needs-work

   
priority-high
High priority - will be reviewed soon

  
priority-low
Low priority - this may not receive review soon

  
priority-medium
Medium priority - this can be reviewed as time permits

  
priority-scheduled
This PR is big - it will require time to be scheduled for review

  
priority-very-high
Highest priority - prioritise this over other review work

  
resolved-after-1.1
The issue is resolved in development, but still present in 1.1 LTS.

  
single-reviewer
This PR qualifies for having only one reviewer

  
size-l
Estimated task size: large (2w+)

  
size-m
Estimated task size: medium (~1w)

  
size-optimisation

   
size-s
Estimated task size: small (~2d)

  
size-xs
Estimated task size: extra small (a few hours at most)

No labels
api-break
approved
bug
component-docs
component-platform
component-test
dependencies
deprecation
DO-NOT-MERGE
enhancement
good first issue
help wanted
needs-adoption
needs-backports
needs-ci
needs-design-approval
needs-info
needs-preceding-pr
needs-review
needs-reviewer
needs-work
priority-high
priority-low
priority-medium
priority-scheduled
priority-very-high
resolved-after-1.1
single-reviewer
size-l
size-m
size-optimisation
size-s
size-xs
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
gh-Mbed-TLS/TF-PSA-Crypto!626
No description provided.