Talk:CAST-128

WikiProject Cryptography / Computer science  (Rated Start-class, Mid-importance)
This article is within the scope of WikiProject Cryptography, a collaborative effort to improve the coverage of Cryptography on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.
Start  This article has been rated as Start-Class on the quality scale.
Mid  This article has been rated as Mid-importance on the importance scale.

Cast-128 Image

Hello,

i am writing about an image you created for the article about the Cast-128 crypto algorithm. As i studied the specific algorithm, i realized that there is a slight difference between the image and the Request For Comments 2144 where the algorithm is presented. Copying form the RFC:

```      Type 1:  I = ((Kmi + D) <<< Kri)
f = ((S1[Ia] ^ S2[Ib]) - S3[Ic]) + S4[Id]
```
```      Type 2:  I = ((Kmi ^ D) <<< Kri)
f = ((S1[Ia] - S2[Ib]) + S3[Ic]) ^ S4[Id]
```
```      Type 3:  I = ((Kmi - D) <<< Kri)
f = ((S1[Ia] + S2[Ib]) ^ S3[Ic]) - S4[Id]
```

The RFC also states:

```  "CAST-128 uses a pair of subkeys per round:  a 32-bit quantity Km is
used as a "masking" key and a 5-bit quantity Kr is used as a
"rotation" key."
```

So i believe that the two sub-keys (Kmi and Kri) should be switched in place in the image. I believe that now the image depicts the opposite argument.

Test Vectors

Moved here from the article (Removed in this edit). Wikipedia is not the place for reference documentation like this. -- Sverdrup (talk) 11:55, 6 March 2013 (UTC)

Test vectors :

Below is a sample test vector, providing the input and the expected output for the above algorithm. Even, the values of Key Schedule, Km and Kr is provided for both encryption and decryption.

Encryption :

```128-bit key = 01 23 45 67 12 34 56 78 23 45 67 89 34 56 78 9A
plaintext   = 01 23 45 67 89 AB CD EF
ciphertext  = 23 8B 4F E5 84 7E 44 B2
```
i K[i] Km[i] Kr[i]
1 BC173E26 BC173E26 00000015
2 78A207EF 78A207EF 0000001B
3 ECE0A7F5 ECE0A7F5 00000001
4 7CB0FB6B 7CB0FB6B 00000005
5 A5D2D636 A5D2D636 00000003
6 D78B9407 D78B9407 0000001F
7 56C069D3 56C069D3 0000001F
8 82E8240C 82E8240C 0000001C
9 33543749 33543749 00000010
10 8813D5C7 8813D5C7 0000001F
11 B9FCD732 B9FCD732 00000012
12 59106B36 59106B36 00000001
13 496AF1A9 496AF1A9 0000001D
14 18F8DC43 18F8DC43 00000019
15 8D9DEF0F 8D9DEF0F 00000001
16 83EDA384 83EDA384 0000000F

Decryption :

```128-bit key = 01 23 45 67 12 34 56 78 23 45 67 89 34 56 78 9A
plaintext   = 23 8B 4F E5 84 7E 44 B2
ciphertext  = 01 23 45 67 89 AB CD EF
```
i K[i] Km[i] Kr[i]
1 BC173E26 BC173E26 00000015
2 78A207EF 78A207EF 0000001B
3 ECE0A7F5 ECE0A7F5 00000001
4 7CB0FB6B 7CB0FB6B 00000005
5 A5D2D636 A5D2D636 00000003
6 D78B9407 D78B9407 0000001F
7 56C069D3 56C069D3 0000001F
8 82E8240C 82E8240C 0000001C
9 33543749 33543749 00000010
10 8813D5C7 8813D5C7 0000001F
11 B9FCD732 B9FCD732 00000012
12 59106B36 59106B36 00000001
13 496AF1A9 496AF1A9 0000001D
14 18F8DC43 18F8DC43 00000019
15 8D9DEF0F 8D9DEF0F 00000001
16 83EDA384 83EDA384 0000000F

Attack vectors?

One topic found in other crypto articles is a section discussing known or suspected attack vectors. Even for ciphers considered secure, cryptanalysis research might suggest theoretical avenues of attack, and this would be interesting to note in the article for anyone researching the cipher. Any experts care to add? 137.254.4.10 (talk) 23:09, 13 February 2015 (UTC)