Are there different versions of CAST-256 - also known as CAST6 - available? Are there different S-Boxes available for CAST-256? If there are different versions or S-Boxes what identifier should I use to indicate them?

I have an issue with PHP mcrypt version of CAST-256 (the link goes to the ill maintained mcrypt library underneath) where I cannot generate the same value as the one in the test vectors for CAST-256. In case anyone wants to try, I'm using the first test vector from the RFC. The Bouncy Castle libraries (v1.51) for Java seem to generate the correct value.



  • the same code on other block ciphers in mcrypt without issue and triple checked the mcrypt input/output values - code available on request;
  • "Applied Cryptography 2nd Edition" by Bruce Schneier talks about configurable S-Boxes for the original CAST cipher, but I don't see the same indication for CAST-256 other than that it should reuse the S-Boxes of CAST-128;
  • there is a set of 4 S-Boxes required for CAST-256, so the S-Boxes in the code are all part of the same configuration.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.