Abstract: The round function F of Blow-CAST-Fish is composed of four S-boxes which are part of the subkeys.If S-boxes have a collision，the differential characteristic of function F with non-zero inputxor and a zero outputxor can be developed to perform a differential cryptanalysis of the algorithm which can recover the rest of the subkeys.After analyzing the collision of one S-box，differential characteristic of function F is constructed，then the 14-round differential characteristic with the probability 2-49 is identified.And the proportion of weak keys which can produce the differential characteristic is tested to be 2-52.4.Then based on 14-round differential characteristic，16-round Blow-CAST-Fish can be attacked.

Key words: Blow-CAST-Fish, differential characteristic, weak keys, round function, S-box

摘要： Blow-CAST-Fish的轮函数F由作为算法子密钥的四个S盒构成。如果S盒产生碰撞，则可构造F函数的输入差分为非零、输出差分为零的差分特征，进而对算法进行差分分析以获取其他子密钥。研究单个S盒的碰撞，构造F函数的差分特征，并测试使特征成立的弱密钥比例，给出了特征概率为2-49，弱密钥比例为2-52.4的14轮差分特征，并以此为基础，攻击16轮Blow-CAST-Fish。

关键词: Blow-CAST-Fish, 差分特征, 弱密钥, 轮函数, S盒