Cast-128

The algorithm was created in 1996 by Carlisle Adams and Stafford Tavares using the CAST cipher method, which is also used by their other CAST-256 algorithm ( AES candidate algorithm).

CAST-128 consists of 12 or 16 rounds of the Feistel network with a block size of 64 bits and a key length of 40 to 128 bits (but only with an increment of 8 bits). 16 rounds are used when key sizes exceed 80 bits. The algorithm uses 8x16 S-blocks based on bent functions , XOR operations and modular arithmetic (modular addition and subtraction). There are three different types of round functions, but they are similar in structure and differ only in the choice of the operation to be performed (addition, subtraction or XOR) in different places.

Although CAST-128 is protected by the Entrust patent, it can be used worldwide for commercial or non-commercial purposes for free.

CAST is a popular 64-bit cipher that allows key sizes up to 128 bits, which was developed in Canada by Carlisle Adams and Stafford Tavares. The authors argue that the name is due to the development process and should remind of the probabilistic nature of the process, and not about the initials of the authors.

The CAST algorithm uses a 64-bit block and a 64-bit key. CAST is resistant to differential and linear cryptanalysis. The strength of the CAST algorithm lies in its S-blocks. CAST does not have fixed S-blocks, and for each application they are rebuilt. Created for a specific implementation of CAST, the S-block never changes again. In other words, S-blocks are implementation dependent, not key dependent. Northern Telecom uses CAST in its Entrust software package for Macintosh computers, PCs, and UNIX workstations. The S-blocks they selected were not published, which is not surprising, however.

CAST-128 is owned by Entrust Technologies, but is free for both commercial and non-commercial use. CAST-256 is a free, accessible CAST-128 extension that accepts a key size of up to 256 bits and has a block size of 128 bits. CAST-256 was one of the original candidates for AES.

CAST-128 is based on the Feistel network. A complete encryption algorithm is outlined in the following four steps:

  ENTRANCE: text m 1 ... m 64 , key K = k 1 ... k 128 .
 EXIT: ciphertext c 1 ... C 64 .

1. (key scan) is 16 pairs of {Kmi, Kri} subkeys obtained from K (see the sections Round Key Pairs and Non-Identical Rounds sections).

2. (L ₀ , R ₀ ) <- (m ₁ ... m ₆₄ ). (Separates the text into left and right 32-bit halves L ₀ = m ₁ ... m ₃₂ and R ₀ = m ₃₃ ... m ₆₄ ).

3. (16 rounds) for i from 1 to 16, calculate L _i and R _i as follows: L _i = R _i-1 ; R _i = L _i-1 ^ F (R _i-1 , Km _i , Kr _i ), where F is defined in the section “Round key pairs” (F is of type 1, type 2, type 3 or, depending on i) .

4.c ₁ ... c ₆₄ <- (R ₁₆ , L ₁₆ ). (Swap the final blocks with L ₁₆ , R ₁₆ and combine to form the ciphertext.)

Decryption is the same as the encryption algorithm above, except that the rounds (and therefore the pairs of subkeys) are used in the reverse order to calculate (L ₀ , R ₀ ) from (R ₁₆ , L ₁₆ ).

CAST-128 uses a pair of subkeys per round: 32-bit Km values ​​are used as a “mask” of the key, and Kr is used as a “permutation” of the key, of which only the initial 5-bit is used.

Three different types of functions are used in CAST-128. The types are as follows (where "D" is the input to function F and "I _a " - "I _d " is the most significant byte - the least significant byte I, respectively). Note that the "+" and "-" addition and subtraction modulo 2 ** 32, "^" is a bitwise XOR and "<<<" is a left shift.

CAST-128 uses eight replacement fields: fields S1, S2, S3 and S4 the round functions of the replacement fields, S5, S6, S7 and S8 are the sweep keys of the replacement fields. Although 8 replacement fields require a total of 8 Kbytes for storage, please note that only 4 Kbytes are required during actual encryption / decryption, as subkey generation is usually done before any data input. See Appendix for contents of replacement fields S1 - S8.

Imagine a 128-bit key in the form x0x1x2x3x4x5x6x7x8x9xAxBxCxDxExF, where x0 is the high byte and xF is the low byte.

Imagine z0..zF intermediate (temporary) bytes. Si [] represents the replacement field i and "^" represents the XOR addition.

Replacement fields are generated from the key x0x1x2x3x4x5x6x7x8x9xAxBxCxDxExF as follows.

  z0z1z2z3 = x0x1x2x3 ^ S5 [xD] ^ S6 [xF] ^ S7 [xC] ^ S8 [xE] ^ S7 [x8]
   z4z5z6z7 = x8x9xAxB ^ S5 [z0] ^ S6 [z2] ^ S7 [z1] ^ S8 [z3] ^ S8 [xA]
   z8z9zAzB = xCxDxExF ^ S5 [z7] ^ S6 [z6] ^ S7 [z5] ^ S8 [z4] ^ S5 [x9]
   zCzDzEzF = x4x5x6x7 ^ S5 [zA] ^ S6 [z9] ^ S7 [zB] ^ S8 [z8] ^ S6 [xB]
   K1 = S5 [z8] ^ S6 [z9] ^ S7 [z7] ^ S8 [z6] ^ S5 [z2]
   K2 = S5 [zA] ^ S6 [zB] ^ S7 [z5] ^ S8 [z4] ^ S6 [z6]
   K3 = S5 [zC] ^ S6 [zD] ^ S7 [z3] ^ S8 [z2] ^ S7 [z9]
   K4 = S5 [zE] ^ S6 [zF] ^ S7 [z1] ^ S8 [z0] ^ S8 [zC]
   x0x1x2x3 = z8z9zAzB ^ S5 [z5] ^ S6 [z7] ^ S7 [z4] ^ S8 [z6] ^ S7 [z0]
   x4x5x6x7 = z0z1z2z3 ^ S5 [x0] ^ S6 [x2] ^ S7 [x1] ^ ​​S8 [x3] ^ S8 [z2]
   x8x9xAxB = z4z5z6z7 ^ S5 [x7] ^ S6 [x6] ^ S7 [x5] ^ S8 [x4] ^ S5 [z1]
   xCxDxExF = zCzDzEzF ^ S5 [xA] ^ S6 [x9] ^ S7 [xB] ^ S8 [x8] ^ S6 [z3]
   K5 = S5 [x3] ^ S6 [x2] ^ S7 [xC] ^ S8 [xD] ^ S5 [x8]
   K6 = S5 [x1] ^ ​​S6 [x0] ^ S7 [xE] ^ S8 [xF] ^ S6 [xD]
   K7 = S5 [x7] ^ S6 [x6] ^ S7 [x8] ^ S8 [x9] ^ S7 [x3]
   K8 = S5 [x5] ^ S6 [x4] ^ S7 [xA] ^ S8 [xB] ^ S8 [x7]
   z0z1z2z3 = x0x1x2x3 ^ S5 [xD] ^ S6 [xF] ^ S7 [xC] ^ S8 [xE] ^ S7 [x8]
   z4z5z6z7 = x8x9xAxB ^ S5 [z0] ^ S6 [z2] ^ S7 [z1] ^ S8 [z3] ^ S8 [xA]
   z8z9zAzB = xCxDxExF ^ S5 [z7] ^ S6 [z6] ^ S7 [z5] ^ S8 [z4] ^ S5 [x9]
   zCzDzEzF = x4x5x6x7 ^ S5 [zA] ^ S6 [z9] ^ S7 [zB] ^ S8 [z8] ^ S6 [xB]
   K9 = S5 [z3] ^ S6 [z2] ^ S7 [zC] ^ S8 [zD] ^ S5 [z9]
   K10 = S5 [z1] ^ S6 [z0] ^ S7 [zE] ^ S8 [zF] ^ S6 [zC]
   K11 = S5 [z7] ^ S6 [z6] ^ S7 [z8] ^ S8 [z9] ^ S7 [z2]
   K12 = S5 [z5] ^ S6 [z4] ^ S7 [zA] ^ S8 [zB] ^ S8 [z6]
   x0x1x2x3 = z8z9zAzB ^ S5 [z5] ^ S6 [z7] ^ S7 [z4] ^ S8 [z6] ^ S7 [z0]
   x4x5x6x7 = z0z1z2z3 ^ S5 [x0] ^ S6 [x2] ^ S7 [x1] ^ ​​S8 [x3] ^ S8 [z2]
   x8x9xAxB = z4z5z6z7 ^ S5 [x7] ^ S6 [x6] ^ S7 [x5] ^ S8 [x4] ^ S5 [z1]
   xCxDxExF = zCzDzEzF ^ S5 [xA] ^ S6 [x9] ^ S7 [xB] ^ S8 [x8] ^ S6 [z3]
   K13 = S5 [x8] ^ S6 [x9] ^ S7 [x7] ^ S8 [x6] ^ S5 [x3]
   K14 = S5 [xA] ^ S6 [xB] ^ S7 [x5] ^ S8 [x4] ^ S6 [x7]
   K15 = S5 [xC] ^ S6 [xD] ^ S7 [x3] ^ S8 [x2] ^ S7 [x8]
   K16 = S5 [xE] ^ S6 [xF] ^ S7 [x1] ^ ​​S8 [x0] ^ S8 [xD]

The remaining half is identical to that given above, a continuation from the latter created x0..xF to generate keys K17 - K32.

  z0z1z2z3 = x0x1x2x3 ^ S5 [xD] ^ S6 [xF] ^ S7 [xC] ^ S8 [xE] ^ S7 [x8]
   z4z5z6z7 = x8x9xAxB ^ S5 [z0] ^ S6 [z2] ^ S7 [z1] ^ S8 [z3] ^ S8 [xA]
   z8z9zAzB = xCxDxExF ^ S5 [z7] ^ S6 [z6] ^ S7 [z5] ^ S8 [z4] ^ S5 [x9]
   zCzDzEzF = x4x5x6x7 ^ S5 [zA] ^ S6 [z9] ^ S7 [zB] ^ S8 [z8] ^ S6 [xB]
   K17 = S5 [z8] ^ S6 [z9] ^ S7 [z7] ^ S8 [z6] ^ S5 [z2]
   K18 = S5 [zA] ^ S6 [zB] ^ S7 [z5] ^ S8 [z4] ^ S6 [z6]
   K19 = S5 [zC] ^ S6 [zD] ^ S7 [z3] ^ S8 [z2] ^ S7 [z9]
   K20 = S5 [zE] ^ S6 [zF] ^ S7 [z1] ^ S8 [z0] ^ S8 [zC]
   x0x1x2x3 = z8z9zAzB ^ S5 [z5] ^ S6 [z7] ^ S7 [z4] ^ S8 [z6] ^ S7 [z0]
   x4x5x6x7 = z0z1z2z3 ^ S5 [x0] ^ S6 [x2] ^ S7 [x1] ^ ​​S8 [x3] ^ S8 [z2]
   x8x9xAxB = z4z5z6z7 ^ S5 [x7] ^ S6 [x6] ^ S7 [x5] ^ S8 [x4] ^ S5 [z1]
   xCxDxExF = zCzDzEzF ^ S5 [xA] ^ S6 [x9] ^ S7 [xB] ^ S8 [x8] ^ S6 [z3]
   K21 = S5 [x3] ^ S6 [x2] ^ S7 [xC] ^ S8 [xD] ^ S5 [x8]
   K22 = S5 [x1] ^ ​​S6 [x0] ^ S7 [xE] ^ S8 [xF] ^ S6 [xD]
   K23 = S5 [x7] ^ S6 [x6] ^ S7 [x8] ^ S8 [x9] ^ S7 [x3]
   K24 = S5 [x5] ^ S6 [x4] ^ S7 [xA] ^ S8 [xB] ^ S8 [x7]
   z0z1z2z3 = x0x1x2x3 ^ S5 [xD] ^ S6 [xF] ^ S7 [xC] ^ S8 [xE] ^ S7 [x8]
   z4z5z6z7 = x8x9xAxB ^ S5 [z0] ^ S6 [z2] ^ S7 [z1] ^ S8 [z3] ^ S8 [xA]
   z8z9zAzB = xCxDxExF ^ S5 [z7] ^ S6 [z6] ^ S7 [z5] ^ S8 [z4] ^ S5 [x9]
   zCzDzEzF = x4x5x6x7 ^ S5 [zA] ^ S6 [z9] ^ S7 [zB] ^ S8 [z8] ^ S6 [xB]
   K25 = S5 [z3] ^ S6 [z2] ^ S7 [zC] ^ S8 [zD] ^ S5 [z9]
   K26 = S5 [z1] ^ S6 [z0] ^ S7 [zE] ^ S8 [zF] ^ S6 [zC]
   K27 = S5 [z7] ^ S6 [z6] ^ S7 [z8] ^ S8 [z9] ^ S7 [z2]
   K28 = S5 [z5] ^ S6 [z4] ^ S7 [zA] ^ S8 [zB] ^ S8 [z6]
   x0x1x2x3 = z8z9zAzB ^ S5 [z5] ^ S6 [z7] ^ S7 [z4] ^ S8 [z6] ^ S7 [z0]
   x4x5x6x7 = z0z1z2z3 ^ S5 [x0] ^ S6 [x2] ^ S7 [x1] ^ ​​S8 [x3] ^ S8 [z2]
   x8x9xAxB = z4z5z6z7 ^ S5 [x7] ^ S6 [x6] ^ S7 [x5] ^ S8 [x4] ^ S5 [z1]
   xCxDxExF = zCzDzEzF ^ S5 [xA] ^ S6 [x9] ^ S7 [xB] ^ S8 [x8] ^ S6 [z3]
   K29 = S5 [x8] ^ S6 [x9] ^ S7 [x7] ^ S8 [x6] ^ S5 [x3]
   K30 = S5 [xA] ^ S6 [xB] ^ S7 [x5] ^ S8 [x4] ^ S6 [x7]
   K31 = S5 [xC] ^ S6 [xD] ^ S7 [x3] ^ S8 [x2] ^ S7 [x8]
   K32 = S5 [xE] ^ S6 [xF] ^ S7 [x1] ^ ​​S8 [x0] ^ S8 [xD]

Km ₁ , ..., Km ₁₆ 32-bit plug-in disguises (one per round). Kr ₁ ,, Kr ₁₆ 32-bit permutations of subkeys (one per round); only the lower 5 bits are used in each round.

for (i = 1; i <= 16; i ++) {Km _i = Ki; Kr _i = K16 + i; }

CAST-128 The encryption algorithm was designed so that the key size can vary from 40 to 128 bits, in an 8-bit step (i.e., valid key sizes are 40, 48, 56, 64 ..., 112, 120, and 128 bits). For variable key size work, the specification is as follows:

1) For key sizes up to and including 80 bits (i.e., 40, 48, 56, 64, 72, and 80 bits), the algorithm is exactly the same, but uses 12 rounds instead of 16;

2) For key sizes larger than 80 bits, the algorithm uses the full 16 rounds;

3) For key sizes less than 128 bits, the key is padded with zero bytes (in the rightmost or lowest positions) to 128 bits (since the CAST 128 key schedule accepts an 128 bit input key).

S-Box S1

S-Box S2

S-Box S3

S-Box S4

S-Box S5

S-Box S6

S-Box S7

S-Box S8

Decryption for CAST-128 is relatively simple. Decryption works in the same algorithmic direction as encryption, starting with encrypted text as input. In this case, the subkeys are used in the opposite direction.

• RFC 2144 - CAST-128 Algorithm
• CAST Algorithm Publications