Citation :

Mohammed Khaire Hussain , 2026. "Truncated Authentication Tags for Ascon-AEAD128 over LoRa: A Risk Analysis of Forgery, Failure-Limit Denial of Service, Airtime and Packet Errors under NIST SP 800-232" ESP International Journal of Advancements in Science & Technology (ESP-IJAST)  Volume 4, Issue 4: 40-51.

Abstract :

LoRa devices send payloads of a few bytes, so every authentication-tag byte is a large share of each frame. NIST SP 800-232 standardises Ascon-AEAD128 for constrained devices, permits tags shorter than 64 bits only after a careful risk analysis, and bounds the verification failures tolerated per key. This study performs that analysis for LoRa uplinks. An analytical model links the tag length to time on air, forgery probability against a channel-time-limited attacker, the attacker airtime needed to exhaust the failure budget and force a key update, benign budget consumption by corrupted frames that pass the 16-bit LoRa CRC, and packet errors. It is evaluated for SF7–SF12 with a bit-exact LoRa physical-layer simulator verified against 240 NIST test vectors and the exact symbol-error rate. A 64-bit tag shortens time on air by 4.8–18.7% relative to a 128-bit tag, and about 61% of 8-bit tag increments cost no airtime. Longer frames cost at most 0.23 dB in AWGN. Under the strict failure limit, tags shorter than 64 bits let one forged frame force a key update. The minimum admissible tag is therefore 64 bits under the strict limit and 48–56 bits under the relaxed limit.

References :

[1] F. Adelantado, X. Vilajosana, P. Tuset-Peiro, B. Martinez, J. Melia-Segui and T. Watteyne, Understanding the limits of LoRaWAN, IEEE Commun. Mag. 55(9) (2017) 34–40. https://doi.org/10.1109/MCOM.2017.1600613

[2] M. Bor, U. Roedig, T. Voigt and J. Alonso, Do LoRa low-power wide-area networks scale?, Proc. 19th ACM Int. Conf. Modeling, Analysis and Simulation of Wireless and Mobile Systems (MSWiM) (2016) 59–67. https://doi.org/10.1145/2988287.2989163

[3] L. Vangelista, Frequency shift chirp modulation: The LoRa modulation, IEEE Signal Process. Lett. 24(12) (2017) 1818–1821. https://doi.org/10.1109/LSP.2017.2762960

[4] T. Elshabrawy and J. Robert, Closed-form approximation of LoRa modulation BER performance, IEEE Commun. Lett. 22(9) (2018) 1778–1781. https://doi.org/10.1109/LCOMM.2018.2849718

[5] J. Tapparel, O. Afisiadis, P. Mayoraz, A. Balatsoukas-Stimming and A. Burg, An open-source LoRa physical layer prototype on GNU Radio, Proc. IEEE 21st Int. Workshop on Signal Processing Advances in Wireless Communications (SPAWC) (2020). https://doi.org/10.1109/SPAWC48557.2020.9154273

[6] LoRa Alliance Technical Committee, LoRaWAN L2 1.0.4 Specification (TS001-1.0.4), LoRa Alliance, Technical Specification (2020).

[7] LoRa Alliance Technical Committee, RP002-1.0.3 LoRaWAN Regional Parameters, LoRa Alliance, Technical Specification (2021).

[8] Semtech Corporation, SX1272/3/6/7/8: LoRa Modem Designer’s Guide, Application Note AN1200.13, Rev. 1 (2013).

[9] X. Yang, E. Karampatzakis, C. Doerr and F. Kuipers, Security vulnerabilities in LoRaWAN, Proc. IEEE/ACM 3rd Int. Conf. Internet-of-Things Design and Implementation (IoTDI) (2018) 129–140. https://doi.org/10.1109/IoTDI.2018.00022

[10] I. Butun, N. Pereira and M. Gidlund, Security risk analysis of LoRaWAN and future directions, Future Internet 11(1) (2019) 3. https://doi.org/10.3390/fi11010003

[11] P. Thaenkaew, B. Quoitin and A. Meddahi, Leveraging larger AES keys in LoRaWAN: A practical evaluation of energy and time costs, Sensors 23(22) (2023) 9172. https://doi.org/10.3390/s23229172

[12] Z. A. Simin, S. Aslan, M. M. Carvalho and D. Valles, Enhanced security of bidirectional communication in IoT-driven utility networks using Sertainty UXP and LoRaWAN, Sensors 26(6) (2026) 1752. https://doi.org/10.3390/s26061752

[13] V. Shkuratskyy, A. B. Usman, H. Bagheri, S. Hill and S. K. Memon, Evaluating lightweight and post-quantum encryption for compressed image transmission over LoRa in the era of edge AI, Discov. Electron. 3(1) (2026) 114. https://doi.org/10.1007/s44291-026-00261-4

[14] G. Amirkhanova, S. Ismailov, A. Amirkhanov, S. Adilzhanova, M. Zhasuzakova and S. Chen, A lightweight, end-to-end encrypted data pipeline for IIoT: An AES-GCM implementation for ESP32, MQTT, and Raspberry Pi, Information 17(1) (2026) 33. https://doi.org/10.3390/info17010033

[15] Atul, V. Shukla, M. K. Das, V. Shukla and D. Mishra, A reproducible security–performance benchmark protocol for lightweight AEAD on resource-constrained IoT nodes, IACR Cryptology ePrint Archive, Paper 2026/1882 (2026).

[16] M. Sönmez Turan, K. A. McKay, D. Chang, J. Kang and J. Kelsey, Ascon-based lightweight cryptography standards for constrained devices: Authenticated encryption, hash, and extendable output functions, NIST Special Publication 800-232 (2025). https://doi.org/10.6028/NIST.SP.800-232

[17] C. Dobraunig, M. Eichlseder, F. Mendel and M. Schläffer, Ascon v1.2: Lightweight authenticated encryption and hashing, J. Cryptol. 34(3) (2021) 33. https://doi.org/10.1007/s00145-021-09398-9

[18] C. Lefevre and B. Mennink, SoK: Security of the Ascon modes, IACR Trans. Symmetric Cryptol. 2025(1) (2025) 138–210. https://doi.org/10.46586/tosc.v2025.i1.138-210

[19] M. Sönmez Turan, K. A. McKay, D. Chang, L. Bassham, J. Kang, N. Waller, J. Kelsey and D. Hong, Status report on the final round of the NIST lightweight cryptography standardization process, NIST Internal Report 8454 (2023). https://doi.org/10.6028/NIST.IR.8454

[20] M. Dworkin, Recommendation for block cipher modes of operation: Galois/Counter Mode (GCM) and GMAC, NIST Special Publication 800-38D (2007). https://doi.org/10.6028/NIST.SP.800-38D

[21] N. Ferguson, Authentication weaknesses in GCM, Public comment submitted to NIST (2005).

[22] C. J. Mitchell, Truncation attacks on MACs, Electron. Lett. 39(20) (2003) 1439–1440. https://doi.org/10.1049/el:20030921

[23] L. Ferreira, Sigforgery: Breaking and fixing data authenticity in Sigfox, Financial Cryptography and Data Security (FC 2021), Lecture Notes in Computer Science, Springer (2021) 331–350. https://doi.org/10.1007/978-3-662-64322-8_16

[24] E. Wagner, M. Serror, K. Wehrle and M. Henze, When and how to aggregate message authentication codes on lossy channels?, Applied Cryptography and Network Security (ACNS 2024), Lecture Notes in Computer Science 14584 (2024) 241–264. https://doi.org/10.1007/978-3-031-54773-7_10

[25] I. Andrushchak and O. Koloshko, Algorithmic selection of MAC tag length for short messages: Balancing the risks of substitution, delay, and throughput, Int. Sci. J. Eng. Agric. 4(6) (2025) 15–27. https://doi.org/10.46299/j.isjea.20250406.02

[26] D. Ochkas, H. Le Bouder and A. Pelov, Ascon-AEAD128 for COSE and JOSE, IETF Internet-Draft draft-ochkas-cose-ascon-03, work in progress (2026).

[27] P. Koopman and T. Chakravarty, Cyclic redundancy code (CRC) polynomial selection for embedded networks, Proc. Int. Conf. Dependable Systems and Networks (DSN) (2004) 145–154. https://doi.org/10.1109/DSN.2004.1311885

[28] R. Daidone, G. Dini and G. Anastasi, On evaluating the performance impact of the IEEE 802.15.4 security sub-layer, Comput. Commun. 47 (2014) 65–76. https://doi.org/10.1016/j.comcom.2014.03.025

[29] National Institute of Standards and Technology, ACVP-Server: Automated Cryptographic Validation Test System — generation/validation JSON files, GitHub repository usnistgov/ACVP-Server, accessed September 2026.

[30] J. G. Proakis and M. Salehi, Digital Communications, 5th ed., McGraw-Hill, New York, NY, USA (2008).

[31] C. J. Clopper and E. S. Pearson, The use of confidence or fiducial limits illustrated in the case of the binomial, Biometrika 26(4) (1934) 404–413. https://doi.org/10.1093/biomet/26.4.404

Keywords :

Ascon, Authenticated Encryption, Internet of Things Security, Lora, Message Authentication Tag Length, Physical-Layer Simulation.