Differential Characteristics of the NIST Lightweight Cryptography Standard Ascon: 42 Active S-boxes over 4 Rounds and 68 over 5 Rounds

This note analyses the permutation of Ascon, the NIST standard for lightweight authenticated encryption and hashing (SP 800-232); it proposes no new construction. It reports a 4-round differential characteristic with 42 active S-boxes and a 5-round characteristic with 68. To the best of our knowledge, the best previously known had 43 and 72. For the 4-round characteristic it gives one concrete pair of states that follows all four rounds through the reference permutation, which anyone can check in a minute (verify/check.py, no dependencies); for the 5-round characteristic there is only a per-round check and no such pair. The characteristics were also verified in Lean 4. They have weight 138 and 226, move neither the proven lower bound nor the best known weight, and do not threaten the security of Ascon. Files: the note (CC BY 4.0) and the code and proofs at tag v1.1 of the repository (MIT).