ascon-aead

ascon-aead is a pure-Rust implementation of Ascon-AEAD128, the lightweight authenticated encryption with associated data (AEAD) scheme standardized by NIST in SP 800-232. Ascon was selected as the winner of NIST’s lightweight cryptography competition, making it a natural choice for embedded, IoT, and other resource-constrained environments where AES-based AEAD is too heavy.

The crate implements the RustCrypto aead traits, so it drops into the same interfaces used across the RustCrypto ecosystem for encryption, decryption, and associated-data handling. It is no_std-friendly, supports optional zeroization of sensitive material via the zeroize feature, and builds on a shared ascon-core permutation crate.

What You Get

• A pure-Rust implementation of the NIST SP 800-232 Ascon-AEAD128 scheme
• Standard RustCrypto aead trait implementations for encrypt/decrypt with associated data
• no_std support for embedded and constrained targets, with optional alloc
• Optional zeroization of key material via the zeroize feature
• Feature flags for rand_core, getrandom, arrayvec, and bytes integration

Common Use Cases

• Authenticated encryption on microcontrollers and IoT devices where AES-GCM is too costly
• Adopting a NIST-standardized lightweight AEAD in a Rust firmware or edge application
• Interoperating with other RustCrypto-based crypto through the shared aead traits
• Protecting messages with confidentiality and integrity plus associated-data binding

Under The Hood

Architecture - The crate is one member of the sebastinas/ascon-aead Cargo workspace, alongside ascon-core (the shared Ascon permutation), ascon-hash, and ascon-benches. ascon-aead/src/asconcore.rs builds the AEAD mode on top of the ascon-core permutation, while lib.rs exposes the RustCrypto aead trait implementations and key/nonce types. Encryption and decryption flow through the standard aead in-out buffers via the inout crate.

Tech Stack - Rust edition 2024 (MSRV 1.85), depending on aead 0.6 for the trait surface, ascon-core for the permutation, subtle for constant-time operations, inout for buffer handling, and optional zeroize for secret wiping. It is no_std by construction with std/alloc as opt-in features.

Code Quality - A dedicated tests/ directory holds known-answer vector tests validating the implementation against the specification. The crate uses constant-time primitives (subtle) for tag handling, and the README is explicit that no external security audit has been performed.

API Design - Because it implements the shared RustCrypto aead traits, usage matches every other AEAD in that ecosystem, so developers familiar with aes-gcm or chacha20poly1305 need essentially no new API knowledge; feature flags cleanly gate std, randomness sources, and buffer backends.