Network Working Group C. Adams Request for Comments: 2612 J. Gilchrist Category: Informational Entrust Technologies June 1999
The CAST-256 Encryption Algorithm
Status of this Memo
This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (1999). All Rights Reserved.
Abstract
There is always a desire in the Internet community for unencumbered encryption algorithms with a range of key sizes that can provide security for a variety of cryptographic applications and protocols.
This document describes an existing algorithm that can be used to satisfy this requirement. Included are a description of the cipher and the key scheduling algorithm, the s-boxes, and a set of test vectors (Appendix A).
Table of Contents
Abstract........................................................1 1. Introduction.................................................2 2. CAST-256 Algorithm Specification.............................2 3. Cipher Naming................................................8 4. Cipher Usage.................................................8 5. Security Considerations......................................8 6. References...................................................9 7. Authors' Addresses...........................................9 Appendix A. Test Vectors.......................................10 Full Copyright Statement.......................................19
Adams & Gilchrist Informational [Page 1]
RFC 2612 The CAST-256 Encryption Algorithm June 1999
This document describes the CAST-256 encryption algorithm, a DES-like Substitution-Permutation Network (SPN) cryptosystem built upon the CAST-128 encryption algorithm [1] which appears to have good resistance to differential cryptanalysis, linear cryptanalysis, and related-key cryptanalysis. This cipher also possesses a number of other desirable cryptographic properties, including avalanche, Strict Avalanche Criterion (SAC), Bit Independence Criterion (BIC), no complementation property, and an absence of weak and semi-weak keys. It thus appears to be a good candidate for general-purpose use throughout the Internet community wherever a cryptographically- strong, freely-available encryption algorithm is required.
CAST-256 has a block size of 128 bits and a variable key size (128, 160, 192, 224, or 256 bits).
The following notation from CAST-128 [1] is relevant to CAST-256.
CAST-128 uses a pair of subkeys per round: a 5-bit quantity Kri is used as a "rotation" key for round i and a 32-bit quantity Kmi is used as a "masking" key for round i.
Three different round functions are used in CAST-128. The rounds are as follows (where D is the data input to the operation, Ia - Id are the most significant byte through least significant byte of I, respectively, Si is the ith s-box (see Section 2.1.1 for s-box contents), and O is the output of the operation). Note that "+" and "-" are addition and subtraction modulo 2**32, "^" is bitwise eXclusive-OR, and "<<<" is the circular left-shift operation.
Type 1: I = ((Kmi + D) <<< Kri) O = ((S1[Ia] ^ S2[Ib]) - S3[Ic]) + S4[Id]
Type 2: I = ((Kmi ^ D) <<< Kri) O = ((S1[Ia] - S2[Ib]) + S3[Ic]) ^ S4[Id]
Type 3: I = ((Kmi - D) <<< Kri) O = ((S1[Ia] + S2[Ib]) ^ S3[Ic]) - S4[Id]
Let f1, f2, f3 be keyed round function operations of Types 1, 2, and 3 (respectively) above.
Adams & Gilchrist Informational [Page 2]
RFC 2612 The CAST-256 Encryption Algorithm June 1999
CAST-128 uses four round function substitution boxes (s-boxes), S1 - S4. These are defined as follows (entries -- written in hexadecimal notation -- are to be read left-to-right, top-to- bottom).
The following notation is employed in the specification of CAST-256.
Let f1, f2, f3 be as defined for CAST-128.
Let BETA = (ABCD) be a 128-bit block where A, B, C and D are each 32 bits in length.
Let "BETA <- Qi(BETA)" be short-hand notation for the following: C = C ^ f1(D, Kr0_(i), Km0_(i)) B = B ^ f2(C, Kr1_(i), Km1_(i)) A = A ^ f3(B, Kr2_(i), Km2_(i)) D = D ^ f1(A, Kr3_(i), Km3_(i))
Let "BETA <- QBARi(BETA)" be short-hand notation for the following: D = D ^ f1(A, Kr3_(i), Km3_(i)) A = A ^ f3(B, Kr2_(i), Km2_(i)) B = B ^ f2(C, Kr1_(i), Km1_(i)) C = C ^ f1(D, Kr0_(i), Km0_(i))
(Q(*) is called a "forward quad-round" and QBAR(*) is called a "reverse quad-round".)
Let Kr_(i) = {Kr0_(i), Kr1_(i), Kr2_(i), Kr3_(i)} be the set of rotation keys for the ith quad-round, where Krj_(i) is a 5-bit rotation key for f1, f2, or f3 (as specified above).
Let Km_(i) = {Km0_(i), Km1_(i), Km2_(i), Km3_(i)} be the set of masking keys for the ith quad-round, where Kmj_(i) is a 32-bit masking key for f1, f2, or f3 (as specified above).
Let KAPPA = (ABCDEFGH) be a 256-bit block where A, B, ..., H are each 32 bits in length.
Let "KAPPA <- Wi(KAPPA)" be short-hand notation for the following: G = G ^ f1(H, Tr0_(i), Tm0_(i)) F = F ^ f2(G, Tr1_(i), Tm1_(i)) E = E ^ f3(F, Tr2_(i), Tm2_(i)) D = D ^ f1(E, Tr3_(i), Tm3_(i)) C = C ^ f2(D, Tr4_(i), Tm4_(i)) B = B ^ f3(C, Tr5_(i), Tm5_(i)) A = A ^ f1(B, Tr6_(i), Tm6_(i)) H = H ^ f2(A, Tr7_(i), Tm7_(i))
(W(*) is called a "forward octave".)
Adams & Gilchrist Informational [Page 6]
RFC 2612 The CAST-256 Encryption Algorithm June 1999
Let "Kr_(i) <- KAPPA" be short-hand notation for the following: Kr0_(i) = 5LSB(A), Kr1_(i) = 5LSB(C), Kr2_(i) = 5LSB(E), Kr3_(i) = 5LSB(G) where 5LSB(x) denotes "the five least significant bits of x".
Let "Km_(i) <- KAPPA" be short-hand notation for the following: Km0_(i) = H, Km1_(i) = F, Km2_(i) = D, Km3_(i) = B
for (i=0; i<6; i++) BETA <- Qi(BETA) for (i=6; i<12; i++) BETA <- QBARi(BETA)
128bits of ciphertext = BETA
Round Key Re-Ordering for Decryption
The cipher employs a 256-bit primary key K. Decryption is identical to encryption except that the sets of quad-round keys Kr_(i), Km_(i) derived from K are used in reverse order as follows.
In order to avoid confusion when variable keysize operation is used, the name CAST-256 is to be considered synonymous with the name CAST6; this allows a keysize to be appended without ambiguity. Thus, for example, CAST-256 with a 192-bit key is to be referred to as CAST6- 192; where a 256-bit key is explicitly intended, the name CAST6-256 should be used.
The CAST-256 cipher described in this document is available worldwide on a royalty-free and licence-free basis for commercial and non- commercial uses.
Intermediate Values Known Answer Test. The data listed is:
KEYSIZE=the current key length in bits KEY=the key in hexadecimal format PT=the plaintext to be encrypted R=the quad-round number (1 to 12) ROTK1,ROTK2,ROTK3,ROTK4=the rotation keys for the current quad-round MASK1,MASK2,MASK3,MASK4=the masking keys for the current quad-round OUT=the output of the quad-round CT=the ciphertext corresponding to the given plaintext.
For each key size, an encryption and the corresponding decryption are shown.
RFC 2612 The CAST-256 Encryption Algorithm June 1999
Full Copyright Statement
Copyright (C) The Internet Society (1999). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the Internet Society.