I understand what SP-network (Substitution-Permutation Network) and Feistel Network look like. And those ciphers based on Feistel (e.g. DES) often achieve so called E/D similarity, which indicates that the cipher itself follows the same pattern during either encryption or decryption.

SPN, comparing with Feistel Network, can bring more "confusion" into the cipher indeed. But the ciphers deriving from SPN (e.g. AES) may not be able to realize this E/D similarity. For instance, we have to put the inverse SBOX into the AES decryption process.

Thus, can we design a block cipher based on SP-network without loss of E/D similarity theoretically? Thanks!

  • $\begingroup$ Do you need a block cipher, or would a mode of operation on a block cipher suffice? If the latter, then CTR mode uses the same operation for encryption as for decryption. Likewise for modes based on CTR. $\endgroup$ Mar 2, 2021 at 18:19
  • $\begingroup$ Thanks @SAIPeregrinus. I actually need a block cipher rather a mode of operation, but your comment is still enlightening and worththinking. As for my question, I also wonder whether we can modify the SBox or other components (e.g. some matrix) in AES-like ciphers to achieve our goal here. $\endgroup$
    – Max1z
    Mar 3, 2021 at 1:40

1 Answer 1


Actually, to deal with the conflict between the inverse SBOX and E/D similarity, we can just expand the original SP network into something like "$S$->$P$->(entangled with key)->$P^{-1}$->$S^{-1}$". Then we can have a E/D similar block cipher. Some standard ciphers like PRINCE were designed this way.

However, it seems that we still can not make SPN itself to be of E/D similarity so we have to place extra components in it.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.