CAST5

CAST5
Name	CAST5
Type	Block cipher
Designers	Shai Halevi, Don Coppersmith, Carlisle Adams
Publish date	1996
Key size	40–128 bits
Block size	64 bits
Structure	Feistel network
Rounds	12 or 16
Derived from	CAST family

CAST5 CAST5 is a symmetric-key block cipher in the CAST family designed for general-purpose cryptographic use. It was specified by cryptographers including Carlisle Adams, Don Coppersmith, and Eli Biham and standardized in several protocols and products during the late 1990s. CAST5 became widely adopted in software such as PGP and in standards associated with organizations like the IETF and the RSA Security ecosystem.

History

CAST5 emerged from the CAST family of ciphers developed during the early 1990s by a collaboration of cryptographers including Carlisle Adams and Matt Robshaw and influenced by research from figures such as Don Coppersmith and Eli Biham. The algorithm was submitted for evaluation to standards bodies and was chosen for inclusion in protocols maintained by the Internet Engineering Task Force; it was published in RFCs that addressed encryption algorithms for protocols like IPsec and S/MIME. During the same era, competing ciphers such as DES, Triple DES, and the eventual AES finalists shaped adoption decisions made by implementers like PGP Corporation and vendors in the Open Source community. CAST5’s use in widely deployed applications increased through endorsements by organizations such as Netscape and inclusion in cryptographic libraries maintained by groups like the OpenSSL Project.

Design

CAST5 is a 64-bit block cipher built as a Feistel network with either 12 or 16 rounds depending on key length. The cipher uses key-dependent S-boxes constructed from fixed tables influenced by research from Ronald Rivest and Claude Shannon on substitution–permutation approaches, and employs arithmetic operations including modular addition and bitwise rotation similar to constructs explored by Horst Feistel and Whitfield Diffie. Key schedule and round functions were designed to balance performance and security for software implementations on CPUs from vendors like Intel and AMD. The variable key size (40 to 128 bits) allowed manufacturers and standards bodies such as FIPS-related projects to choose trade-offs between export constraints and cryptographic strength, paralleling debates involving RSA Laboratories and export controls of the 1990s.

Modes of Operation and Implementation

Implementations commonly pair CAST5 with block cipher modes standardized by bodies like the IETF and the Internet Security Research Group — for example, CBC, CFB, OFB, and CTR modes as specified in protocol documents used by IPsec and S/MIME. Software libraries such as OpenSSL Project, GnuPG, and proprietary suites from vendors like PGP Corporation included CAST5 back-ends for secure messaging and file encryption. Hardware implementations targeted embedded platforms from manufacturers such as ARM Holdings and microcontroller vendors, optimizing for instruction sets that were prominent in devices from Intel and Motorola. Interoperability considerations often referenced standards maintained by organizations like ISO and deployment guidelines used by projects including Mozilla and Apache HTTP Server.

Security Analysis and Cryptanalysis

Early cryptanalytic work examined differential and linear attacks on CAST-family designs; notable researchers in this area include Eli Biham and Adi Shamir who advanced techniques applicable to Feistel ciphers. Security assessments compared CAST5’s effective strength against then-contemporary ciphers such as DES and Blowfish, and later against AES candidates. Cryptanalysts demonstrated certain reduced-round vulnerabilities using differential cryptanalysis and related-key attacks in academic venues like conferences organized by EUROCRYPT and CRYPTO. Practical attack feasibility depended on key length and round count; 40-bit keys were considered weak due to exhaustive search demonstrated in events such as challenges sponsored by EFF and research groups at institutions like MIT and Cambridge University. For keys at the higher end (128 bits) and full-round configurations, no practical full-key attacks have been published that break CAST5 faster than exhaustive search on general-purpose hardware produced by companies like NVIDIA or Intel.

Applications and Usage

CAST5 saw adoption in email encryption systems including PGP and OpenPGP implementations, in secure communications stacks for VPN products that implemented IPsec, and in secure file storage utilities supported by projects such as GnuPG. It was also used in commercial software suites by companies like Symantec and legacy components of web browsers developed by organizations such as Netscape Communications Corporation. Academic and open-source cryptographic libraries incorporated CAST5 as an option for developers aiming for compatibility with older systems and standards maintained by the IETF and S/MIME implementers.

Patents and Licensing Considerations

The CAST family had patent-related discussions during its uptake, with licensing considerations influencing whether implementers in corporations such as Sun Microsystems or projects like OpenSSL Project included the cipher by default. By the late 1990s and early 2000s, many implementers treated CAST5 as available for use under permissive terms, though commercial vendors often consulted legal teams at organizations like Microsoft Corporation and IBM to verify freedom-to-operate. Standards developers at institutions such as the IETF provided normative language for algorithm identifiers to ease implementation while compliance teams at enterprises referenced guidance from bodies like NIST for broader cryptographic practice.

Category:Block ciphers