I just installed GnuPG for Windows. The documentation says the default symmetric cipher is CAST5. In PGP also, default cipher was CAST5.
Is CAST5 secure to use? Any known attacks reported on this algorithm?
$\begingroup$
$\endgroup$
5
-
1$\begingroup$ It's still secure, yes (at least as far as I know). It's not as efficient as AES though. $\endgroup$– AlephFeb 21, 2015 at 16:09
-
$\begingroup$ Which algorithm you will use other than AES if given a choice? $\endgroup$– RPKFeb 21, 2015 at 16:11
-
$\begingroup$ Twofish is my personal favorite, Serpent if you need the most secure algorithm. (Using one of the finalist of the AES challenge sounds like a good idea.) $\endgroup$– NovaFeb 21, 2015 at 17:46
-
$\begingroup$ But I did not find any tools which give option to use SERPENT. Even GnuPG has no option. BTW, why Twofish is your favorite? $\endgroup$– RPKFeb 21, 2015 at 17:49
-
3$\begingroup$ Twofish has excellent diffusion, as well as key dependent s-boxes, and is fast in software $\endgroup$– Richie FrameFeb 22, 2015 at 7:00
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
CAST5 seems to be a solid 64-bit block cipher with 128-bit key. As far as I can tell after a short literature search, it's definition is sound and unbroken, despite nearly two decades of exposure (more for the round function).
CAST5 is also known as CAST-128, defined in RFC 2144 (1997), and endorsed by ISO/IEC 18033-3:2010 (current). It is a 16-round Feistel cipher, with each round using 4 (among a total of 8) S-boxes with 8-bit input and 32-bit output; and 32-bit operations (XORs, addition/subtraction), and key-dependent rotations.
CAST5 most (but still mildly) serious weakness is its small block size (64-bit) by modern standards (the trend is 128-bit, e.g. AES). This could be an issue when enciphering large amount of data with the same key using some common modes, including CFB used in OpenPGP and GnuPG, because collisions among random blocks occur with increasing odds (about 0.8% for 4GiB, 40% for 32GiB). For example, it can be disproved with some level of credibility a false claim that a dozen of ≈20GiB files known to have been GnuPG-enciphered using CAST5 correspond to all-zero data encrypted as a computer benchmark, simply by checking if there is any file with colliding blocks (the claimed origin of the encrypted files makes it unlikely, when several collisions are expected for "real" data, like video).
Another inherent limitation is the 128-bit key. There are much worst fears to have in a GnuPG context (how can I trust that BIOS? Hard disk firmware? Keyboard?).
CAST5's implementation may be vulnerable to timing attack related to cache or data-dependent operations. That could be a relatively credible attack vector if hostile software was running on the same CPU with only the isolation provided by an OS or VM. It seems to be a relatively low residual risk.
CAST5 does not seem particularly vulnerable (or resistant) to fault attack, or related-key attack. These types of attacks are not much to fear in the context of GnuPG.
Note: the paper by John Kelsey, Bruce Schneier, and David Wagner: Related-Key Cryptanalysis of 3-WAY, Biham-DES, CAST, DES-X, NewDES, RC2, and TEA (ICICS 1997), is for an earlier version of CAST with only 8 rounds. The paper is made available in Postscript by the last author, and may be viewable online here.
