In a development that is already circulating rapidly through the cryptography and embedded-security communities, a team of Chinese researchers has unveiled a new family of fault-based attacks against Ascon, the lightweight cipher that NIST standardized in 2025 as the official cryptographic primitive for protecting the Internet of Things. The study, published in Mobile Networks and Applications, demonstrates that a modest number of carefully chosen perturbations to the cipher’s internal state can be enough to extract a full 128-bit secret key, raising pressing questions about the physical security of the billions of constrained devices that are expected to adopt the new standard.
Ascon earned its place in the cryptographic spotlight by winning NIST’s Lightweight Cryptography competition, a multi-year international effort to identify encryption algorithms suited to devices too small, slow, or power-hungry to run conventional ciphers like the Advanced Encryption Standard. In 2025, the algorithm was formalized in NIST Special Publication 800-232 as a standard for authenticated encryption, hashing, and extendable output functions on constrained hardware. Its sponge-based permutation design and compact 5-bit S-box make it economical to implement on microcontrollers and in dedicated silicon, which is precisely why it is expected to appear in smart sensors, medical implants, industrial controllers, and connected vehicles. But mathematical strength against classical cryptanalysis is only half the story: a cipher deployed in the physical world can also be attacked by disturbing its operation while it runs.
The new work, led by Yang Gao, Siqi Lu, Qingjun Yuan, Cheng Lei, and Yongjuan Wang of the Henan Key Laboratory of Network Cryptography Technology at Information Engineering University in Zhengzhou, China, belongs to a discipline known as differential fault analysis, or DFA. First proposed in 1997 by Boneh, DeMillo, and Lipton, the technique exploits a deceptively simple observation: if an attacker can introduce an error into a cryptographic computation at a chosen moment and compare the faulty output with the correct one, the difference between the two often leaks information about the internal state, and ultimately about the secret key. Over nearly three decades, DFA and its many descendants have been used to chip away at nearly every deployed cipher, and Ascon has proven to be no exception, with prior studies exploring subset fault analysis, statistical fault attacks, persistent faults, clock-glitch injections, and electromagnetic fault induction.
What distinguishes the new attack is its focus on 5-bit faults, a granularity that matches the architecture of Ascon’s nonlinear layer. Ascon’s permutation operates on a 320-bit state organized into 64 five-bit S-boxes, each performing a nonlinear substitution on a small input word. Because the S-box is the only nonlinear component of the cipher, its behavior under perturbation determines how much information a fault can reveal. Previous fault analyses of Ascon typically assumed faults affecting an entire S-box input or injecting more generalized disturbances; the Zhengzhou team instead concentrated on faults that corrupt exactly five bits of an S-box input, using the differential properties of the Ascon S-box itself as the engine of the attack. By tabulating how each possible input difference maps to output differences, they constructed a precise picture of which faulty behaviors distinguish which candidate inputs.
A central conceptual contribution of the paper is the notion of fault trails. Rather than treating each fault injection as an isolated event, the researchers model the evolution of the set of candidate S-box inputs across a sequence of injections. Each successive fault filters the candidate set further, and the combinatorial structure of these filtering paths—how many sequences of faults lead to a unique input being identified—can be described by recurrence relations and solved in closed form. The authors derive explicit formulas for the number of fault trails capable of isolating a single S-box input under their two attack models, work that is presented in detail in the paper’s appendices together with the differential distribution tables for both random-XOR and random-AND fault classes. This framework gives the attack a firmer probabilistic foundation than earlier ad hoc analyses, allowing the team to predict analytically how many injections should be required to pin down an S-box input, and then to confirm those predictions through simulation.
Built on this framework are two distinct fault models, labeled A and B, which describe different ways in which a 5-bit fault can invalidate or bias the S-box computation. Under fault model A, the analysis shows that an average of 391 five-bit fault injections is sufficient to recover the complete 128-bit key of Ascon-128. Under fault model B, the number drops to 289 injections. Expressed in terms of the register-width faults that more closely reflect what a physical attacker using voltage glitching, laser injection, or electromagnetic probing can realistically achieve, the figures are 13.3 and 13.1 register-width faults respectively—numbers that the authors report outperform all previously published DFA results on Ascon. In practical terms, an attacker who can induce roughly a baker’s dozen of well-timed disturbances during the cipher’s Finalization stage, while collecting the corresponding faulty outputs, could reconstruct the entire secret key.
The Finalization stage is the natural target for such an attack. In Ascon’s authenticated-encryption mode, the internal state is finalized by additional permutation rounds interleaved with the secret key, and any intermediate state recovered in this phase can be inverted or solved to expose the key directly. The team’s analysis focuses on recovering this intermediate state S-box by S-box, with the 5-bit fault granularity allowing each attacked S-box to be handled independently. Notably, the authors did not stop at idealized assumptions. They extended their analysis to several settings that better mirror laboratory reality, including non-uniform fault distributions, varying probabilities that a fault renders the computation useless, and faults of different widths. These robustness considerations matter enormously in practice, because real fault-injection equipment rarely produces the clean, uniform bit flips assumed in theoretical work.
Simulation results reported in the paper show close agreement between the empirically measured number of injections needed and the theoretical predictions derived from the fault-trail framework, lending weight to the closed-form expressions the team derived. The work also situates itself within a rapidly accelerating research conversation: companion efforts by other groups over the past several years—including statistical fault analysis with fault intensity maps, square Euclidean imbalance-based attacks published in IEEE Internet of Things Journal in 2025, impossible-state exploitation published in Cybersecurity in 2026, and practical bit-flip key-recovery attacks by Japanese researchers—have collectively eroded the assumption that Ascon’s compactness comes with implementation resilience. The new 5-bit analysis pushes that frontier further by exploiting the very feature that makes Ascon efficient, its narrow S-box, as the cryptanalytic wedge.
The implications reach well beyond academic cryptanalysis. Ascon was designed to secure exactly the class of devices—low-power sensors, RFID tags, embedded controllers—where defenses such as redundant computation, fault detectors, and masked logic carry the highest cost in area and energy. A demonstrated attack requiring only on the order of ten register-width faults in the Finalization stage suggests that hardware and firmware integrators cannot treat the NIST standardization as a guarantee of implementation security. Countermeasures exist: duplicated Finalization computations with output comparison, fault-detection codes on the state register, randomization of round execution, and masking schemes can all raise the bar considerably, but each adds cost to precisely the devices where budgets are tightest. The authors’ probabilistic characterization of injection requirements offers designers a concrete benchmark against which such countermeasures can be evaluated.
It is also worth emphasizing what the attack does not do. It requires physical possession of a device and the ability to inject faults during cryptographic computation, typically via equipment ranging from clock-glitch generators to electromagnetic pulse injectors or lasers. It does not threaten Ascon’s mathematical security in any remote or network-facing scenario, and NIST’s standard remains sound at the algorithmic level. Indeed, the paper itself notes that implementation security against fault attacks on Ascon “remains insufficiently understood,” framing the work as an contribution toward closing that gap. Cryptographers have long distinguished between the cipher and its implementations, and this study is a rigorous new data point in the ongoing effort to map where the latter fall short.
As the Internet of Things continues to expand and Ascon deployments move from reference code to commercial silicon, the lesson of the Zhengzhou team’s work is likely to resonate across the industry: the winner of a standards competition inherits not only users but adversaries, and the most creative of those adversaries operate not on mathematics alone but on silicon, timing, and voltage. With fault-trail analysis now offering a precise mathematical language for what was previously an empirical art, the race between lightweight cryptography and the tools that probe it has acquired a new, sharper shape.
Subject of Research: Differential fault analysis of the Ascon lightweight authenticated-encryption cipher under 5-bit S-box fault injection, enabling recovery of the 128-bit key from faulted finalization states.
Subject of Research: Technology and Engineering
Article Title: Differential Fault Analysis of Ascon Under 5-Bit S-Box Fault Injection
Article References: Gao, Y., Lu, S., Yuan, Q., Lei, C., & Wang, Y. (2026). Differential Fault Analysis of Ascon Under 5-Bit S-Box Fault Injection. Mobile Networks and Applications. https://doi.org/10.1007/s11036-026-02506-8
Image Credits: AI Generated
DOI: 10.1007/s11036-026-02506-8
Keywords: Ascon, Internet of Things, lightweight cryptography, AEAD, differential fault analysis, S-box, fault injection, key recovery, finalization stage, embedded security, NIST lightweight cryptography
Cite Scienmag News
APA
MLA
Chicago
Denise Maddox. (September 4, 2026). Single-Bit Faults Break Ascon Through Differential S-Box Analysis. Scienmag. https://scienmag.com/single-bit-faults-break-ascon-through-differential-s-box-analysis/
Denise Maddox. “Single-Bit Faults Break Ascon Through Differential S-Box Analysis.” Scienmag, 4 September 2026, https://scienmag.com/single-bit-faults-break-ascon-through-differential-s-box-analysis/. Accessed 4 September 2026.
Denise Maddox. “Single-Bit Faults Break Ascon Through Differential S-Box Analysis.” Scienmag. September 4, 2026. https://scienmag.com/single-bit-faults-break-ascon-through-differential-s-box-analysis/
Copy citation
Download RIS
Tags: Ascon lightweight ciphercryptanalysis of sponge-based permutation cipherscryptographic security vulnerabilitiescryptographic vulnerability researchcryptography research on constrained devicesdifferential S-box analysisembedded system securityfault attack countermeasuresfault injection techniquesfault-based cryptanalysisIoT device securityIoT device security riskslightweight cryptography standardsNIST lightweight cryptography standardNIST standardized encryption algorithmsphysical attack on embedded systemsphysical attack vectors on cryptographysecret key extraction techniquessecurity implications of lightweight encryptionsingle-bit fault attackssingle-bit fault injection
