# substitution-permutation network construction

I want to understand more about substitution-permutation network, if we modify it instead of carrying out the key-mixing, substitution, and permutation steps in alternating order for r rounds, the cipher instead first applies r rounds of key-mixing, then carries out r rounds of substitution, and finally applies r permutations. How this could affect the security, and what is the security of this construction?

• I'm pretty sure that this is homework. You should state this (if I'm correct). – Yehuda Lindell Oct 21 '16 at 6:50

• $M \oplus K_0 \oplus K_1 \oplus ... K_r$
• $K_0 \oplus K_1 \oplus ... K_r$ effectively compresses into one, single key
• Equivalent to $M ^ K$ in terms of security
More importantly, since the only key addition layer is at the front, and the S-box and permutation layer are assumed to be publicly known, a single known plaintext attack could break the construction: Simply encrypt the known block of information and then invert the permutation and S-box layers on the ciphertext. This leaves us with $M \oplus K$, which, since we know $M$, means we can do $M \oplus M \oplus K$ and recover $K$. Granted, $K$ is only the XOR sum of $K_0 \oplus K_1 \oplus ... K_r$, but we don't actually need the values of $K_0, K_1, ... K_r$ individually. We only need their sum in order to perform the encryption/decryption operation.