The IIS Chip Gallery

Asconda (2026)

by

Adrien De Winter, Benedikt Wahl

Main Details

Application	Pulp
Technology	130
Manufacturer	IHP
Type	Teaching
Package	QFN56
Dimensions	2500μm x 2000μm
Gates	100 kGE
Voltage	1.2 V
Power	24 mW @100 MHz
Clock	100 MHz

Description

ASCONDA is a full VLSI integration of the ASCON V3 hardware accelerator into the Croc SoC, a CVE2-based RV32I research platform fabricated in IHP SG13 CMOS5L technology. ASCON was selected as the NIST Lightweight Cryptography Standard (SP 800-232, 2023). The accelerator is implemented as an OBI slave in the SoC user domain, supporting all four ASCON operating modes: AEAD128 (authenticated encryption with associated data), Hash256, XOF128, and CXOF128.

Across 13 benchmarks covering all four ASCON operating modes (AEAD128, Hash256, XOF128, and CXOF128), the ASCON V3 hardware achieves an 83x-317x speedup over a pure software implementation, with a geometric mean of about 145x. This range follows directly from the cost of software ASCON on CVE2s RV32I ISA, which needs roughly 1,200-1,680 instructions for a 12-round permutation owing to 64-bit decomposition into two 32-bit instructions per operation, ten rotations per round that contribute around 480-960 instructions over p12, byte-marshaling overhead, and instruction-fetch latency from SRAM, whereas the hardware completes the same permutation in three clock cycles.

The ASCON V3 accelerator occupies 20.7 kGE, representing 27.2% of the 76.1 kGE total standard-cell logic area. The complete physical design, closes timing at 100 MHz with a worst-case setup slack of +0.39 ns.

Our Contributions

1. RTL integration: Full integration of the ASCON V3 accelerator into the Croc SoC user domain with an OBI slave interface, completion interrupt, and a verified C driver.
2. Variant justification: A systematic comparison of ASCON hardware variants motivating the selection of V3 (32-bit bus width, 4-round unrolling), which aligns with CVE2's native datapath without requiring a bus-width adapter.
3. SRAM placement exploration: An automated sweep of seven SRAM macro placement strategies, demonstrating that global-route overflow is a better routability predictor than HPWL, and identifying the Straddle configuration as optimal.
4. Complete physical design: Synthesis (Yosys), placement, clock-tree synthesis, routing, IR-drop analysis, DRC (KLayout), and LVS (Calibre) which returned all clean on IHP SG13G2.
5. Stimuli power analysis: VCD-based power measurement with two contrasting workloads (compute- only and ASCON cryptographic), isolating the ASCON permutation combinational switching signature (20x combinational power increase).

This chip is part of the 2026 edition of the VLSI Design course at ETH Zurich.

Related Publication

No related publications yet