I just installed GnuPG for Windows. The documentation says the default symmetric cipher is CAST5. In PGP also, default cipher was CAST5.
Is CAST5 secure to use? Any known attacks reported on this algorithm?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
CAST5 seems to be a solid 64-bit block cipher with 128-bit key. As far as I can tell after a short literature search, it's definition is sound and unbroken, despite nearly two decades of exposure (more for the round function).
CAST5 is also known as CAST-128, defined in RFC 2144 (1997), and endorsed by ISO/IEC 18033-3:2010 (current). It is a 16-round Feistel cipher, with each round using 4 (among a total of 8) S-boxes with 8-bit input and 32-bit output; and 32-bit operations (XORs, addition/subtraction), and key-dependent rotations.
CAST5 most (but still mildly) serious weakness is its small block size (64-bit) by modern standards (the trend is 128-bit, e.g. AES). This could be an issue when enciphering large amount of data with the same key using some common modes, including CFB used in OpenPGP and GnuPG, because collisions among random blocks occur with increasing odds (about 0.8% for 4GiB, 40% for 32GiB). For example, it can be disproved with some level of credibility a false claim that a dozen of ≈20GiB files known to have been GnuPG-enciphered using CAST5 correspond to all-zero data encrypted as a computer benchmark, simply by checking if there is any file with colliding blocks (the claimed origin of the encrypted files makes it unlikely, when several collisions are expected for "real" data, like video).
Another inherent limitation is the 128-bit key. There are much worst fears to have in a GnuPG context (how can I trust that BIOS? Hard disk firmware? Keyboard?).
CAST5's implementation may be vulnerable to timing attack related to cache or data-dependent operations. That could be a relatively credible attack vector if hostile software was running on the same CPU with only the isolation provided by an OS or VM. It seems to be a relatively low residual risk.
Note: the paper by John Kelsey, Bruce Schneier, and David Wagner: Related-Key Cryptanalysis of 3-WAY, Biham-DES, CAST, DES-X, NewDES, RC2, and TEA (ICICS 1997), is for an earlier version of CAST with only 8 rounds. The paper is made available in Postscript by the last author, and may be viewable online here.