Elec onics Le e s
LETTER
De ailed Assessmen o Ha dwa e Implemen a ions, A acks
and Coun e measu es o he Ascon Au hen ica ed Ciphe
Miguel Ma ín-González1,2E ica Tena-Sánchez1,2F ancisco Eugenio Po es ad-O dóñez1,2An onio J. Acos a1,3
1Ins i u o de Mic oelec ónica de Se illa IMSE-CNM, CSIC/Uni e si y o Se ille, Se illa, Spain 2Depa men o Elec onics Technology, Escuela Poli écnica
Supe io , Uni e si y o Se ille, Se illa, Spain 3Depa men o Elec onics and Elec omagne ism, Facul y o Physics, Uni e si y o Se ille, Se illa, Spain
Co espondence: Miguel Ma ín-González ([email p o ec ed])
Recei ed: 5 Ma ch 2025 Re ised: 11 Ap il 2025 Accep ed: 14 Ap il 2025
Funding: This wo k has been unded by he p ojec G an PID2020-116664RB-I00 unded by MCIN/AEI/10.13039/501100011033. Au ho s wan o hank he
SPIRS (Secu e Pla o m o ICT Sys ems Roo ed a he Silicon Manu ac u ing P ocess) P ojec wi h G an Ag eemen No. 952622 unde he Eu opean Union’s
Ho izon 2020 Resea ch and Inno a ion P og amme and he Minis e io de Asun os Económicos y T ans o mación Digi al h ough TSI-069100-2023-1
PERTE-Chip Chai P ojec , wi h Nex Gene a ionEU unds.
ABSTRACT
The design and implemen a ion o ligh weigh -o ien ed ciphe s on ha dwa e has u ned in o an u gen ma e wi h he expansi e
ield o In e ne o Things (IoT) and he e e inc easing p esence o small elec onic de ices ha equi e as and secu e
communica ion in ou mode n wo ld. In 2023, he Ascon ciphe was selec ed as he new s anda d au hen ica ed enc yp ion wi h
associa ed da a (AEAD) algo i hm o ligh weigh en i onmen s by he Na ional Ins i u e o S anda ds and Technology (NIST).
This pape p o ides a ull compa ison and join e alua ion o he ha dwa e implemen a ions, a acks and coun e measu es ha
ha e been p oposed o Ascon since i was published, aiming o shed ligh on some open de elopmen pa hs in addi ion o enable
he ha dwa e designe o make be e in o med decisions. All in all, Ascon implemen a ions end o achie e g ea pe o mance
while s aying ligh weigh , bu unp o ec ed implemen a ions a e ulne able o ha dwa e a acks, and some a acks can e en dodge
coun e measu es. The e y p omising Ascon ciphe will su ely h i e in he ield o ligh weigh c yp og aphy, bu u he wo k
in o he design o secu e implemen a ions is s ill needed, being his pape a g ea s a ing poin o esea che s and designe s alike.
1 In oduc ion
Nowadays, he as majo i y o digi al elecommunica ion de ices
employ ciphe s when secu e communica ion is equi ed. How-
e e , many o he cu en ly used c yp og aphic algo i hms
a e oo esou ce in ensi e o be usable in ligh weigh (LW)
en i onmen s, whe e esou ces and powe a e highly limi ed.
These cons ained de ices a e inc easingly common wi h he
g owing In e ne o Things (IoT), so he de elopmen o LW-
o ien ed ciphe s has la ely been a e y ac i e ield o s udy.
No s anda d ciphe o ligh weigh en i onmen s exis ed un il
he US Na ional Ins i u e o S anda ds and Technology (NIST)
hos ed he Ligh weigh C yp og aphy S anda disa ion p ojec
[1] in 2018, which concluded in 2023 wi h he selec ion o he
Ascon ciphe as he new s anda d au hen ica ed enc yp ion wi h
associa ed da a (AEAD) ciphe o LW c yp og aphy [2]. Wi h
a ixed s anda d, de elopmen e o s can be mo e ocused and
exhaus i e.
Ascon’s ul ima e selec ion was due o i s ou s andingly a ac i e
ligh weigh -o ien ed design, ha is, i s simplici y, i s obus ness
agains c yp analysis and he ew po en ial leakage poin s ha
could be exploi able by ha dwa e a acks. Fu he mo e, Ascon
was also p e iously selec ed as he p ima y choice o au hen-
ica ed enc yp ion in ligh weigh applica ions in he CAESAR
compe i ion, ha an om 2013 o 2019 [3].
This is an open access a icle unde he e ms o he C ea i e Commons A ibu ion License, which pe mi s use, dis ibu ion and ep oduc ion in any medium, p o ided he o iginal wo k is p ope ly
ci ed.
© 2025 The Au ho (s). Elec onics Le e s published by John Wiley & Sons L d on behal o The Ins i u ion o Enginee ing and Technology.
Elec onics Le e s,2025;61:e70260
h ps://doi.o g/10.1049/ell2.70260
1o 8
TABLE 1 Implemen a ion schemes, ela i e expec ed pe o mance and cos . Re e ence alues a e ep esen ed as ‘⋅’, ela i e inc emen as ‘↑’, and
ela i e dec emen as ‘↓’.
Implemen a ion scheme A ea Powe La ency Th oughpu
I e a ed/Recu si e [8–19]⋅⋅ ⋅ ⋅
Se ialised [8, 12, 18]↓↓ ↓↓ ↑ ↓↓
Un olled [8, 12, 14, 17, 18, 20]↑↑ ↑↑ ↓ ↑↑
Pipelined [21]↑↑ ↑ ↑
Howe e , e en i a ciphe is ma hema ically esis an o c yp -
analysis, i s ha dwa e secu i y is no gua an eed, as physical
in o ma ion leakage h ough side channels on physical imple-
men a ions may be exploi able by ha dwa e a acks. Many iable
a acks on ciphe s ha e been de eloped hese pas ew decades
[4], bu e en i many coun e measu e schemes ha e been p o-
posed agains hem, he e is no gene al coun e measu e able o
neu alise all o hem simul aneously [5].
This pape aims o p o ide a ull compa ison and quali a i e
e alua ion o he published Ascon ha dwa e implemen a ions in
li e a u e so a , he ha dwa e a acks pe o med on hem, and
he p oposed coun e measu es agains said a acks, upda ing he
wo k in [6] wi h ull compa isons and u he analysis.
2The Ascon Ciphe
Ascon has been designed wi h LW en i onmen s in mind [2],
whe e esou ces a e sca ce. I s simplici y p o ides g ea eedom
o ollow di e en implemen a ion schemes while a he same
ime managing o main ain g ea pe o mance and asking in
e u n minimal implemen a ion sac i ices. As a symme ic AEAD
algo i hm, i makes use o symme ic sec e keys, as well as a
public nonce pe message and message ags o au hen ica ion.
I is able o enciphe /deciphe a bi a y-leng h messages wi h
o wi hou associa ed da a. The in e es ed eade may e e o
he o icial documen a ion [2] o an exhaus i e desc ip ion o
Ascon’s pe mu a ion and i s algo i hmic s uc u e.
The NIST s anda d speci ica ions [7] a e s ill a d a as o he
w i ing o his pape . Some naming con en ions a e modi ied in
i , bu he o iginal names om Ascon documen a ion [2] will
be main ained he e o be e compa ibili y wi h he e e enced
da a. Co espondence be ween names is s a ed in he s anda d
speci ica ions d a [7]. Tha being said, Ascon is in ac an
algo i hmic amily able o p o ide AEAD and hashing. This pape
a ge s Ascon-128 (named Ascon-AEAD128 in he new s anda d),
he de aul membe o he Ascon AEAD amily. All amily
membe s sha e mos o hei in e nal s uc u e, so conclusions
de i ed he e should be mos ly po able amongs hem.
3HW Implemen a ions
To he bes o ou knowledge, 72 FPGA and 31 ASIC Ascon-128
implemen a ions ha e been published on li e a u e so a . This
sec ion del es a li le on he di e en implemen a ion schemes
usable on Ascon, and p o ides some compa a i e me ics in o de
o enable he designe o make mo e in o med decisions when
deciding a p ope scheme o ollow.
As a block ciphe , Ascon allows he ha dwa e designe o choose
se e al dis inc implemen a ion schemes, some o hem p io i ise
ce ain ea u es while o he s a e able o s ike balance be ween
some o all o hem. Table 1shows he gene ic schemes ha
could be es ablished, wi h hei associa ed ela i e expec ed cos s
and pe o mance me ics. I mus be aken in o accoun ha ,
in gene al, hese schemes a e no mu ually exclusi e and can
be applied in a g adual manne . They a e b ie ly desc ibed as
ollows:
∙I e a i e/ ecu si e implemen a ions pe o m pe mu a ion
ounds i e a i ely un il he ull ciphe phase is comple e.
This is usually he mos balanced scheme so i is aken as a
e e ence in Table 1.
∙Se ialisa ion consis s o educing he da a block size p ocessed
in pa allel. This is e y a ac i e when esou ce minimisa-
ion is equi ed, bu pe o mance su e s consequen ly wi h
educed pa allelism.
∙Loop un olling allows i e a ion coun s o be educed, ull
un olling can e en dispose o ecu si i y, being able o pe -
o m a comple e ciphe phase combina ionally. This allows
ex eme h oughpu po en ial, bu a a massi e a ea and powe
cos .
∙Pipelining consis s o segmen ing combina ional s ages wi h
egis e laye s in be ween, which may p o ide a signi ican
inc ease in h oughpu as idle s ages can be educed, a he
expense o a highe sensi i i y o clock gli ches.
A sole pipelined implemen a ions ha e been con i med in li e a-
u e, bu i may be possible some o hem we e le unaccoun ed
o , minu e implemen a ion de ails a e no always disclosed
by au ho s. Mos implemen a ions a e i e a ed as only ull
un olling can p e en he need o ecu si eness. Fully un olled
implemen a ion we e p oposed in [14]and[12], bu hei a ea
equi emen s we e on a e age a ull o de o magni ude g ea e
han he implemen a ions shown he e. I could be a gued ha ,
Ascon being a LW-o ien ed ciphe , ull un olling is con adic o y
o his end, he associa ed a ea cos s a e insu moun able when
esou ces a e ew.
Figu e 1shows se e al published Ascon-128 implemen a ions on
a ious FPGA pla o ms, plo ing hei achie ed da a h oughpu
e sus he a ea hey equi e in look-up ables (LUTs). Each
implemen a ion shown is ep esen ed by a shape ha deno es
2o 8 Elec onics Le e s,2025
1350911x, 2025, 1, Downloaded om h ps://ie esea ch.onlinelib a y.wiley.com/doi/10.1049/ell2.70260 by Readcube (Lab i a Inc.), Wiley Online Lib a y on [30/06/2025]. See he Te ms and Condi ions (h ps://onlinelib a y.wiley.com/ e ms-and-condi ions) on Wiley Online Lib a y o ules o use; OA a icles a e go e ned by he applicable C ea i e Commons License
FIGURE 1 Ascon FPGA implemen a ions. A ea e iciency:
Achie ed da a h oughpu e sus a ea equi ed.
i s main implemen a ion scheme, hey a e also colou -coded
o he FPGA pla o m whe e hey we e benchma ked, wi h a
label o iden i ica ion. Implemen a ions labelled N-p om [12]
and un olled-N om [8] pe o m loop un olling, execu ing N
pe mu a ions pe clock cycle. Implemen a ions se ial-M om
[12] a e se ialised, p ocessing Mbi s pe clock cycle. Imple-
men a ion (RECO-HCON) [13] uses a econ igu able a chi ec u e
able o ope a e ei he as Ascon-128, Ascon-128a, Ascon-Hash o
Ascon-Hasha, he e he ull a ea is conside ed, al hough only
h oughpu o he Ascon-128 is shown. Some implemen a ions
we e i ed wi h ha dwa e coun e measu es, implemen a ions
labelled as (h-TI) [10, 19] ep esen hyb id 2/3-sha e h eshold
implemen a ions, men ioned la e wi h o he coun e measu es.
As i can be seen om he igu es, pa ially un olled implemen-
a ions achie e high h oughpu bu g ea e un olling equi es
mo e a ea, pa ially se aialised implemen a ions end o be less
pe o man h oughpu -wise bu a e smalle in gene al, and HW
coun e measu es a e a ea in ensi e, as expec ed.
Figu e 2plo s he equency equi ed on each o he p e iously
shown FPGA implemen a ions o achie e hei s a ed a ea
e iciency (a ea e iciency is de ined he e as he a io be ween
an implemen a ion’s achie ed da a h oughpu and he a ea i
equi es, wha was plo ed in Figu e 1). Tha is, he speed a which
hey need o ope a e o each hei measu ed h oughpu -a ea
a io in Figu e 1. Some conclusions can be eached wi h hese
da a. As one could expec , he less bi s p ocessed a he same ime
in se ialised implemen a ions, he lowe he a ea e iciency wi h
a ixed ope a ing equency. Pe haps su p isingly, high un olling
may end up being coun e -p oduc i e, as combina ional pa hs
can become so long ha he maximum ope a ing equency may
su e a g ea e limi a ion, educing h oughpu wi h i . Ye again,
he p esence o HW coun e measu es dec eases pe o mance.
E en wi h all published implemen a ions, da a a e sca ce and no
uni ied. As i can be seen, mos implemen e s a ge ed Spa an-
6 FPGAs, he e a e no enough da a a ailable o o he FPGA
models. Few implemen a ions we e i ed wi h HW coun e -
FIGURE 2 Ascon FPGA implemen a ions. Ope a ing equency
e sus a ea e iciency (achie ed-da a- h oughpu /a ea- equi ed).
measu es: Only h eshold implemen a ions ha e been applied
agains powe analysis a acks [10, 15, 19], and only e o de ec ion
echniques ha e been employed agains aul injec ion a acks
[11, 15] (wi hou enough da a o be shown in hese igu es).
Mo e de ails will be gi en abou a acks and coun e measu es in
subsequen sec ions. Howe e , e y ew ASIC implemen a ions
ha e been p oposed, and ew wi hin common echnology nodes,
so da a a e insu icien o ela i e pe o mance e alua ions. S ill,
a highe coun e measu e di e si y has been published o ASIC,
enabling ela i e implemen a ion cos compa isons, shown la e
in Table 6.
4HW A acks on Ascon
Ha dwa e a acks exploi unsuspec ed in o ma ion leakage
h ough side-channels usually p esen on physical implemen-
a ions. They can b eak ciphe s by analysing a iables ha
hold co ela ions wi h sec e alues. Two main a ack ca ego ies
may be dis inguished: aul injec ion a acks and side-channel
a acks (mo e conc e ely powe analysis a acks). A a ie y o
a acks om bo h kinds ha e been pe o med on Ascon, he
wo ollowing sec ions del e b ie ly on he na u e o bo h a ack
ca ego ies, he published HW a acks on Ascon, and Ascon’s
esis ance o hem when implemen ed on di e en pla o ms.
Faul injec ion a acks (FIA) eco e in o ma ion om a ciphe ’s
ou pu alue dis ibu ions. On a co ec ly wo king ciphe , i s
enciphe ed ou pu should appea andom, holding no exploi able
co ela ion wi h sec e in o ma ion. FIA in ends o o ce he
ciphe o leak sec e s h ough i s ou pu by injec ing aul s du ing
i s ope a ion, be i h ough he ci cui ’s clock signal, powe inpu
o h ough elec omagne ic emi e s. Tha way, ou pu alues
may p esen endencies and show co ela ions wi h ideally sec e
in e media e alues, which FIA uses o disco e he sec e key.
Th ee FIA a acks ha e been pe o med and published on Ascon
o da e, wi h hei esul s collec ed in Table 2. All o hem ha e
3o 8
1350911x, 2025, 1, Downloaded om h ps://ie esea ch.onlinelib a y.wiley.com/doi/10.1049/ell2.70260 by Readcube (Lab i a Inc.), Wiley Online Lib a y on [30/06/2025]. See he Te ms and Condi ions (h ps://onlinelib a y.wiley.com/ e ms-and-condi ions) on Wiley Online Lib a y o ules o use; OA a icles a e go e ned by he applicable C ea i e Commons License
TABLE 2 Faul injec ion a acks pe o med on Ascon.
A ack Injec ions A acked pla o m
SIFA [22] 13 o 2500 sim. unp o . SW
FIMA [23] 305 o 250 sim. unp o . SW
SSFA [24] 70 o100 sim.unp o .SW
been pe o med by simula ion on unp o ec ed SW implemen a-
ions, a ge ing he las ound o he ciphe ope a ion’s S-box o
aul injec ion and using he message ag as he ou pu o analyse:
∙S a is ical ine ec i e aul analysis (SIFA) a ack [22], ins ead
o eco e ing in o ma ion om aul y ciphe ou pu s, exploi s
ou pu s om ine ec i e aul injec ions, ha is, ou pu s ha
emain co ec a e an injec ion as a esul o aul s ha we e
unable o p opaga e h ough he ciphe o i s ou pu s.
∙Faul in ensi y map analysis (FIMA) a ack [23] combines
SIFA wi h aul in ensi y analysis, so i ga he s in o ma ion
as well abou he a ge ’s aul sensi i i y (how in ense aul s
ha e o be o become e ec i e).
∙SubSe aul analysis (SSFA) a ack [24] exploi s bi - ese
aul injec ions wi h a chosen g anula i y ( he amoun o bi s
a ec ed), and ies o guess he key one agmen a a ime
h ough subse c yp analysis.
I can be seen ha Ascon is no secu e agains FIA, al hough
a ack pe o mance would likely be lowe in physical scena ios
as opposed o simula ed en i onmen s, whe e noise is ha de o
con ol. Fu he mo e, HW implemen a ions end o be less leaky
han SW unning on mic op ocesso s.
Side-channel a acks (SCA), also called powe analysis a acks,
aim o eco e sec e s by exploi ing he co ela ion be ween
a a ge de ice’s powe consump ion wi h i s in e nal s a e
logic alues and/o hei ansi ions. Published SCA ended
o a ge he s a ing ound’s S-box on Ascon’s ope a ion o
powe ace collec ion, exploi ing he ac ha mos o he
s a ing in e nal s a e is known, only he a ge key is p i a e
una ailable in o ma ion.
Two main SCA ca ego ies can be dis inguished, depending on
hedeg eeo con ol hea acke hason he a ge de iceo he
knowledge equi ed abou he in e nal sys em: model-based and
p o iling a acks.
In model-based SCA, p e ious knowledge abou he way he
ciphe is implemen ed is needed, as a powe leakage model has o
be de eloped in o de o p edic powe consump ion aces. Then,
h ough co ela ion analysis wi h he ga he ed a ge ’s powe
aces, he a acke may be able o in e he key associa ed wi h
he measu ed aces. Table 3shows published esul s o hese
di e en a ack echniques.
The adi ional and well known di e en ial powe analysis (DPA)
a acks [17, 25] and co ela ion powe analysis (CPA) a acks [26–
29] equi e a conc e e model o he a ge S-box o gene a e he
p edic ed powe aces. On he o he hand, he inno a i e side
channel analysis wi h ein o cemen lea ning (SCARL) a ack
[30] employs a e sa ile gene alised leakage model usable on S-
boxes o a gi en o de , so i does no equi e a p e ious p edic ed
ace da abase. I i s he gene alised leakage model au oma ically
o he ecei ed a ack aces h ough ein o cemen lea ning wi h
an ac o -c i ic neu al ne wo k sys em.
In con as o model-based a acks, p o iling a acks do no need
a p e ious leakage model, hey build a powe consump ion
p o ile o he a ge de ice be o e he a ack. This p o ile o
empla e maps ciphe inpu s gi en by he a acke o he powe
consump ion associa ed o hei p ocessing. Thus, he a acke is
equi ed o ha e ull con ol o e he a ge de ice o some ime
p io o he a ack. Wi h a ich enough p o ile, e y ew a ack
aces a e needed o es ablish a key guess by co ela ion analysis.
Table 4shows he bes -pe o ming p o iling a ack echniques
ha ha e been pe o med on Ascon.
So analy ical side channel a ack (SASCA) [33], uses a ac o
g aph ha ollows sec e alue p obabili y dis ibu ions p opaga -
ing h ough he ciphe o be e empla e ma ching; i was la e
ein o ced wi h linea disc imina ion analysis (SASCA-LDA) [31]
o educing compu a ional complexi y h ough ace educ ion.
The empla e a ack (TA) pe o med in [29] educes p o iling
aces h ough he de ec ion o poin s o in e es aiming o lowe
compu a ional complexi y du ing co ela ion analysis. Fu he -
mo e, some p o iling a acks make use o neu al ne wo ks, deep
lea ning side channel analysis (DLSCA) a ack [28], also called
deep lea ning assis ed side channel analysis (DLASCA) a ack
in [29], employs neu al ne wo ks, be i mul i-laye pe cep ons
(MLPs) o con olu ional neu al ne wo ks (CNNs) ained on he
p o iling aces as a ack ace analyse s. In [29], ans e lea ning
was also applied o ne wo k p e- aining wi h simula ed powe
aces, his educes he amoun o a ack aces equi ed, bu he
a acke needs o ha e a de ice model o p e ious simula ion
like in model-based a acks. Fu he mo e, in [32], a p elimina y
ensemble-based deep lea ning side channel analysis (EDLSCA)
pa ial hal -key- eco e y a ack was pe o med o demons a e
ha neu al ne wo k ensembles can enhance co ela ion analysis
h ough DLSCA, bu no ull a ack was pe o med. As i can be
seen, neu al ne wo ks ha e g ea po en ial as p o iling a ack ools
o leakage assessmen .
5HW Coun e measu es
I can be concluded om he p e ious sec ion ha unp o ec ed
Ascon implemen a ions, be i HW o unning on SW, a e no
sa e om HW a acks. Ha dwa e coun e measu es can ein o ce
implemen a ions by educing in o ma ion leakage, bu always
wi h some implemen a ion cos s. Sadly, no uni e sal coun e -
measu e scheme exis s, hough many echniques ha e been
p oposed, each one is only able o shield agains ce ain a acks.
P ac ical p o ec ion can only be achie ed by combining hem,
which usually en ails hea y implemen a ion sac i ices.
Coun e measu e schemes agains aul injec ion a acks p oposed
o Ascon may be g ouped in wo main ca ego ies:
∙E o de ec ion/co ec ion [11, 15, 34–37]: Based mainly upon
ope a ion edundance and esul compa ison o in ope a ion
esul signa u e e i ica ion, p e en s e o p opaga ion by
4o 8 Elec onics Le e s,2025
1350911x, 2025, 1, Downloaded om h ps://ie esea ch.onlinelib a y.wiley.com/doi/10.1049/ell2.70260 by Readcube (Lab i a Inc.), Wiley Online Lib a y on [30/06/2025]. See he Te ms and Condi ions (h ps://onlinelib a y.wiley.com/ e ms-and-condi ions) on Wiley Online Lib a y o ules o use; OA a icles a e go e ned by he applicable C ea i e Commons License
TABLE 3 Model-based powe analysis a acks on Ascon.
A ack A ack aces A acked pla o m
DPA [25]∽10
4unp o . HW, Spa an-6.
[17] 500 sim. ASIC 90nm, Ascon-x-low-a ea.
[17] 1000 sim. ASIC 90nm, Ascon- as .
CPA [26]2×104unp o . HW, Spa an-6.
[27]5×105unp o . SW, 32-bi , STM32F407IGT6.
[28] 8000 unp o . SW, 32-bi , STM32F303.
[29] 2000 unp o . SW, 32-bi , RV32IMC 180nm
SCARL [30]2.4 ×104unp o . HW, A ix-7.
TABLE 4 P o iling powe analysis a acks on Ascon.
A ack P o iling aces A ack aces A acked pla o m
SASCA-LDA [31] 81,000 2 unp o . SW, 32-bi , STM32F303.
TA [29] 90,000 573 unp o . SW, 32-bi , 180nm RV32IMC.
DLSCA MLP [32] 50,000 20 unp o . SW, 32-bi , ATMega8515.
DLASCA CNN [29] 95,000 500 unp o . SW, 32-bi , 180nm RV32IMC.
DLASCA CNN + ans e lea ning [29] 60,000 175 unp o . SW 32-bi , 180nm RV32IMC.
con amina ing esul s when one is de ec ed, o co ec ing
e o s be o e hey ha e a chance o p opaga e. Co ec ion is a
equi emen o neu alising SIFA a acks, bu i needs a leas
ope a ion iplica ion. Depending on he a ge edundancy,
a ea and powe cos s may be la ge when implemen ing hese
coun e measu es.
∙In ec i e coun e measu es [37–39]: These exo ic echniques
a e based on gua an eeing ull, balanced and consis en e o
p opaga ion, in ec ing ciphe ou pu s when aul s ha e been
injec ed in such a way ha no usable endency will e e be
p esen , and no ine ec i e aul s may e e ake place as all o
hem ge o p opaga e.
Al e na i ely, all HW coun e measu es p oposed agains powe
analysis a acks o Ascon all unde he masking umb ella.
Masking consis s in di iding in e nal sec e alues in o inde-
penden ‘sha es’ by mixing da a wi h andomness. Tha way,
ope a ions ha may be leaky a e pe o med in an al e na i e da a
ep esen a ion in which leakage is ha mless. The ans o ma ion
can only be e e sed by mixing all sha es, which inc eases he
amoun o in o ma ion he a acke has o ga he o unco e
usable sec e s.
The di e en masking schemes, compa a i e achie able imple-
men a ion ea u es and associa ed cos s a e shown in Table 5.
B ie ly iden i ying each o he echniques men ioned:
∙Th eshold implemen a ions (TIs) [10, 15, 19]makeuseo
a leas h ee sha es. They a e he mos common masking
scheme nowadays as hey p e en leakage h ough gli ches
and hei design is no especially complex. Thei cos s a e
aken as e e ence in Table 5as all o he masking schemes a e
buil upon hem. ‘Hyb id’ TIs [10, 19] use wo sha es whe e
possible o educe o e head wi hou comp omising secu i y.
∙Domain o ien ed masking (DOM) [40, 41]: Encloses sha es
in o domains o gua an ee sha e independence, imposing
ha d domain bounda y cons ain s o p e en collisions ha
may euni e sha es p ema u ely, which would comp omise
secu i y.
∙Uni ied masking app oach (UMA) [41]: Uni ies echniques
om so wa e and ha dwa e masking aiming o educe
la ency and andomness equi emen s.
∙Gene ic low-la ency masking (GLM) [42]: Relaxes DOM’s
domain cons ain s o g ea ly educe la ency, bu design
complexi y inc eases as sha e collisions a e ha de o p e en .
∙SEl -SYnch onising masking (SESYM) [43]: Uses wa e
dynamic di e en ial logic (WDDL) and sel -synch onising
echniques o educe equi ed in e nal sequen ial laye s o
lowe la ency, a a massi e a ea cos .
∙E icien low-la ency masking wi hou esh andomness
(ELM) [44]: Disposes o esh andomness equi emen s by
u ilising neighbou S-box sha es as andomness sou ces.
All he men ioned coun e measu e schemes ha e been p oposed
heo e ically agains he ha dwa e a acks gi en he e, bu only
a ew o hem ha e been implemen ed physically wi h hei
p o ec ion es ed and hei ea u es benchma ked. On Table 6,
ocus is placed on ela i e implemen a ion cos s o he ew
coun e measu e schemes ha ha e been implemen ed on HW
and benchma ked o Ascon. Columns show, om le o igh :
ela i e inc ease o dec ease in a ea, powe , la ency/c i ical pa h
delay, and h oughpu . Being ela i e/no malised alues, esul s
5o 8
1350911x, 2025, 1, Downloaded om h ps://ie esea ch.onlinelib a y.wiley.com/doi/10.1049/ell2.70260 by Readcube (Lab i a Inc.), Wiley Online Lib a y on [30/06/2025]. See he Te ms and Condi ions (h ps://onlinelib a y.wiley.com/ e ms-and-condi ions) on Wiley Online Lib a y o ules o use; OA a icles a e go e ned by he applicable C ea i e Commons License
TABLE 5 Masking coun e measu es, ela i e implemen a ion ea u es and cos s. Re e ence alues a e ep esen ed as ‘⋅’, ela i e inc emen as ‘↑’,
ela i e dec emen as ‘↓’.
Technique A ea La ency Th oughpu Rand. eq. Design comp.
TI: 3-sha e [15]⋅⋅ ⋅ ⋅ ⋅
Hyb id TI: 2/3-sha e [10, 19]↓⋅ ⋅ ↓ ⋅
DOM [40, 41]↓↓ ⋅ ↓ ↑
UMA [41]↑↓ ↓ ↓↓ ↑
GLM [42]↑↑ ↓ ↑ ↑↑ ↑↑
SESYM [43]↑↑↑ ↓ ↑ ↓ ↑↑
ELM [44]↑↓ ↑ ∅ ↑↑
TABLE 6 Rela i e coun e measu e implemen a ion cos s.
Pla o m Cn msu e. A ea Powe La ency Th oughpu
[11] FPGA: Spa an-7 unp o . 1x 1x 1x 1x
sig. 1-bi 1.01x 1.00x 1.00x 1.00x
in e lea ed-bi 1.02x 1.00x 1.00x 1.00x
CRC-3 1.10x 1.00x 1.05x 0.96x
[11] FPGA: Kin ex-7 unp o . 1x 1x 1x 1x
sig. 1-bi 1.01x 0.99x 1.00x 1.00x
in e lea ed-bi 1.02x 0.99x 1.00x 1.00x
CRC-3 1.02x 0.99x 1.02x 0.98x
[17][18] ASIC: 90nm as 1x 1x N/A 1x
as -TI 3.83x 4.23x N/A 0.68x
x-low-a ea 1x 1x N/A 1x
x-low-TI 2.45x 3.00x N/A 1.07x
[15] ASIC: 130 nm unp o . 1x 1x 1x N/A
e . d c. 2.62x 3.08x 1.00x N/A
TI 3.70x 5.73x 1.15x N/A
TI +e . d c. 9.63x 14.58x 1.15x N/A
should be pa ially ex apolable o o he ASIC echnologies o
FPGA pla o ms. As i can be seen, da a a e s ill e y limi ed, e y
ew coun e measu e schemes ha e been physically implemen ed
and benchma ked, be i on hei own o combined wi h o he s,
le alone es ed agains HW a acks.
6 Conclusions
Ascon will su ely ecei e much a en ion in he immedia e u u e
while i ipens as he new NIST-appoin ed s anda d ligh weigh
AEAD ciphe . A sizeable amoun o Ascon HW implemen a ions
ha e been published, mos o hem on FPGAs, e y ew as ASIC.
In bo h cases, a limi ed a ie y o coun e measu es ha e been
implemen ed. Se e al HW a acks ha e been success ul agains
unp o ec ed Ascon, hough mos o he published a acks we e
pe o med on mic ocon olle s unning SW implemen a ions.
Thus, mo e a acks on HW implemen a ions a e equi ed o
es a ack pe o mance. The e a e now many coun e measu e
schemes p oposed in heo y, bu e en i coun e measu es a e
heo e ically secu e, leakage can s ill occu on HW whe e pa -
asi ics and couplings a e ubiqui ous. E en small couplings and
o he highe o de e ec s can lead o exploi able leakage s ill
when coun e measu es a e p esen . Physical coun e measu e
implemen a ions and hei e alua ion a e impe a i e, as e y ew
schemes ha e been physically designed, benchma ked and es ed
on HW o da e. As a e needed a acks agains implemen a ions i -
ed wi h coun e measu es, bo h o es coun e measu e s eng h
and a ack powe . All in all, Ascon is expec ed o h i e in he
ield o LW c yp og aphy in he nea u u e, bu u he wo k is
ye equi ed un il i is eady o gene al deploymen .
Au ho Con ibu ions
Miguel Ma ín-González: da a cu a ion, o mal analysis, in es iga ion,
me hodology, esou ces, so wa e, alida ion, isualiza ion, w i ing
6o 8 Elec onics Le e s,2025
1350911x, 2025, 1, Downloaded om h ps://ie esea ch.onlinelib a y.wiley.com/doi/10.1049/ell2.70260 by Readcube (Lab i a Inc.), Wiley Online Lib a y on [30/06/2025]. See he Te ms and Condi ions (h ps://onlinelib a y.wiley.com/ e ms-and-condi ions) on Wiley Online Lib a y o ules o use; OA a icles a e go e ned by he applicable C ea i e Commons License
– o iginal d a , w i ing – e iew and edi ing. E ica Tena-Sánchez:
concep ualiza ion, o mal analysis, unding acquisi ion, p ojec
adminis a ion, supe ision, alida ion, w i ing – e iew and edi ing.
F ancisco Eugenio Po es ad-O dóñez: o mal analysis, alida ion,
w i ing – e iew and edi ing. An onio J. Acos a: concep ualiza ion,
o mal analysis, unding acquisi ion, p ojec adminis a ion, supe ision,
alida ion, w i ing – e iew and edi ing.
Acknowledgemen s
This wo k has been unded by he p ojec G an PID2020-116664RB-
I00 unded by MCIN/AEI/10.13039/501100011033. Au ho s wan o hank
he SPIRS (Secu e Pla o m o ICT Sys ems Roo ed a he Silicon
Manu ac u ing P ocess) P ojec wi h G an Ag eemen No. 952622 unde
he Eu opean Union’s Ho izon 2020 esea ch and inno a ion p og amme
and he Minis e io de Asun os Económicos y T ans o mación Digi al
h ough TSI-069100-2023-1 PERTE-Chip Chai P ojec , wi h Nex Gene a-
ionEU unds.
Con lic s o In e es
The au ho s decla e no con lic s o in e es .
Da a A ailabili y S a emen
The da a ha suppo he indings o his s udy a e a ailable h ough he
a icle’s e e ence lis .
Re e ences
1. NIST, “Ligh weigh C yp og aphy S anda disa ion P ojec ,” accessed
Janua y 8, 2025, h ps://cs c.nis .go /p ojec s/ligh weigh -c yp og aphy
(2024).
2. C. Dob aunig, M. Eichlsede , F. Mendel, and M. Schlä e , “Ascon 1.2,”
Submission o NIST Ligh weigh C yp og aphy S anda disa ion P ojec ,
h ps://ascon.iaik. ug az.a /speci ica ion.h ml (2021).
3. CAESAR, “Caesa Submissions Final Po olio,” accessed Janua y 8,
2025, h ps://compe i ions.c .yp. o/caesa -submissions.h ml (2025).
4. F. X. S andae , “Secu e In eg a ed Ci cui s and Sys ems. In eg a ed
Ci cui s and Sys ems,” in In oduc ion o Side-Channel A acks (Sp inge ,
2009), 27–42.
5. W. Hu, C.-H. Chang, A. Sengup a, e al., “An O e iew o Ha dwa e
Secu i y and T us : Th ea s, Coun e measu es, and Design Tools,” IEEE
T ansac ions on Compu e -Aided Design o In eg a ed Ci cui s and Sys ems
40, no. 6 (2021): 1010–1038, h ps://doi.o g/10.1109/TCAD.2020.3047976.
6. M. Ma ín-González, E. Tena-Sanchez, F. E. Po es ad O döñez, and A.
J. Acos a, “Ha dwa e Implemen a ions, SCA/FIA a acks, and Coun e -
measu es o he Ascon AEAD Ciphe : A e iew,” in 2024 39 h Con e ence
on Design o Ci cui s and In eg a ed Sys ems (DCIS) (IEEE, 2024), 1–6,
h ps://doi.o g/10.1109/DCIS62603.2024.10769155.
7. NIST, “Nis sp 800-232 (Ini ial Public D a ), Ascon-Based Ligh weigh
C yp og aphy S anda ds o Cons ained De ices: Au hen ica ed Enc yp-
ion, Hash, and Ex endable Ou pu Func ions,” Na ional Ins i u e o
S anda ds and Technology, accessed Feb ua y 7, 2025, h ps://cs c.nis .
go /pubs/sp/800/232/ipd.
8. M. Fi ez and I. Ve bauwhede, “Ene gy E icien Ha dwa e
Implemen a ions o CAESAR Submissions,” (PhD Thesis, KU Leu en,
2016), h ps://cosicda abase.esa .kuleu en.be/backend/publica ions/
iles/ hese/279.
9. P. Yalla and J. P. Kaps, “E alua ion o he Caesa Ha dwa e API
o Ligh weigh Implemen a ions,” in 2017 In e na ional Con e ence on
ReConFigu able Compu ing and FPGAs (ReConFig), (IEEE, 2017), 1–6,
h ps://doi.o g/10.1109/RECONFIG.2017.8279790.
10. W. Diehl, F. Fa ahmand, A. Abdulgadi , J.-P. Kaps, and K. Gaj, “Face-
O Be ween he Caesa Ligh weigh Finalis s: Aco n s. Ascon,” in
2018 In e na ional Con e ence on Field-P og ammable Technology (FPT),
(IEEE, 2018), 330–333, h ps://doi.o g/10.1109/FPT.2018.00066.
11. J. Kau , M. M. Ke mani, and R. Aza de akhsh, “Ha dwa e Cons uc-
ions o E o De ec ion in Ligh weigh Au hen ica ed Ciphe Ascon
Benchma ked on FPGA,” IEEE T ansac ions on Ci cui s and Sys ems II:
Exp ess B ie s 69, no. 4 (2022): 2276–2280, h ps://doi.o g/10.1109/TCSII.
2021.3136463.
12. S. Khan, W. K. Lee, and S. O. Hwang, “Scalable and E icien Ha dwa e
A chi ec u es o Au hen ica ed Enc yp ion in IOT Applica ions,” IEEE
In e ne o Things Jou nal 8, no. 14 (2021): 11260–11275, h ps://doi.o g/10.
1109/JIOT.2021.3052184.
13. X. Wei, M. El-Hadedy, S. Mosanu, Z. Zhu, W.-M. Hwu, and X. Guo,
“RECO-hcon: A High-Th oughpu Recon igu able Compac Ascon P o-
cesso o T us ed IOT,” in 2022 IEEE 35 h In e na ional Sys em-on-Chip
Con e ence (SOCC) (IEEE, 2022), 1–6.
14. S. Khan, W. K. Lee, and S. O. Hwang, “E alua ing he Pe o mance
o Ascon Ligh weigh Au hen ica ed Enc yp ion o AI-Enabled IoT
De ices,” in 2022 TRON Symposium (TRONSHOW) (IEEE, 2022), 1–6,
h ps://ieeexplo e.ieee.o g/abs ac /documen /10024417.
15. A. Kandi, A. Baksi, T. Ge lich, e al., “Ha dwa e Implemen a ion o
Ascon,” NIST Ligh weigh C yp og aphy Wo kshop 2023, accessed Jan-
ua y 8, 2025, h ps://cs c.nis .go /e en s/2023/ligh weigh -c yp og aphy-
wo kshop-2023.
16. K. Raj and S. Bodapa i, “Fpga Based Ligh Weigh Enc yp ion o
Medical Da a o IOMT De ices Using Ascon Ciphe ,” in 2022 IEEE
In e na ional Symposium on Sma Elec onic Sys ems (iSES) (IEEE, 2022),
196–201, h ps://doi.o g/10.1109/iSES54909.2022.00048.
17. H. G oss, E. Wenge , C. Dob aunig, and C. Eh enhö e , “Ascon
Ha dwa e Implemen a ions and Side-Channel E alua ion,” Mic op oces-
so s and Mic osys ems 52 (2017): 470–479, h ps://doi.o g/10.1016/j.micp o.
2016.10.006.
18. H. G oss, E. Wenge , C. Dob aunig, and C. Eh enhö e , “Sui up!
– Made-To-Measu e Ha dwa e Implemen a ions o Ascon,” in 2015
Eu omic o Con e ence on Digi al Sys em Design (IEEE, 2015), 645–652.
19. W. Diehl, A. Abdulgadi , F. Fa ahmand, J.-P. Kaps, and K. Gaj,
“Compa ison o Cos o P o ec ion Agains Di e en ial Powe Analysis o
Selec ed Au hen ica ed Ciphe s,” in 2018 IEEE In e na ional Symposium
on Ha dwa e O ien ed Secu i y and T us (HOST) (IEEE, 2018), 147–152,
h ps://doi.o g/10.1109/HST.2018.8383904.
20. A. Abdulgadi , W. Diehl, and J. P. Kaps, “An Open-Sou ce Pla o m
o E alua ion o Ha dwa e Implemen a ions o Ligh weigh Au hen-
ica ed Ciphe s,” in 2019 In e na ional Con e ence on ReConFigu able
Compu ing and FPGAs (ReConFig) (IEEE, 2019), 1–5, h ps://doi.o g/10.
1109/ReConFig48160.2019.8994788.
21. G. Su ya, P. Mais i, and S. Sanka an, “Local Clock Gli ching Faul
Injec ion Wi h Applica ion o he Ascon Ciphe ,” in 2020 IEEE In e -
na ional Symposium on Sma Elec onic Sys ems (iSES) (IEEE, 2020),
271–276, h ps://doi.o g/10.1109/iSES50453.2020.00067.
22. K. Ramezanpou , P. Ampadu, and W. Diehl, “A S a is ical Faul
Analysis Me hodology o he Ascon Au hen ica ed Ciphe ,” in 2019
IEEE In e na ional Symposium on Ha dwa e O ien ed Secu i y and T us
(HOST) (IEEE, 2019), 41–50, h ps://doi.o g/10.1109/HST.2019.8741029.
23. K. Ramezanpou , P. Ampadu, and W. Diehl, “Fima: Faul In ensi y
Map Analysis,” in Cons uc i e Side-Channel Analysis and Secu e Design
(Sp inge ,2019),63–79,h ps://doi.o g/10.1007/978-3-030-16350-1_5.
24. P. Joshi and B. Mazumda , “Ss a: Subse Faul Analysis o Ascon-
128 Au hen ica ed Ciphe ,” Mic oelec onics Reliabili y 123 (2021): 114–155,
h ps://doi.o g/10.1016/j.mic o el.2021.114155.
25. N. Samwel and K. Papagiannopoulos, “Side-Channel Analysis o
Keccak and Ascon,” (mas e ’s hesis, Radboud Uni e si y Nijmegen,
2016), h ps://api.seman icschola .o g/Co pusID:43167034.
26. N. Samwel and J. Daemen, “DPA on Ha dwa e Implemen a ions
o Ascon and Keyak,” in CF’17: P oceedings o he Compu ing F on ie s
7o 8
1350911x, 2025, 1, Downloaded om h ps://ie esea ch.onlinelib a y.wiley.com/doi/10.1049/ell2.70260 by Readcube (Lab i a Inc.), Wiley Online Lib a y on [30/06/2025]. See he Te ms and Condi ions (h ps://onlinelib a y.wiley.com/ e ms-and-condi ions) on Wiley Online Lib a y o ules o use; OA a icles a e go e ned by he applicable C ea i e Commons License
Con e ence (Associa ion o Compu ing Machine y, 2017), 415–424,
h ps://doi.o g/10.1145/3075564.3079067.
27. L. Ba ina, I. R. Buhan, L. M. Chmielewski, e al., Side-Channel E alua-
ion Repo on Implemen a ions o Se e al NIST LWC Finalis s, (Nijmegen:
C yp og aphic Enginee ing & Side-Channel Analysis (CESCA) Lab,
2022), h ps://hdl.handle.ne /2066/253567.
28. L. Weissba and S. Picek, “Ligh weigh Bu No Easy: Side-Channel
Analysis o he Ascon Au hen ica ed Ciphe on a 32-Bi Mic ocon olle ,”
p ep in , C yp ology eP in A chi e, Oc obe 16,2023,h ps://ep in .iac .
o g/2023/1598.
29. D. Shanmugam and P. Schaumon , “Imp o ing Side-Channel Leakage
Assessmen Using P e-Silicon Leakage Models,” in Cons uc i e Side-
Channel Analysis and Secu e Design (Sp inge , 2023), 105–124, h ps://doi.
o g/10.1007/978-3-031-29497-6_6.
30. K. Ramezanpou , P. Ampadu, and W. Diehl, “Sca l: Side-Channel
Analysis Wi h Rein o cemen Lea ning on he Ascon Au hen ica ed
Ciphe ,” p ep in , a Xi :2006.03995, June 6, 2020, h ps://doi.o g/10.
48550/a Xi .2006.03995.
31. S. C. You, M. G. Kuhn, S. Sa ka , and F. Hao, “Low T ace-Coun
Templa e A acks on 32-Bi Implemen a ions o Ascon AEAD,” IACR
T ansac ions on C yp og aphic Ha dwa e and Embedded Sys ems 2023, no.
4 (2023): 344–366, h ps://doi.o g/10.46586/ ches. 2023.i4.344-366.
32. A. Rezaeezade, A. Basu o-Bece a, L. Weissba , and G. Pe in,
“One o All, All o Ascon: Ensemble-Based Deep Lea ning Side-
Channel Analysis,” p ep in , C yp ology eP in A chi e, Pape 2023/1922,
Decembe 16, 2023, h ps://ep in .iac .o g/2023/1922.
33. S. Lou, W. Wu, Y. Li, R. Zhang, and Z. Liu, “An E icien So
Analy ical Side-Channel A ack on Ascon,” Wi eless Algo i hms, Sys ems,
and Applica ions (Sp inge , 2022), 389–400, h ps://doi.o g/10.1007/978-
3-031-19208-1_32.
34. S. Saha, D. Jap, D. B. Roy, A. Chak abo y, S. Bhasin, and D.
Mukhopadhyay, “A F amewo k o Coun e S a is ical Ine ec i e Faul
Analysis o Block Ciphe s Using Domain T ans o ma ion and E o
Co ec ion,” IEEE T ansac ions on In o ma ion Fo ensics and Secu i y 15
(2020): 1905–1919, h ps://doi.o g/10.1109/TIFS.2019.2952262.
35. A. Baksi, V. B. Y. Kuma , B. Ka maka , S. Bhasin, D. Saha, and A.
Cha opadhyay, “A No el Duplica ion Based Coun e measu e o S a is i-
cal Ine ec i e Faul Analysis,” p ep in , C yp ology eP in A chi e, Pape
2020/1268, Oc obe 14, 2020, h ps://ep in .iac .o g/2020/1268.
36. A. Baksi, S. Bhasin, J. B eie , A. Cha opadhyay, and V. B. Y.
Kuma , “Feeding Th ee Bi ds Wi h One Scone: A Gene ic Duplica ion
Based Coun e measu e o Faul A acks (Ex ended Ve sion),” p ep in ,
C yp ology eP in A chi e, Pape 2020/1542, Decembe 13, 2020, h ps://
ep in .iac .o g/2020/1542.
37. J. Daemen, C. Dob aunig, M. Eichlsede , H. G oss, F. Mendel, and
R. P imas, “P o ec ing Agains S a is ical Ine ec i e Faul A acks,”
p ep in , C yp ology eP in A chi e, Pape 2019/536, May 22, 2019, h ps://
ep in .iac .o g/2019/536.
38. J. Jacob, J. Joseph, M. K. Abinshad, K. N. Ambili, and J. Jose,
“P e en ion o Faul A acks in Ascon Au hen ica ed Ciphe Using
Cellula Au oma a,” in Cellula Au oma a (Sp inge , 2021), 18–25, h ps://
doi.o g/10.1007/978-3-030-69480-7_3.
39. K. N. Ambili and J. Jose, “Rein o cing Ligh weigh Au hen ica ed
Enc yp ion Schemes Agains S a is ical Ine ec i e Faul A ack,” C yp-
ology eP in A chi e, Pape 2022/041, Janua y 14, 2022, h ps://ep in .iac .
o g/2022/041.
40. H. G oss, S. Manga d, and T. Ko ak, “Domain-O ien ed Masking:
Compac Masked Ha dwa e Implemen a ions Wi h A bi a y P o ec ion
O de ,” in P oceedings o he 2016 ACM Wo kshop on Theo y o Imple-
men a ion Secu i y (Associa ion o Compu ing Machine y, 2016), 1–3,
h ps://ep in .iac .o g/2016/486.
41. H. G oss and S. Manga d, “Reconciling d+1 Masking in Ha dwa e and
So wa e,” p ep in , C yp ology eP in A chi e, Pape 2017/103, 26 June,
2017, h ps://ep in .iac .o g/2017/103.
42. H. G oss, R. Iusupo , and R. Bloem, “Gene ic Low-La ency Mask-
ing in Ha dwa e,” IACR T ansac ions on C yp og aphic Ha dwa e and
Embedded Sys ems 2018, no. 2 (2018): 1–21, h ps://doi.o g/10.13154/ ches.
2018.i2.1-21.
43. R. Nagpal, B. Gige l, R. P imas, and S. Manga d, “Riding he Wa es
Towa ds Gene ic Single-Cycle Masking in Ha dwa e,” IACR T ansac ions
on C yp og aphic Ha dwa e and Embedded Sys ems 2022, no. 4 (2022):
693–717, h ps://doi.o g/10.46586/ ches. 2022.i4.693-717.
44. S. H. P asad, F. Mendel, M. Schlae e , and R. Nagpal, “E icien
Low-La ency Masking o Ascon Wi hou F esh Randomness,” p ep in ,
C yp ology eP in A chi e, Pape 2023/1914, 13 Decembe , 2023, h ps://
ep in .iac .o g/2023/1914.
8o 8 Elec onics Le e s,2025
1350911x, 2025, 1, Downloaded om h ps://ie esea ch.onlinelib a y.wiley.com/doi/10.1049/ell2.70260 by Readcube (Lab i a Inc.), Wiley Online Lib a y on [30/06/2025]. See he Te ms and Condi ions (h ps://onlinelib a y.wiley.com/ e ms-and-condi ions) on Wiley Online Lib a y o ules o use; OA a icles a e go e ned by he applicable C ea i e Commons License
