About CAST Encryption
CAST is a family of block ciphers designed by Carlisle Adams and Stafford Tavares (hence the name
CAST) in 1996. The most widely used variants are CAST-128 (also known as CAST-5) and CAST-256
(also known as CAST-6).
CAST-128 (CAST-5):
- Block Size: 64 bits
- Key Size: 40 to 128 bits (in 8-bit increments)
- Rounds: 12 or 16 rounds (depending on key size)
- Structure: Feistel network with complex round function
- Status: Standardized in RFC 2144 and used in various applications including
PGP
CAST-256 (CAST-6):
- Block Size: 128 bits
- Key Size: 128, 160, 192, 224, or 256 bits
- Rounds: 48 rounds (12 quad-rounds)
- Structure: Substitution-permutation network (SPN)
- Status: Submitted as a candidate for the AES competition but not selected
as a finalist
How CAST Works:
CAST-128:
- Uses a Feistel network structure with 16 rounds for 128-bit keys (12 rounds for shorter
keys)
- Each round uses one of four different round functions, which include operations like:
- Modular addition and subtraction
- XOR operations
- Fixed S-boxes (substitution boxes)
- Circular rotations
- The key schedule generates 16 subkeys of 32 bits each, plus 16 rotation values
CAST-256:
- Extends CAST-128 to handle 128-bit blocks and longer keys
- Uses a substitution-permutation network with 48 rounds organized as 12 "quad-rounds"
- Each quad-round applies four different round functions to different parts of the data
- Uses the same basic operations as CAST-128 but with a more complex structure
Security and Applications:
- Security: CAST-128 has withstood cryptanalysis well, with no practical
attacks against the full cipher. CAST-256 was designed with an even higher security margin.
- Applications: CAST-128 has been used in various security applications,
including:
- Pretty Good Privacy (PGP) for email encryption
- GNU Privacy Guard (GPG)
- Various VPN implementations
- Licensing: CAST-128 was patented, but the patents have expired, making it
free to use. CAST-256 is also free to use.
Note: While CAST-128 is still considered secure for many applications, modern
systems typically prefer AES or other newer ciphers with larger block sizes for new
implementations.