Abstract

This paper describes the CAST design procedure for constructing a family of DES-like Substitution-Permutation Network (SPN) cryptosystems which appear to have good resistance to differential cryptanalysis, linear cryptanalysis, and related-key cryptanalysis, along with a number of other desirable cryptographic properties. Details of the design choices in the procedure are given, including those regarding the component substitution boxes (s-boxes), the overall framework, the key schedule, and the round function. An example CAST cipher, an output of this design procedure, is presented as an aid to understanding the concepts and to encourage detailed analysis by the cryptologic community.

Citations

596	Communication theory of secrecy systems - Shannon - 1949
359	Linear Cryptanalysis Method for DES Cipher - Matsui
233	The RC5 Encryption Algorithm - Rivest - 1997
133	A Proposal for a New Block Encryption Standard - Lai, Massey
130	New Types of Cryptanalytic Attacks Using Related Keys (Extended Abstract - Biham
119	Cryptography and computer privacy - Feistel - 1973
105	Markov ciphers and differential cryptanalysis - Lai, Massey, et al.
98	Nonlinearity Criteria for Cryptographic Functions - Meier
73	Privacy and authentication: An introduction to cryptography - Diffie, Hellman - 1979
62	Perfect nonlinear S-boxes - Nyberg
60	Propagation characteristics of boolean functions - Preneel, Leekwijck, et al. - 1991
52	LOKI-a cryptographic primitive for authentication and secrecy applications - Brown, Pieprzyk, et al. - 1990
50	Structured design of substitutionpermutation encryption networks - Kam, Davida - 1979
50	The Twofish encryption algorithm - Schneier, Kelsey, et al. - 1999
48	The Data Encryption Standard (DES) and Its Strength Against Attacks - Coppersmith - 1994
41	Some cryptographic Techniques for Machine-to-Machine Data - Feistel, Notz, et al. - 1975
41	A generalization of linear cryptanalysis and the applicability of Matsui’s piling-up lemma - Harpes, Kramer, et al.
40	Improving resistance to differential cryptanalysis and the redesign of LOKI - Brown, Kwan, et al. - 1993
38	Provable security against differential cryptanalysis - Nyberg, Knudsen
32	Fast software encryption functions - ” - 1991
29	Generating and counting binary bent sequences - Adams, Tavares - 1990
24	A Fast Software One-Way Hash Function - Merkle - 1990
22	Designing S-boxes for Ciphers Resistant to Differential Cryptanalysis - Adams, Tavares - 1979
20	An Expanded Set of S-box Design Criteria Based on Information Theory and its Relation to Differential-Like Attacks - Dawson, Tavares - 1991
20	Systematic Generation of Cryptographically Robust S-boxes - Seberry, Zhang, et al. - 1993
18	The FEAL cipher family - Miyaguchi - 1991
17	A formal and practical design procedure for substitution-permutation network cryptosystems - Adams - 1990
17	The use of bent sequences to achieve higher-order strict avalanche criterion - Adams, Tavares - 1990
14	Is the data encryption standard a group? (Results of cycling experiments - Kaliski, Rivest, et al. - 1988
14	On Weaknesses of Non-surjective Round Functions - Rijmen, Preneel, et al. - 1997
14	Plaintext/Ciphertext Bit Dependencies in Cryptographic System - Webster - 1985
13	The Design of Substitution-Permutation Networks Resistatnt to Differential and Linear - Heys, Tavares - 1994
12	On immunity against Biham and Shamir’s differential cryptanalysis - Adams - 1992
12	S.E.Tavares, “On the security of the CAST encryption algorithm - Heys - 1994
11	Some Regular Properties of the 'Data Encryption Standard - Davies - 1982
11	Cycle structure of the DES with weak and semi-weak keys - Moore, Simmons - 1987
11	On the design of SP networks from an information theoretic point of view - Sivabalan, Tavares, et al. - 1993
10	Simple and Effective Key Scheduling for Symmetric Ciphers - Adams - 1994
10	Constructions of bent functions and difference sets - Nyberg - 1991
8	A Message Authenticator Algorithm Suitable for A Mainframe Computer - Davies - 1985
5	Fast Data Encryption Algorithm Feal-8 - Miyaguchi, Shiraishi, et al. - 1988
4	Cryptanalysis of tree-structured substitution-permutation networks - Heys, Tavares - 1993
4	personal communication - Wiener - 2004
3	Analysis of a Feistel-Like Cipher Weakened by Having No Rotating Key - Grossman, Tuckerman - 1977
3	On the resistance of the CAST encryption algorithm to differential cryptanalysis - Lee, Heys, et al. - 1995
2	Designing DES-Like Ciphers with Guaranteed Resistance to Differential and Linear Attacks - Adams - 1995
2	On the design of S-Boxes, Adv - Webster, Tavares - 1986
1	The real reason for Rivest’s phenomenon, Adv - Coppersmith - 1986
1	Iterative characteristics of DES and s2-DES - Knudsen - 1993
1	K-64: A byte-oriented block-ciphering algorithm, Proceedings of the Cambridge Security Workshop on Fast Software Encryption - Massey, SAFER