Linear Analysis of reduced-round CAST-128 and CAST-256 - Nakahara Jr, Jorge; Rasmussen, Mads (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2007: Anais do VII Simpósio Brasileiro de Segurança da Informação e de Sistemas ComputacionaisDO - 10.5753/sbseg.2007.20914, 2007)
This paper describes a linear analysis of reduced-round versions of the CAST-128 and CAST-256 block ciphers. CAST-256 was a former candidate to the AES Development Process. Both ciphers use the same nonlinear components (fixed 8x32-bit S-boxes, key-dependent bit-rotation, modular addition and subtraction on 32-bit words) and a Feistel Network structure. We exploit the fact that the S-boxes are non-surjective mappings to construct iterative linear distinguishers for both ciphers. As far as we are aware of, this paper describes the first known-plaintext analysis of reduced-round variants of these ciphers.