From one to three: multi-entry persistent fault analysis of Ascon

Ascon-AEAD128 is a NIST-standardized lightweight authenticated-encryption scheme. However, persistent fault analysis (PFA) of Ascon remains underexplored. The existing PFA study lacks a concrete implementation scenario and incurs relatively high plaintext-query complexity. This paper considers a round-unrolled implementation in which each round has separate hardware and shares one round-specific lookup table (LUT) across its 64 bit-sliced S-box positions. Within this setting, we propose a unified multi-entry PFA framework that integrates fault-configuration construction, fault-pattern identification, and complete 128-bit key recovery. We distinguish a strict multi-entry bit-flip model, which supports at most two distinguishable faulty entries, from a more general LUT-overwrite model, which supports up to three. We further consider direct-observation and query-based fault-pattern identification settings and derive the expected fault-injection, identification-query, and key-recovery costs. Simulations over ten configurations, with 10,000 independent trials each, closely match the theoretical results. Once a valid fault configuration is established, one-, two-, and three-entry attacks require approximately 150, 74, and 49 plaintext queries on average, respectively. The three-entry LUT-overwrite model requires approximately 49 queries on average, below the 63–451-query range reported for prior single-entry Ascon PFA.