Return to Answer

CAST-128 has 64-bit block size. Such block size is obsolete. Don't use such block size (thus don't use CAST-128), unless you must.

Loki97 is broken, see Lars R. Knudsen & Vincent Rijmen's Weaknesses in LOKI97. Don't use it.

RC5 with it's originally suggested parameters (64-bit block size, 128-bit key, 12 rounds) is broken, see Alex Biryukov & Eyal Kushilevitz's Improved cryptanalysis of RC5. Although that paper suggests parameters for the 128-bit block version, I'll pretend RC5 is obsoleted by RC6.

This leaves MARS and RC6 as competitors. Neither algorithm is close to broken AFAIK. They have been discussed and compared by NIST's Report on the Development of the Advanced Encryption Standard (AES). RC6 is found to be faster, significantly so in hardware. RC6 is simpler in my view, but it has one drawback: it uses variable rotation, which is hard to make fast and constant-time on some low-end CPUs lacking a barrel shifter including modern ones, e.g. some variants of ARM Cortex M0.

If I desperately needed a block cipher (ruling out a simpler stream cipher like ChaCha) and for some reason was facing the choice in the question (thus could not use AES/Rijndael), I'd probably use MARS, unless speed was paramount and I knew for certain no CPU lacking a barrel shifter woudl ever be a target.

Addition: If I was stuck to a 64-bit block cipher among those of the question, I may use CAST-128: it's unbroken AFAIK, and even endorsed by ISO/IEC 18033-3:2010, reviewed 2020.

CAST-128 has 64-bit block size. Such block size is obsolete. Don't use such block size (thus don't use CAST-128), unless you must.

LOKI97 is broken, see Lars R. Knudsen & Vincent Rijmen's Weaknesses in LOKI97. Don't use it.

RC5 with it's originally suggested parameters (64-bit block size, 128-bit key, 12 rounds) is broken, see Alex Biryukov & Eyal Kushilevitz's Improved cryptanalysis of RC5. Although that paper suggests parameters for the 128-bit block version, I'll pretend RC5 is obsoleted by RC6.

This leaves MARS and RC6 as competitors. Neither algorithm is close to broken AFAIK. They have been discussed and compared by NIST's Report on the Development of the Advanced Encryption Standard (AES). RC6 is found to be faster, significantly so in hardware. RC6 is simpler in my view, but it has one drawback: it uses variable rotation, which is hard to make fast and constant-time on some low-end CPUs lacking a barrel shifter (including modern CPUs, e.g. some variants of ARM Cortex M0).

If I desperately needed a block cipher (ruling out a simpler stream cipher like ChaCha) and for some reason was facing the choice in the question (thus could not use AES/Rijndael), I'd probably use MARS, unless speed was paramount and I knew for certain no CPU lacking a barrel shifter would ever be used (in which case I'd consider RC6)

Addition: If I was stuck to a 64-bit block cipher among those of the question, I may use CAST-128: it's unbroken AFAIK, and even endorsed by ISO/IEC 18033-3:2010, reviewed 2020.

CAST-128 has 64-bit block size. That's obsolete. Don't use it.

Loki97 is broken, see Lars R. Knudsen & Vincent Rijmen's Weaknesses in LOKI97. Don't use it.

RC5 with it's originally suggested parameters (64-bit block size, 128-bit key, 12 rounds) is broken, see Alex Biryukov & Eyal Kushilevitz's Improved cryptanalysis of RC5. Although that paper suggests parameters for the 128-bit block version, I'll pretend RC5 is obsoleted by RC6.

This leaves MARS and RC6 as competitors. Neither algorithm is close to broken AFAIK. They have been discussed and compared by NIST's Report on the Development of the Advanced Encryption Standard (AES). RC6 is found to be faster, significantly so in hardware. RC6 is simpler in my view, but it has one drawback: it uses variable rotation, which is hard to make fast and constant-time on some low-end CPUs lacking a barrel shifter including modern ones, e.g. some variants of ARM Cortex M0.

If I desperately needed a block cipher (ruling out a simpler stream cipher like ChaCha) and for some reason was facing the choice in the question (thus could not use AES/Rijndael), I'd probably use MARS, unless speed was paramount and I knew for certain no CPU lacking a barrel shifter woudl ever be a target.

CAST-128 has 64-bit block size. Such block size is obsolete. Don't use such block size (thus don't use CAST-128), unless you must.

Loki97 is broken, see Lars R. Knudsen & Vincent Rijmen's Weaknesses in LOKI97. Don't use it.

RC5 with it's originally suggested parameters (64-bit block size, 128-bit key, 12 rounds) is broken, see Alex Biryukov & Eyal Kushilevitz's Improved cryptanalysis of RC5. Although that paper suggests parameters for the 128-bit block version, I'll pretend RC5 is obsoleted by RC6.

This leaves MARS and RC6 as competitors. Neither algorithm is close to broken AFAIK. They have been discussed and compared by NIST's Report on the Development of the Advanced Encryption Standard (AES). RC6 is found to be faster, significantly so in hardware. RC6 is simpler in my view, but it has one drawback: it uses variable rotation, which is hard to make fast and constant-time on some low-end CPUs lacking a barrel shifter including modern ones, e.g. some variants of ARM Cortex M0.

If I desperately needed a block cipher (ruling out a simpler stream cipher like ChaCha) and for some reason was facing the choice in the question (thus could not use AES/Rijndael), I'd probably use MARS, unless speed was paramount and I knew for certain no CPU lacking a barrel shifter woudl ever be a target.

Addition: If I was stuck to a 64-bit block cipher among those of the question, I may use CAST-128: it's unbroken AFAIK, and even endorsed by ISO/IEC 18033-3:2010, reviewed 2020.

CAST-128 has 64-bit block size. That's obsolete. Don't use it.

Loki97 is broken, see Lars R. Knudsen & Vincent Rijmen's Weaknesses in LOKI97. Don't use it.

RC5 with it's originally suggested parameters (64-bit block size, 128-bit key, 12 rounds) is broken, see Alex Biryukov & Eyal Kushilevitz's Improved cryptanalysis of RC5. Although that paper suggests parameters for the 128-bit block version, I'll pretend RC5 is obsoleted by RC6.

This leaves MARS and RC6 as competitors. Neither algorithm is close to broken AFAIK. They have been discussed and compared by NIST's Report on the Development of the Advanced Encryption Standard (AES). RC6 is found to be faster, significantly so in hardware. RC6 is simpler in my view, but it has one drawback: it uses variable rotation, which is hard to make fast and constant-time on some low-end CPUs lacking a barrel shifter including modern ones, e.g. some variants of ARM Cortex M0.

If I desperately needed a block cipher (ruling out a simpler stream cipher like ChaCha) and for some reason was facing the choice in the question (thus could not use AES/Rijndael), I'd select RC6 if I was sure no CPU lacking barrel shifter would ever be a target; MARS otherwise.

CAST-128 has 64-bit block size. That's obsolete. Don't use it.

Loki97 is broken, see Lars R. Knudsen & Vincent Rijmen's Weaknesses in LOKI97. Don't use it.

RC5 with it's originally suggested parameters (64-bit block size, 128-bit key, 12 rounds) is broken, see Alex Biryukov & Eyal Kushilevitz's Improved cryptanalysis of RC5. Although that paper suggests parameters for the 128-bit block version, I'll pretend RC5 is obsoleted by RC6.

This leaves MARS and RC6 as competitors. Neither algorithm is close to broken AFAIK. They have been discussed and compared by NIST's Report on the Development of the Advanced Encryption Standard (AES). RC6 is found to be faster, significantly so in hardware. RC6 is simpler in my view, but it has one drawback: it uses variable rotation, which is hard to make fast and constant-time on some low-end CPUs lacking a barrel shifter including modern ones, e.g. some variants of ARM Cortex M0.

If I desperately needed a block cipher (ruling out a simpler stream cipher like ChaCha) and for some reason was facing the choice in the question (thus could not use AES/Rijndael), I'd probably use MARS, unless speed was paramount and I knew for certain no CPU lacking a barrel shifter woudl ever be a target.