next up previous contents
Nächste Seite: CAST-256 Aufwärts: Algorithmus Vorherige Seite: Algorithmus   Inhalt

CAST-128

Zur Definition des Algorithmus ist die Definition folgender Funktion $ f$: $ \mathbb{Z}_{2^{32}} \rightarrow \mathbb{Z}_{2^{32}}$ notwendig:


$\displaystyle \textrm{Typ 1: \quad} I$ $\displaystyle =$ $\displaystyle ((k_{m_i} + D) \circlearrowleft k_{r_i})$  
$\displaystyle f_1$ $\displaystyle =$ $\displaystyle ((S_1[I_a] \oplus S_2[I_b]) - S_3[I_c]) + S_4[I_d]$  
$\displaystyle \textrm{Typ 2: \quad} I$ $\displaystyle =$ $\displaystyle ((k_{m_i} \oplus D) \circlearrowleft k_{r_i})$  
$\displaystyle f_2$ $\displaystyle =$ $\displaystyle ((S_1[I_a] - S_2[I_b]) + S_3[I_c]) \oplus S_4[I_d]$  
$\displaystyle \textrm{Typ 3: \quad} I$ $\displaystyle =$ $\displaystyle ((k_{m_i} - D) \circlearrowleft k_{r_i})$  
$\displaystyle f_3$ $\displaystyle =$ $\displaystyle ((S_1[I_a] + S_2[I_b]) \oplus S_3[I_c]) - S_4[I_d]$  

Hierbei ist

Die verschiedenen ``Typen'' kommen in verschiedenen Runden zur Anwendung: Typ 1 in den Runden 1, 4, 7, 10, 13 und 16, Typ 2 in den Runden 2, 5, 8, 11, 14 und Typ 3 in den Runden 3, 6, 9, 12 und 15.

Der Algorithmus selbst läuft folgendermaßen ab:

  1. Eingabe: Klartext $ m_1 \cdots m_{64}$, Schlüssel $ k = k_1 \cdots k_{128}$
  2. Rundenschlüsselgenerierung: $ k_{m_i}$ (Maske, 32 bits), $ k_{r_i}$ (Rotation, 5 bits) für jede Runde $ i$ (abh. von $ k$)
  3. $ (L_0, R_0) \leftarrow (m_1 \cdots m_{64})$
    d.h. $ L_0 \leftarrow (m_1 \cdots m_{32})$ und $ R_0 \leftarrow (m_{33} \cdots m_{64})$
  4. 16 Runden: $ L_i = R_{i-1}$ und $ R_i = L_{i-1} \oplus {f(R_{i-1},k_{m_i},k_{r_i})}$ für alle $ i\in \{1,\hdots,16\}$ (Typ von $ f$ hängt von $ i$ ab)
  5. Ausgabe: Kryptotext $ c_1 \cdots c_{64} \leftarrow (R_{16},L_{16})$
    d.h. noch eine Vertauschung

Zur Entschlüsselung wird der gleiche Algorithmus verwendet, wobei der einzige Unterschied in der umgekehrten Reihenfolge der generierten Schlüssel besteht. (Es erfolgt eine Berechnung von $ (L_0,R_0)$ aus $ (R_{16},L_{16})$.)

Die 8 S-Boxen sind unterteilt in 4 S-Boxen ( $ S_1, \hdots, S_4$) für die Rundenfunktionen und 4 S-Boxen ( $ S_5, \hdots, S_8$) für die Schlüsselgenerierung. Letztere werden nur einmalig zur Initialisierung einer Ver-/Entschlüsselung benötigt. Organisiert sind die S-Boxen als Lookup-Tables von $ 2^8$ x 32bits (``8x32''). Als Beispiel sei hier nur die S-Box $ S_1$ aufgeführt: 

30fb40d4 9fa0ff0b 6beccd2f 3f258c7a 1e213f2f 9c004dd3 6003e540 cf9fc949
bfd4af27 88bbbdb5 e2034090 98d09675 6e63a0e0 15c361d2 c2e7661d 22d4ff8e
28683b6f c07fd059 ff2379c8 775f50e2 43c340d3 df2f8656 887ca41a a2d2bd2d
a1c9e0d6 346c4819 61b76d87 22540f2f 2abe32e1 aa54166b 22568e3a a2d341d0
66db40c8 a784392f 004dff2f 2db9d2de 97943fac 4a97c1d8 527644b7 b5f437a7
b82cbaef d751d159 6ff7f0ed 5a097a1f 827b68d0 90ecf52e 22b0c054 bc8e5935
4b6d2f7f 50bb64a2 d2664910 bee5812d b7332290 e93b159f b48ee411 4bff345d
fd45c240 ad31973f c4f6d02e 55fc8165 d5b1caad a1ac2dae a2d4b76d c19b0c50
882240f2 0c6e4f38 a4e4bfd7 4f5ba272 564c1d2f c59c5319 b949e354 b04669fe
b1b6ab8a c71358dd 6385c545 110f935d 57538ad5 6a390493 e63d37e0 2a54f6b3
3a787d5f 6276a0b5 19a6fcdf 7a42206a 29f9d4d5 f61b1891 bb72275e aa508167
38901091 c6b505eb 84c7cb8c 2ad75a0f 874a1427 a2d1936b 2ad286af aa56d291
d7894360 425c750d 93b39e26 187184c9 6c00b32d 73e2bb14 a0bebc3c 54623779
64459eab 3f328b82 7718cf82 59a2cea6 04ee002e 89fe78e6 3fab0950 325ff6c2
81383f05 6963c5c8 76cb5ad6 d49974c9 ca180dcf 380782d5 c7fa5cf6 8ac31511
35e79e13 47da91d0 f40f9086 a7e2419e 31366241 051ef495 aa573b04 4a805d8d
548300d0 00322a3c bf64cddf ba57a68e 75c6372b 50afd341 a7c13275 915a0bf5
6b54bfab 2b0b1426 ab4cc9d7 449ccd82 f7fbf265 ab85c5f3 1b55db94 aad4e324
cfa4bd3f 2deaa3e2 9e204d02 c8bd25ac eadf55b3 d5bd9e98 e31231b2 2ad5ad6c
954329de adbe4528 d8710f69 aa51c90f aa786bf6 22513f1e aa51a79b 2ad344cc
7b5a41f0 d37cfbad 1b069505 41ece491 b4c332e6 032268d4 c9600acc ce387e6d
bf6bb16c 6a70fb78 0d03d9c9 d4df39de e01063da 4736f464 5ad328d8 b347cc96
75bb0fc3 98511bfb 4ffbcc35 b58bcf6a e11f0abc bfc5fe4a a70aec10 ac39570a
3f04442f 6188b153 e0397a2e 5727cb79 9ceb418f 1cacd68d 2ad37c96 0175cb9d
c69dff09 c75b65f0 d9db40d8 ec0e7779 4744ead4 b11c3274 dd24cb9e 7e1c54bd
f01144f9 d2240eb1 9675b3fd a3ac3755 d47c27af 51c85f4d 56907596 a5bb15e6
580304f0 ca042cf1 011a37ea 8dbfaadb 35ba3e4a 3526ffa0 c37b4d09 bc306ed9
98a52666 5648f725 ff5e569d 0ced63d0 7c63b2cf 700b45e1 d5ea50f1 85a92872
af1fbda7 d4234870 a7870bf3 2d3b4d79 42e04198 0cd0ede7 26470db8 f881814c
474d6ad7 7c0c5e5c d1231959 381b7298 f5d2f4db ab838653 6e2f1e23 83719c9e
bd91e046 9a56456e dc39200c 20c8c571 962bda1c e1e696ff b141ab08 7cca89b9
1a69e783 02cc4843 a2f7c579 429ef47d 427b169c 5ac9f049 dd8f0f00 5c8165bf

Nun bleibt nur noch die Schlüsselgenerierung zu klären. Dazu betrachten wir eine Kopie des 128-Bit-Schlüssels als Folge von 16 Bytes: $ x_0, \hdots, x_{15}$ mit $ x_0$ als höchstwertigstem Byte. Zusätzlich (und analog zu $ x_0, \hdots, x_{15}$) wird $ z_0, \hdots, z_{15}$ als temporärer 128-Bit-Wert definiert. Jetzt können $ k_{m_i}$ und $ k_{r_i}$ wie folgt definiert werden:


$\displaystyle z_0z_1z_2z_3$ $\displaystyle =$ $\displaystyle x_0x_1x_2x_3 \oplus S_5[x_{13}] \oplus S_6[x_{15}] \oplus S_7[x_{12}] \oplus S_8[x_{14}] \oplus S_7[x_8]$  
$\displaystyle z_4z_5z_6z_7$ $\displaystyle =$ $\displaystyle x_8x_9x_{10}x_{11} \oplus S_5[z_0] \oplus S_6[z_2] \oplus S_7[z_1] \oplus S_8[z_3] \oplus S_8[x_{10}]$  
$\displaystyle z_8z_9z_{10}z_{11}$ $\displaystyle =$ $\displaystyle x_{12}x_{13}x_{14}x_{15} \oplus S_5[z_7] \oplus S_6[z_6] \oplus S_7[z_5] \oplus S_8[z_4] \oplus S_5[x_9]$  
$\displaystyle z_{12}z_{13}z_{14}z_{15}$ $\displaystyle =$ $\displaystyle x_4x_5x_6x_7 \oplus S_5[z_{10}] \oplus S_6[z_9] \oplus S_7[z_{11}] \oplus S_8[z_8] \oplus S_6[x_{11}]$  


$\displaystyle k_{m_1}$ $\displaystyle =$ $\displaystyle S_5[z_8] \oplus S_6[z_9] \oplus S_7[z_7] \oplus S_8[z_6] \oplus S_5[z_2]$  
$\displaystyle k_{m_2}$ $\displaystyle =$ $\displaystyle S_5[z_{10}] \oplus S_6[z_{11}] \oplus S_7[z_5] \oplus S_8[z_4] \oplus S_6[z_6]$  
$\displaystyle k_{m_3}$ $\displaystyle =$ $\displaystyle S_5[z_{12}] \oplus S_6[z_{13}] \oplus S_7[z_3] \oplus S_8[z_2] \oplus S_7[z_9]$  
$\displaystyle k_{m_4}$ $\displaystyle =$ $\displaystyle S_5[z_{14}] \oplus S_6[z_{15}] \oplus S_7[z_1] \oplus S_8[z_0] \oplus S_8[z_{12}]$  


$\displaystyle x_0x_1x_2x_3$ $\displaystyle =$ $\displaystyle z_8z_9z_{10}z_{11} \oplus S_5[z_5] \oplus S_6[z_7] \oplus S_7[z_4] \oplus S_8[z_6] \oplus S_7[z_0]$  
$\displaystyle x_4x_5x_6x_7$ $\displaystyle =$ $\displaystyle z_0z_1z_2z_3 \oplus S_5[x_0] \oplus S_6[x_2] \oplus S_7[x_1] \oplus S_8[x_3] \oplus S_8[z_2]$  
$\displaystyle x_8x_9x_{10}x_{11}$ $\displaystyle =$ $\displaystyle z_4z_5z_6z_7 \oplus S_5[x_7] \oplus S_6[x_6] \oplus S_7[x_5] \oplus S_8[x_4] \oplus S_5[z_1]$  
$\displaystyle x_{12}x_{13}x_{14}x_{15}$ $\displaystyle =$ $\displaystyle z_{12}z_{13}z_{14}z_{15} \oplus S_5[x_{10}] \oplus S_6[x_9] \oplus S_7[x_{11}] \oplus S_8[x_8] \oplus S_6[z_3]$  


$\displaystyle k_{m_5}$ $\displaystyle =$ $\displaystyle S_5[x_3] \oplus S_6[x_2] \oplus S_7[x_{12}] \oplus S_8[x_{13}] \oplus S_5[x_8]$  
$\displaystyle k_{m_6}$ $\displaystyle =$ $\displaystyle S_5[x_1] \oplus S_6[x_0] \oplus S_7[x_{14}] \oplus S_8[x_{15}] \oplus S_6[x_{13}]$  
$\displaystyle k_{m_7}$ $\displaystyle =$ $\displaystyle S_5[x_7] \oplus S_6[x_6] \oplus S_7[x_8] \oplus S_8[x_9] \oplus S_7[x_3]$  
$\displaystyle k_{m_8}$ $\displaystyle =$ $\displaystyle S_5[x_5] \oplus S_6[x_4] \oplus S_7[x_{10}] \oplus S_8[x_{11}] \oplus S_8[x_7]$  


$\displaystyle z_0z_1z_2z_3$ $\displaystyle =$ $\displaystyle x_0x_1x_2x_3 \oplus S_5[x_{13}] \oplus S_6[x_{15}] \oplus S_7[x_{12}] \oplus S_8[x_{14}] \oplus S_7[x_8]$  
$\displaystyle z_4z_5z_6z_7$ $\displaystyle =$ $\displaystyle x_8x_9x_{10}x_{11} \oplus S_5[z_0] \oplus S_6[z_2] \oplus S_7[z_1] \oplus S_8[z_3] \oplus S_8[x_{10}]$  
$\displaystyle z_8z_9z_{10}z_{11}$ $\displaystyle =$ $\displaystyle x_{12}x_{13}x_{14}x_{15} \oplus S_5[z_7] \oplus S_6[z_6] \oplus S_7[z_5] \oplus S_8[z_4] \oplus S_5[x_9]$  
$\displaystyle z_{12}z_{13}z_{14}z_{15}$ $\displaystyle =$ $\displaystyle x_4x_5x_6x_7 \oplus S_5[z_{10}] \oplus S_6[z_9] \oplus S_7[z_{11}] \oplus S_8[z_8] \oplus S_6[x_{11}]$  


$\displaystyle k_{m_9}$ $\displaystyle =$ $\displaystyle S_5[z_3] \oplus S_6[z_2] \oplus S_7[z_{12}] \oplus S_8[z_{13}] \oplus S_5[z_9]$  
$\displaystyle k_{m_{10}}$ $\displaystyle =$ $\displaystyle S_5[z_1] \oplus S_6[z_0] \oplus S_7[z_{14}] \oplus S_8[z_{15}] \oplus S_6[z_{12}]$  
$\displaystyle k_{m_{11}}$ $\displaystyle =$ $\displaystyle S_5[z_7] \oplus S_6[z_6] \oplus S_7[z_8] \oplus S_8[z_9] \oplus S_7[z_2]$  
$\displaystyle k_{m_{12}}$ $\displaystyle =$ $\displaystyle S_5[z_5] \oplus S_6[z_4] \oplus S_7[z_{10}] \oplus S_8[z_{11}] \oplus S_8[z_6]$  


$\displaystyle x_0x_1x_2x_3$ $\displaystyle =$ $\displaystyle z_8z_9z_{10}z_{11} \oplus S_5[z_5] \oplus S_6[z_7] \oplus S_7[z_4] \oplus S_8[z_6] \oplus S_7[z_0]$  
$\displaystyle x_4x_5x_6x_7$ $\displaystyle =$ $\displaystyle z_0z_1z_2z_3 \oplus S_5[x_0] \oplus S_6[x_2] \oplus S_7[x_1] \oplus S_8[x_3] \oplus S_8[z_2]$  
$\displaystyle x_8x_9x_{10}x_{11}$ $\displaystyle =$ $\displaystyle z_4z_5z_6z_7 \oplus S_5[x_7] \oplus S_6[x_6] \oplus S_7[x_5] \oplus S_8[x_4] \oplus S_5[z_1]$  
$\displaystyle x_{12}x_{13}x_{14}x_{15}$ $\displaystyle =$ $\displaystyle z_{12}z_{13}z_{14}z_{15} \oplus S_5[x_{10}] \oplus S_6[x_9] \oplus S_7[x_{11}] \oplus S_8[x_8] \oplus S_6[z_3]$  


$\displaystyle k_{m_{13}}$ $\displaystyle =$ $\displaystyle S_5[x_8] \oplus S_6[x_9] \oplus S_7[x_7] \oplus S_8[x_6] \oplus S_5[x_3]$  
$\displaystyle k_{m_{14}}$ $\displaystyle =$ $\displaystyle S_5[x_{10}] \oplus S_6[x_{11}] \oplus S_7[x_5] \oplus S_8[x_4] \oplus S_6[x_7]$  
$\displaystyle k_{m_{15}}$ $\displaystyle =$ $\displaystyle S_5[x_{12}] \oplus S_6[x_{13}] \oplus S_7[x_3] \oplus S_8[x_2] \oplus S_7[x_8]$  
$\displaystyle k_{m_{16}}$ $\displaystyle =$ $\displaystyle S_5[x_{14}] \oplus S_6[x_{15}] \oplus S_7[x_1] \oplus S_8[x_0] \oplus S_8[x_{13}]$  


$\displaystyle z_0z_1z_2z_3$ $\displaystyle =$ $\displaystyle x_0x_1x_2x_3 \oplus S_5[x_{13}] \oplus S_6[x_{15}] \oplus S_7[x_{12}] \oplus S_8[x_{14}] \oplus S_7[x_8]$  
$\displaystyle z_4z_5z_6z_7$ $\displaystyle =$ $\displaystyle x_8x_9x_{10}x_{11} \oplus S_5[z_0] \oplus S_6[z_2] \oplus S_7[z_1] \oplus S_8[z_3] \oplus S_8[x_{10}]$  
$\displaystyle z_8z_9z_{10}z_{11}$ $\displaystyle =$ $\displaystyle x_{12}x_{13}x_{14}x_{15} \oplus S_5[z_7] \oplus S_6[z_6] \oplus S_7[z_5] \oplus S_8[z_4] \oplus S_5[x_9]$  
$\displaystyle z_{12}z_{13}z_{14}z_{15}$ $\displaystyle =$ $\displaystyle x_4x_5x_6x_7 \oplus S_5[z_{10}] \oplus S_6[z_9] \oplus S_7[z_{11}] \oplus S_8[z_8] \oplus S_6[x_{11}]$  


$\displaystyle k_{r_1}$ $\displaystyle =$ $\displaystyle S_5[z_8] \oplus S_6[z_9] \oplus S_7[z_7] \oplus S_8[z_6] \oplus S_5[z_2]$  
$\displaystyle k_{r_2}$ $\displaystyle =$ $\displaystyle S_5[z_{10}] \oplus S_6[z_{11}] \oplus S_7[z_5] \oplus S_8[z_4] \oplus S_6[z_6]$  
$\displaystyle k_{r_3}$ $\displaystyle =$ $\displaystyle S_5[z_{12}] \oplus S_6[z_{13}] \oplus S_7[z_3] \oplus S_8[z_2] \oplus S_7[z_9]$  
$\displaystyle k_{r_4}$ $\displaystyle =$ $\displaystyle S_5[z_{14}] \oplus S_6[z_{15}] \oplus S_7[z_1] \oplus S_8[z_0] \oplus S_8[z_{12}]$  


$\displaystyle x_0x_1x_2x_3$ $\displaystyle =$ $\displaystyle z_8z_9z_{10}z_{11} \oplus S_5[z_5] \oplus S_6[z_7] \oplus S_7[z_4] \oplus S_8[z_6] \oplus S_7[z_0]$  
$\displaystyle x_4x_5x_6x_7$ $\displaystyle =$ $\displaystyle z_0z_1z_2z_3 \oplus S_5[x_0] \oplus S_6[x_2] \oplus S_7[x_1] \oplus S_8[x_3] \oplus S_8[z_2]$  
$\displaystyle x_8x_9x_{10}x_{11}$ $\displaystyle =$ $\displaystyle z_4z_5z_6z_7 \oplus S_5[x_7] \oplus S_6[x_6] \oplus S_7[x_5] \oplus S_8[x_4] \oplus S_5[z_1]$  
$\displaystyle x_{12}x_{13}x_{14}x_{15}$ $\displaystyle =$ $\displaystyle z_{12}z_{13}z_{14}z_{15} \oplus S_5[x_{10}] \oplus S_6[x_9] \oplus S_7[x_{11}] \oplus S_8[x_8] \oplus S_6[z_3]$  


$\displaystyle k_{r_5}$ $\displaystyle =$ $\displaystyle S_5[x_3] \oplus S_6[x_2] \oplus S_7[x_{12}] \oplus S_8[x_{13}] \oplus S_5[x_8]$  
$\displaystyle k_{r_6}$ $\displaystyle =$ $\displaystyle S_5[x_1] \oplus S_6[x_0] \oplus S_7[x_{14}] \oplus S_8[x_{15}] \oplus S_6[x_{13}]$  
$\displaystyle k_{r_7}$ $\displaystyle =$ $\displaystyle S_5[x_7] \oplus S_6[x_6] \oplus S_7[x_8] \oplus S_8[x_9] \oplus S_7[x_3]$  
$\displaystyle k_{r_8}$ $\displaystyle =$ $\displaystyle S_5[x_5] \oplus S_6[x_4] \oplus S_7[x_{10}] \oplus S_8[x_{11}] \oplus S_8[x_7]$  


$\displaystyle z_0z_1z_2z_3$ $\displaystyle =$ $\displaystyle x_0x_1x_2x_3 \oplus S_5[x_{13}] \oplus S_6[x_{15}] \oplus S_7[x_{12}] \oplus S_8[x_{14}] \oplus S_7[x_8]$  
$\displaystyle z_4z_5z_6z_7$ $\displaystyle =$ $\displaystyle x_8x_9x_{10}x_{11} \oplus S_5[z_0] \oplus S_6[z_2] \oplus S_7[z_1] \oplus S_8[z_3] \oplus S_8[x_{10}]$  
$\displaystyle z_8z_9z_{10}z_{11}$ $\displaystyle =$ $\displaystyle x_{12}x_{13}x_{14}x_{15} \oplus S_5[z_7] \oplus S_6[z_6] \oplus S_7[z_5] \oplus S_8[z_4] \oplus S_5[x_9]$  
$\displaystyle z_{12}z_{13}z_{14}z_{15}$ $\displaystyle =$ $\displaystyle x_4x_5x_6x_7 \oplus S_5[z_{10}] \oplus S_6[z_9] \oplus S_7[z_{11}] \oplus S_8[z_8] \oplus S_6[x_{11}]$  


$\displaystyle k_{r_9}$ $\displaystyle =$ $\displaystyle S_5[z_3] \oplus S_6[z_2] \oplus S_7[z_{12}] \oplus S_8[z_{13}] \oplus S_5[z_9]$  
$\displaystyle k_{r_{10}}$ $\displaystyle =$ $\displaystyle S_5[z_1] \oplus S_6[z_0] \oplus S_7[z_{14}] \oplus S_8[z_{15}] \oplus S_6[z_{12}]$  
$\displaystyle k_{r_{11}}$ $\displaystyle =$ $\displaystyle S_5[z_7] \oplus S_6[z_6] \oplus S_7[z_8] \oplus S_8[z_9] \oplus S_7[z_2]$  
$\displaystyle k_{r_{12}}$ $\displaystyle =$ $\displaystyle S_5[z_5] \oplus S_6[z_4] \oplus S_7[z_{10}] \oplus S_8[z_{11}] \oplus S_8[z_6]$  


$\displaystyle x_0x_1x_2x_3$ $\displaystyle =$ $\displaystyle z_8z_9z_{10}z_{11} \oplus S_5[z_5] \oplus S_6[z_7] \oplus S_7[z_4] \oplus S_8[z_6] \oplus S_7[z_0]$  
$\displaystyle x_4x_5x_6x_7$ $\displaystyle =$ $\displaystyle z_0z_1z_2z_3 \oplus S_5[x_0] \oplus S_6[x_2] \oplus S_7[x_1] \oplus S_8[x_3] \oplus S_8[z_2]$  
$\displaystyle x_8x_9x_{10}x_{11}$ $\displaystyle =$ $\displaystyle z_4z_5z_6z_7 \oplus S_5[x_7] \oplus S_6[x_6] \oplus S_7[x_5] \oplus S_8[x_4] \oplus S_5[z_1]$  
$\displaystyle x_{12}x_{13}x_{14}x_{15}$ $\displaystyle =$ $\displaystyle z_{12}z_{13}z_{14}z_{15} \oplus S_5[x_{10}] \oplus S_6[x_9] \oplus S_7[x_{11}] \oplus S_8[x_8] \oplus S_6[z_3]$  


$\displaystyle k_{r_{13}}$ $\displaystyle =$ $\displaystyle S_5[x_8] \oplus S_6[x_9] \oplus S_7[x_7] \oplus S_8[x_6] \oplus S_5[x_3]$  
$\displaystyle k_{r_{14}}$ $\displaystyle =$ $\displaystyle S_5[x_{10}] \oplus S_6[x_{11}] \oplus S_7[x_5] \oplus S_8[x_4] \oplus S_6[x_7]$  
$\displaystyle k_{r_{15}}$ $\displaystyle =$ $\displaystyle S_5[x_{12}] \oplus S_6[x_{13}] \oplus S_7[x_3] \oplus S_8[x_2] \oplus S_7[x_8]$  
$\displaystyle k_{r_{16}}$ $\displaystyle =$ $\displaystyle S_5[x_{14}] \oplus S_6[x_{15}] \oplus S_7[x_1] \oplus S_8[x_0] \oplus S_8[x_{13}]$  

Von $ k{r_i}$ werden jeweils nur die 5 niederwertigsten Bits benutzt (der Rest sei daher ausmaskiert).

Da der Algorithmus auf 128-Bit Schlüssel ausgelegt ist, muß der angegebene Schlüssel bei kleineren Schlüsselgrößen auf 128 bit rechts (niederwertigste Bits) mit Nullen aufgefüllt werden. Desweiteren muß bei Schlüsselgrößen bis 80 bits die Anzahl der Runden von 16 auf 12 verringert werden.

next up previous contents
Nächste Seite: CAST-256 Aufwärts: Algorithmus Vorherige Seite: Algorithmus   Inhalt
stigge@epost.de