One aspect is to have a lightweight AEAD; AES is only a block cipher. The closest comparison would be AES-GCM. NIST has been testing the algorithms on ATmega32

One aspect is to have a lightweight AEAD; AES is only a block cipher. The closest comparison would be AES-GCM. NIST has been testing the algorithms on ATmega328P in software, with specific comparisons to AES-GCM, where Ascon was twice as fast[0]. They also study hardware designs for various fabs; there was a study also giving significantly better results there[1]. > supports 256-bit keys (which are actually secure against quantum search) (Small note here: this topic is a bit more complex than this, since Grover’s algorithm does not have a constant gate factor with respect to the number of key bits. 128-bit keys already require a number of gates that is unrealistic for a quantum computer to have, similar to expecting a classical computer to have over a quettabyte of RAM.) [0]: https://csrc.nist.gov/csrc/media/Presentations/2022/update-on-the-nist-lwc-standardization-process/images-media/session-1-turan-update-on-nist-lwc-standardization-process.pdf https://csrc.nist.gov/csrc/media/Presentations/2022/update-o... [1]: https://cryptography.gmu.edu/athena/LWC/SCA_Evaluation_and_Benchmarking_of_LWC_Finalists.pdf https://cryptography.gmu.edu/athena/LWC/SCA_Evaluation_and_B...