Use of the CAST-128 Encryption Algorithm in CMS
Extracted elements (13)
CAST-128 is available royalty-free and license-free for commercial and non-commercial uses worldwide, making it widely deployed in Internet applications and thus a suitable optional algorithm for S/MIME.
CAST-128 was chosen as an optional S/MIME algorithm primarily for performance reasons: 3DES (the mandatory algorithm) may be too slow for some environments, and CAST-128 offers relatively high performance along with a variable key size from 40 to 128 bits.
CAST-128 key wrap/unwrap procedures are defined to be identical to the RC2 procedures in RFC 2630 Sections 12.6.1, 12.6.4, and 12.6.5, with 'RC2' replaced by 'CAST-128', ensuring consistent CMS conformance.
An S/MIME client SHOULD announce the set of cryptographic functions it supports by using the S/MIME capabilities attribute. This attribute MUST be signed by the client, and OIDs MUST be ordered with respect to preference.
For content encryption, CAST-128 MUST be used in CBC mode. The key length is variable from 40 to 128 bits in 1-octet increments.
If an S/MIME client is required to support symmetric encryption with CAST-128, the capabilities attribute MUST contain the cast5CBC OID, and the associated parameter MUST be used to indicate supported key length.
If users require CAST-128 for symmetric encryption, it MUST be supported by the S/MIME clients on both the sending and receiving side, and it MUST be set in the user preferences.
It is RECOMMENDED that the size of the content-encryption key and the size of the key-encryption key be equal, since the security of the content will be at most the smaller of these two values.
Only 128-bit CAST-128 keys MAY be used as key-encryption keys, and they MUST be used with the cast5CMSkeywrapParameter set to 128.
When supporting 128-bit CAST-128, the SMIMECapability SEQUENCE MUST be DER-encoded as the hexadecimal string 301106092A864886F67D07420A300402020080.
CAST-128 is incorporated into CMS via two OIDs: cast5CBC for content encryption and cast5CMSkeywrap for key encryption. The content encryption OID is {iso(1) member-body(2) us(840) nt(113533) nsn(7) algorithms(66) 10} and the key encryption OID is {iso(1) member-body(2) us(840) nt(113533) nsn(7) algorithms(66) 15}.
Smaller CAST-128 key sizes (40, 56, or 64 bits) may be unacceptably weak for some environments. The use of larger key sizes (128 bits) is always RECOMMENDED when laws permit, and the content-encryption key and key-encryption key sizes SHOULD be equal.
The cast5CBCParameters ASN.1 SEQUENCE contains an OCTET STRING IV (DEFAULT 0) and an INTEGER keyLength in bits. The cast5CMSkeywrapParameter is simply an INTEGER representing key length in bits.