ASCON Revisited: A New State-Recovery Attack and Committing Security in the Multi-User Setting

After winning NIST's Lightweight Cryptography (LwC) competition, AsconAEAD128 was standardized with a recommended 256-bit key variant for multi-user settings, we denote it as mu-Ascon. We show this instantiation has two critical weaknesses. First, mu-Ascon only partially blinds the expanded key during initialization and finalization, weakening its key-blinding guarantees. Building on this, we show that the recovery of the internal state enables partial key recovery. We further demonstrate a state-recovery attack on three-round-reduced mu-Ascon. Second, mu-Ascon remains vulnerable to committing attacks and hence cannot be used in cases where committing security is required. To remedy this, we propose two API-compatible alternatives for multi-user applications. Our first construction, Ascon-256.v2, achieves CMT-4 committing security up to 64 bits. Our second construction, Ascon-256.v3, leads to both CMT-4 committing security and full 256-bit key-blinding. Both variants require only one additional permutation call, incurring negligible performance overhead while substantially strengthening multi-user security guarantees.