Abstract

This document contains several sections of the CAST-256 AES Submission Package delivered to NIST on June 9 th , 1998. All complete submissions received by NIST will be made public in late August at the First AES Candidate Conference, but the following material is being made available now so that public analysis of the CAST-256 algorithm may begin (see, for example, http://www.ii.uib.no/~larsr/aes.html for the current status of submitted algorithms). Many thanks are due to those who worked with me in the (long, challenging, frustrating, and very enjoyable!) design and analysis phases that ultimately led to the detailed specification given below: Howard Heys (Memorial University); Stafford Tavares (Queen's University); and Michael Wiener (Entrust). As well, many thanks are due to the two who did the various implementations on a variety of platforms (Reference C, Optimized C, Optimized Java, and even M6811 Assembler): Serge Mister and Ian Clysdale (both

Citations

359	Linear Cryptanalysis Method for DES Cipher - Matsui
293	Differential Cryptanalysis of the Data Encryption Standard. NewYork - Biham, Shamir - 1993
71	Truncated and higher order differentials - Knudsen
58	The interpolation attack on block ciphers - Jakobsen, Knudsen - 1997
41	Higher order derivatives and differential cryptanalysis - Lai - 1994
16	Constructing Symmetric Ciphers Using the - Adams
5	Differential cryptanalysis of Feistel ciphers and differentially δ-uniform mappings - Canteaut - 1997
5	Resistance of a CAST-like encryption algorithm to linear and differential cryptanalysis - Lee, Heys, et al. - 1997
4	Higher order differential attack of a CAST cipher - Moriai, Shimoyama, et al.
3	Construction of Highly Nonlinear Injective S-boxes with Application to CAST-like Encryption Algorithm - Youssef, Chen, et al. - 1997
2	Preliminary analytical results concerning the mixing of operations from different algebraic groups and the maximum value of the resulting XOR difference distribution table (unpublished - O’Connor - 1998
1	Preliminary experimental results concerning the mixing of operations from different algebraic groups and the contents of the resulting XOR difference distribution table (unpublished - Adams, Mister