New Differential Cryptanalytic Results for Reduced-Round CAST-128

Meiqin WANG  Xiaoyun WANG  Kam Pui CHOW  Lucas Chi Kwong HUI  

IEICE TRANSACTIONS on Fundamentals of Electronics, Communications and Computer Sciences   Vol.E93-A   No.12   pp.2744-2754
Publication Date: 2010/12/01
Online ISSN: 1745-1337
DOI: 10.1587/transfun.E93.A.2744
Print ISSN: 0916-8508
Type of Manuscript: PAPER
Category: Cryptography and Information Security
block cipher,  differential cryptanalysis,  CAST-128,  weak key,  

Full Text: PDF(474.3KB)>>
Buy this Article

CAST-128 is a block cipher used in a number of products, notably as the default cipher in some versions of GPG and PGP. It has been approved for Canadian government use by the Communications Security Establishment. Haruki Seki et al. found 2-round differential characteristics and they can attack 5-round CAST-128. In this paper, we studied the properties of round functions F1 and F3 in CAST-128, and identified differential characteristics for F1 round function and F3 round function. So we identified a 6-round differential characteristic with probability 2-53 under 2-23.8 of the total key space. Then based on 6-round differential characteristic, we can attack 8-round CAST-128 with key sizes greater than or equal to 72 bits and 9-round CAST-128 with key sizes greater than or equal to 104 bits. We give the summary of attacks on reduced-round CAST-128 in Table 10.