[jona-f]

This thread fails to mention that a cipher has to be somewhat hard to compute or someone with a lot of resources can't just brute force it. Therefore you also want an implementation of a given cipher to be as efficient as possible, so that no future improvement lowers the security of your cipher.

[adrian_b]

"Lightweight" cryptography is not intended for smartphones, personal computers and similarly powerful devices.

It is intended only for microcontrollers embedded in various systems, e.g. the microcontrollers from a car or from a robot that automate various low-level functions (not the general system control), or from various sensors or appliances.

It is expected that the data exchanged by such microcontrollers is valuable only if it can be deciphered in real time.

If an attacker would be able to decipher the recorded encrypted data by brute force after a month, or even after a week, it is expected that the data will be useless. Otherwise, standard cryptography must be used.

[tptacek]

... without, however, creating the impression that Ascon or Xoodyak could be broken by brute force in a week, a month, or a century.