Field Guide · algorithm

Also known as: SPN

A substitution-permutation network (SPN) builds a block cipher by alternating two kinds of layer over many rounds: a substitution layer of S-boxes and a permutation layer that rearranges or linearly mixes bits.1 The two layers deliver Shannon’s confusion and diffusion, and the structure is the basis of AES, today’s dominant cipher.

⊕ key S-boxes permutation next round
One SPN round: mix in the round key, substitute through S-boxes, then permute — repeated over many rounds.

How it works

Each round of an SPN applies three steps to the whole block:

  • Key mixing — XOR in a round key derived from the master key by the key schedule.
  • Substitution — split the block into small chunks and pass each through an S-box, a nonlinear lookup that supplies confusion by making the relationship between key and ciphertext complicated and non-affine.
  • Permutation / mixing — shuffle or linearly combine the bits across the block so that the local effect of each S-box spreads out, supplying diffusion.

Stacking many such rounds means a one-bit change at the input cascades, after only a few rounds, into a change in roughly half the output bits — the avalanche effect. Unlike a Feistel network, an SPN transforms the entire block each round, so the substitution and permutation steps must themselves be invertible: decryption runs the inverse S-boxes and inverse permutation with the round keys reversed.

Variants — AES as the worked example

AES is the SPN everyone actually uses, and its round names map one-to-one onto the abstract layers:

  • AddRoundKey is the key-mixing step (XOR the 128-bit round key).
  • SubBytes is the substitution layer — every byte of the 16-byte state passes through the same 8-to-8-bit AES S-box.
  • ShiftRows and MixColumns together are the permutation/mixing layer: ShiftRows rotates the rows of the state (a byte permutation) and MixColumns mixes each column with a fixed matrix over GF(2⁸), so within two rounds every output byte depends on every input byte. The final round drops MixColumns to keep encryption and decryption symmetric.

AES runs 10, 12, or 14 such rounds for 128-, 192-, or 256-bit keys. Its MixColumns diffusion is engineered for a provable resistance bound against differential and linear attacks — the “wide trail” strategy — which is a defining advantage of the SPN approach over ad-hoc round functions.

Relevance to SDR

The most important SPN for radio work is AES, used for P25 AES-256 voice encryption and as a DMR encryption option. The construction is therefore behind much of the strongest encrypted traffic GopherTrunk sees, and — as with any well-designed cipher — recovering that audio without the key is infeasible. The same S-box-plus-permutation vocabulary also frames how weaker, non-encryption obfuscation schemes are analyzed: the clean-room talker-alias work in issue #773 recovered a fixed substitution table from public data, the kind of nonlinear lookup an SPN would call an S-box.

Sources

  1. Substitution–permutation network — Wikipedia, for the alternating substitution/permutation rounds, confusion/diffusion, and the AES round mapping. ↩

See also