For Full-Text PDF, please login, if you are a member of IEICE,|
or go to Pay Per View on menu list, if you are a nonmember of IEICE.
Differential Cryptanalysis of CAST-256 Reduced to Nine Quad-Rounds
Haruki SEKI Toshinobu KANEKO
IEICE TRANSACTIONS on Fundamentals of Electronics, Communications and Computer Sciences
Publication Date: 2001/04/01
Print ISSN: 0916-8508
Type of Manuscript: Special Section PAPER (Special Section on Fundamentals of Information and Communications)
block cipher, AES, CAST-256, differential cryptanalysis, weak key,
Full Text: PDF(394.4KB)>>
The block cipher CAST-256 based on CAST-128 was a candidate algorithm for the AES round 1. In this paper we present a first result of a differential attack on CAST-256 reduced to 9 quad-rounds. One of the three round functions of CAST-256 has differential characteristics, for which a non-zero inputxor results in a zero outputxor, with high probability. This type of characteristic is the most useful for differential attack. We also show that CAST-256 has weak keys with respect to differential attack. Thus CAST-256 reduced to 9 quad-rounds can be attacked using 2123 chosen plaintexts in the case of differentially weak keys. The time complexity is about 2100 encryptions. Immunity to differential cryptanalysis of CAST-256 is not necessarily improved compared with CAST-128. Only 5 rounds of CAST-128 can be attacked using a similar differential characteristic.