Editing Block cipher (section)

===Substitution–permutation networks===
[[Image:SubstitutionPermutationNetwork-en.svg|thumb|200px|right|A sketch of a substitution–permutation network with 3 rounds, encrypting a plaintext block of 16 bits into a ciphertext block of 16 bits. The S-boxes are the ''S<sub>i</sub>'', the P-boxes are the same ''P'', and the round keys are the ''K<sub>i</sub>''.]]
{{Main|Substitution–permutation network}}

One important type of iterated block cipher known as a ''[[substitution–permutation network]] (SPN)'' takes a block of the plaintext and the key as inputs and applies several alternating rounds consisting of a [[Substitution box|substitution stage]] followed by a [[Permutation box|permutation stage]]—to produce each block of ciphertext output.<ref>{{cite book|last=Keliher|first=Liam|chapter=Modeling Linear Characteristics of Substitution–Permutation Networks|editor-last1=Hays|editor-first1=Howard |editor-last2=Carlisle|editor-first2=Adam|title=Selected areas in cryptography: 6th annual international workshop, SAC'99, Kingston, Ontario, Canada, August 9–10, 1999 : proceedings|publisher=Springer|year=2000|isbn=9783540671855|page=[https://archive.org/details/springer_10.1007-3-540-46513-8/page/n87 79]|url=https://archive.org/details/springer_10.1007-3-540-46513-8|display-authors=etal}}</ref> The non-linear substitution stage mixes the key bits with those of the plaintext, creating Shannon's ''[[confusion (cryptography)|confusion]]''. The linear permutation stage then dissipates redundancies, creating ''[[diffusion (cryptography)|diffusion]]''.<ref>{{cite book|last1=Baigneres|first1=Thomas|last2=Finiasz|first2=Matthieu|chapter=Dial 'C' for Cipher|editor-last1=Biham|editor-first1=Eli |editor-last2=Yousseff|editor-first2=Amr|title=Selected areas in cryptography: 13th international workshop, SAC 2006, Montreal, Canada, August 17–18, 2006 : revised selected papers|publisher=Springer|year=2007|isbn=9783540744610|page=77|chapter-url=https://books.google.com/books?id=yb99g5G7FS4C&pg=PA77}}</ref><ref>{{cite book|last1=Cusick|first1=Thomas W.|last2=Stanica|first2=Pantelimon|title=Cryptographic Boolean functions and applications|publisher=Academic Press|year=2009|isbn=9780123748904|page=164|url=https://books.google.com/books?id=OAkhkLSxxxMC&pg=PA164}}</ref>

A ''[[substitution box]] (S-box)'' substitutes a small block of input bits with another block of output bits. This substitution must be [[Bijection|one-to-one]], to ensure invertibility (hence decryption). A secure S-box will have the property that changing one input bit will change about half of the output bits on average, exhibiting what is known as the [[avalanche effect]]—i.e. it has the property that each output bit will depend on every input bit.<ref>{{cite book|last1=Katz|first1=Jonathan|last2=Lindell|first2=Yehuda|title=Introduction to modern cryptography|publisher=CRC Press|year=2008|isbn=9781584885511|url=https://archive.org/details/Introduction_to_Modern_Cryptography|page=[https://archive.org/details/Introduction_to_Modern_Cryptography/page/n184 166]}}, pages&nbsp;166–167.</ref>

A ''[[permutation box]] (P-box)'' is a [[permutation]] of all the bits: it takes the outputs of all the S-boxes of one round, permutes the bits, and feeds them into the S-boxes of the next round. A good P-box has the property that the output bits of any S-box are distributed to as many S-box inputs as possible.<ref>{{cite book | chapter-url=https://ieeexplore.ieee.org/document/6575944 | doi=10.1109/AICERA-ICMiCR.2013.6575944 | chapter=Key based S-box selection and key expansion algorithm for substitution-permutation network cryptography | title=2013 Annual International Conference on Emerging Research Areas and 2013 International Conference on Microelectronics, Communications and Renewable Energy | date=2013 | last1=Nayaka | first1=Raja Jitendra | last2=Biradar | first2=R. C. | pages=1–6 | isbn=978-1-4673-5149-2 }}</ref>

At each round, the round key (obtained from the key with some simple operations, for instance, using S-boxes and P-boxes) is combined using some group operation, typically [[XOR]].{{citation needed|date=April 2012}}

[[Decryption]] is done by simply reversing the process (using the inverses of the S-boxes and P-boxes and applying the round keys in reversed order).<ref>{{cite book | title=Block Cipher Cryptanalysis: An Overview | publisher=Indian Statistical Institute | author=Subhabrata Samajder | year=2017 | location=Kolkata | pages=5/52}}</ref>