Improved Linear Cryptanalysis of CAST-256  

作　　者：赵静远 王美琴 温隆 

机构地区：[1]Key Laboratory of Cryptologic Technology and Information Security,Ministry of Education,Shandong University [2]School of Mathematics,Shandong University

出　　处：《Journal of Computer Science & Technology》2014年第6期1134-1139,共6页计算机科学技术学报（英文版）

基　　金：supported by the National Basic Research 973 Program of China under Grant No.2013CB834205;the National Natural Science Foundation of China under Grant Nos.61133013,61070244 and 61103237;the Program for New Century Excellent Talents in University of China under Grant No.NCET-13-0350;the Interdisciplinary Research Foundation of Shandong University under Grant No.2012JC018

摘　　要：CAST-256, a first-round AES （Advanced Encryption Standard） candidate, is designed based on CAST-128. It is a 48-round Generalized-Feistel-Network cipher with ]28-bit block accepting 128, 160, 192, 224 or 256 bits keys. Its S-boxes are non-surjective with 8-bit input and 32-bit output. Wang et al. identified a 21-round linear approximation and gave a key recovery attack on 24-round CAST-256. In ASIACRYPT 2012, Bogdanov et al. presented the multidimensional zero-correlation linear cryptanalysis of 28 rounds of CAST-256. By observing the property of the concatenation of forward quad-round and reverse quad-round and choosing the proper active round function, we construct a linear approximation of 26-round CAST-256 and recover partial key information on 32 rounds of CAST-256. Our result is the best attack according to the number of rounds for CAST-256 without weak-key assumption so far.CAST-256, a first-round AES （Advanced Encryption Standard） candidate, is designed based on CAST-128. It is a 48-round Generalized-Feistel-Network cipher with ]28-bit block accepting 128, 160, 192, 224 or 256 bits keys. Its S-boxes are non-surjective with 8-bit input and 32-bit output. Wang et al. identified a 21-round linear approximation and gave a key recovery attack on 24-round CAST-256. In ASIACRYPT 2012, Bogdanov et al. presented the multidimensional zero-correlation linear cryptanalysis of 28 rounds of CAST-256. By observing the property of the concatenation of forward quad-round and reverse quad-round and choosing the proper active round function, we construct a linear approximation of 26-round CAST-256 and recover partial key information on 32 rounds of CAST-256. Our result is the best attack according to the number of rounds for CAST-256 without weak-key assumption so far.

关 键 词：CAST-256 linear cryptanalysis block cipher Generalized-Feistel-Network 

分 类 号：TN918.4[电子电信—通信与信息系统]