Microsoft Word - ASSA_TRAN+THI+LUONG_SPN.docx Adv Syst Sci Appl 2025; 3; 74-95 Published online at https://ijassa.ipu.ru. A Word-Oriented Substitution–Permutation Network Cipher with Security Evaluation based on Active S-Box Bounds and a Dynamic Advanced Encryption Standard-Based Variant Nguyen Van Long1, Tran Thi Luong1*, Nguyen Bui Cuong2, Truong Minh Phuong2 1) Academy of Cryptography Techniques, Hanoi, Vietnam 2) Institute of Cryptographic Science and Technology, Hanoi, Vietnam Abstract: The Substitution–Permutation Network (SPN) serves as a foundational structure in the design of modern block cipher algorithms due to its effective realization of two essential properties: confusion and diffusion. Currently, the security of SPNs is actively studied, with the S-box structure and the diffusion layer being key components analyzed to enhance resistance against attacks. In this paper, we propose a generalized SPN-based cipher model inspired by the Advanced Encryption Standard (AES) structure. We then present a novel theoretical approach to evaluating the security of this SPN cipher, based on a lower bound of the number of active S-boxes. This forms the basis for identifying the roles and cryptographic properties required of the component transformations in this type of cipher. Next, we propose a dynamic block cipher algorithm based on the AES cipher, which not only ensures the required level of security but also inherits the implementation advantages of the original AES. The dynamic AES block cipher demonstrates higher security compared to the original AES, passes randomness evaluation standards, and is efficiently implementable. These results are significant in guiding the design of secure and flexible block cipher algorithms, while also providing a theoretical foundation for the selection and evaluation of secure cryptographic components in modern cryptosystems. Keywords: Dynamic block cipher, active S-box, SPN block cipher, AES. 1. INTRODUCTION Block ciphers serve as fundamental building blocks in numerous modern network security protocols. Typically, these ciphers are designed using an iterative round-based structure, where each round comprises two primary layers [1]: a confusion layer and a diffusion layer. Among various designs, the SPN architecture is widely adopted for symmetric encryption due to its effective combination of nonlinear substitution (via S-boxes) and permutation (P-layer) to achieve both confusion and diffusion. In most SPN-based block ciphers [2–5], the diffusion layer is implemented using a linear transformation, while the confusion layer relies on small nonlinear substitution boxes, commonly 4 or 8 bits in size. Given their small size, these S- boxes offer limited nonlinearity, which highlights the importance of the diffusion layer in propagating the S-box nonlinearity across the entire cipher block. As emphasized in Shannon’s seminal work [1], strong cryptographic security depends on the joint and inseparable use of both confusion and diffusion mechanisms. Among the class of algorithms based on the above principle, AES [2] is arguably the most prominent representative of SPN block ciphers and has attracted the most extensive research in this field. From a security perspective, the designers of AES demonstrated that the algorithm achieves at least 25 active S-boxes after four rounds of operation [2]. This issue was later * Corresponding author: luongtranhong@gmail.com A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 75 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) revisited and extended in [6] to the case involving an 8×8 MDS matrix. However, the analysis in [6] is based on certain specific differential trails. As a result, the lower bounds on the number of active S-boxes for 3, 7, 11, ... rounds proposed in that study are not entirely accurate (see Table 1 and Table 3 in [6]). Thanks to its widespread adoption and long-established security, AES has become the focus of numerous studies aimed at enhancing and developing more optimized variants. One prominent research direction involves the construction of dynamic AES versions, in which core components and transformations within the round function are designed to be key- dependent or time-varying. From a design philosophy standpoint, the concept of dynamic block cipher security was introduced by L. Knudsen in [7], and this viewpoint was later supported by the original designers of AES, also in [7]. For dynamic versions of the AES block cipher, numerous research studies have been published, each proposing different dynamicization methods. Some approaches focus on making the AES S-boxes key-dependent [8–14], while others emphasize generating key- dependent MixColumn transformations [15–18]. Notably, there are studies that explore the dynamicization of both the S-box and MixColumn components of AES [19], and even the dynamicization of all three transformations—S-box, MixColumn, and ShiftRow—has garnered attention [20–22]. Another ongoing research direction involves making the XOR operation dynamic within AES [23–27]. Additionally, the authors in [28] proposed a dynamic AES approach where the number of encryption rounds varies for each plaintext block. In the context of dynamic S-box techniques for AES, Al-Dweik and colleagues [9] proposed a way to create key-dependent S-boxes that exhibit desirable algebraic characteristics such as nonlinearity, BIC, and SAC. However, other crucial cryptographic attributes of these S-boxes were not addressed in their study. Another approach to generating key-based S-boxes for AES was introduced in [10], which involves rearranging the S-box structure by employing a simulated key expansion algorithm. Additionally, the authors in [11] presented a technique to produce modified S-boxes by permuting the original AES S-box. These adaptable S-boxes depend on a secret key and incorporate affine constants and an unconventional polynomial. With each additional bit of the key, a newly rearranged S-box is generated, thereby enhancing the cipher’s complexity. In [12], an S-box generation algorithm based on the Playfair cipher was examined. The authors evaluated and compared criteria such as balance and avalanche standards between the modified block cipher with dynamic S-boxes and the original AES. However, similar to [9], other important cryptographic properties were not addressed. In [13], the authors proposed a key-dependent dynamic S-box generation algorithm for AES, utilizing a pseudo-random number generator (PRNG) based on three linear feedback shift registers (LFSRs). In [14], a completely different approach was explored, where dynamic S-boxes are generated based on Epoch time or Unix time during each encryption cycle. However, the method proposed in [14] lacks a clear explanation of the S-box generation mechanism when using Epoch or Unix time as input, which makes it difficult for readers to understand. Notably, the cryptographic properties of the resulting dynamic S-boxes were not mentioned at all. Returning to the problem of dynamic AES block cipher design at the MixColumns transformation layer, Murtaza et al. [15] proposed a key-dependent MixColumns transformation based on scalar multiplication, where the scalar multiplication is performed on the rows of the MDS matrix. Similar approaches were also applied in [16]. Additionally, the authors in [16] explored dynamic MixColumns transformations using exponentiation. Along the same lines, the authors in [17] utilized Self-Reciprocal Recursive MDS matrices to introduce dynamism into the MixColumns layer. Meanwhile, in [18], a collection of n×n binary matrices was presented that can be used to generate dynamic matrices resembling both the AES matrix and recursive MDS matrices. Regarding the dynamic modification of multiple transformation components within the AES round function, a notable example is presented in [19]. The authors introduced dynamic S-boxes and new MixColumns matrices that retain favorable cryptographic properties while 76 N.V. LONG, T.T. LUONG, N.B. CUONG, T.M. PHUONG Copyright ©2025 ASSA Adv. in Systems Science and Appl. (2025) developing a dynamic version of AES. Beyond the SubBytes and MixColumns components, the ShiftRows component was also made dynamic in the study by the authors in [20], where the dynamic approach is similarly key-dependent. The approach of constructing key- dependent, randomly generated dynamic transformation components was proposed in [21], where all three transformations—SubBytes, ShiftRows, and MixColumns—within the AES round function are made dynamic. However, no security evaluations were provided in this study. Continuing with the dynamic modification of these three cryptographic components, [22] introduced a new, efficient, key-dependent AES algorithm. For the AddRoundKey transformation in the AES round function, the authors in [23, 24] introduced improved techniques using key-dependent XOR tables generated through 3D chaotic maps. These XOR tables are based on initial secret parameters, resulting in a dynamic AES version where the AddRoundKey layer follows the rules of the new XOR tables. This approach was further investigated and developed by T. T. Luong et al. in [25-27], employing different XOR table generation techniques. Recently, in 2024, Adamu et al. published a study on dynamic AES [28]. In their approach, the number of encryption rounds for each data block is made dynamic and key-dependent. While this represents a novel method, we assess that it may not be fully reasonable from a security standpoint, since the number of rounds—such as 10 for AES-128—is a threshold chosen based on known cryptanalysis attacks. Randomizing the number of rounds without ensuring the necessary security bounds could compromise the entire system. Our observations are as follows: According to the philosophy of dynamic cryptosystems proposed by Knudsen in [7], introducing dynamism is meaningful from a security perspective. However, to the best of our understanding, dynamic methods must comply with minimal security principles. For example, cryptographic components such as the MDS property of the matrix in AES’s MixColumns transformation must be preserved, the cryptographic properties of the generated dynamic S-boxes should not be inferior to the original version, and the new ShiftRow operation must still ensure effective diffusion of active bytes, among others. Secondly, dynamic methods need to consider the potential significant impact on the implementation of the proposed solution. The research works we reviewed above seem to have overlooked these issues. In particular, those dynamic approaches fail to leverage AES’s table lookup implementation for optimizing speed. Some studies mention recalculating these tables after each dynamic change. However, for applications requiring frequent key changes, this recalculation can be even more complex than the encryption operations themselves for a single data block. This is likely a limitation affecting the practical applicability of dynamic block ciphers. Our contributions. In this study, we first propose a generalized AES-like SPN cipher model. Then, we introduce a novel approach to evaluate the security of these ciphers based on estimating a lower bound on the number of active S-boxes. Accordingly, we present a generalized AES-like SPN cipher model and provide a theoretical proof for the results obtained. From these results, we identify the crucial cryptographic roles and properties that each component of the cipher’s round function must possess. Building on this foundation, we propose an improved dynamic AES version with dynamic components that satisfy the necessary security requirements. Notably, our dynamic method does not require recomputing lookup tables in the optimized table-based implementation. This is a significant distinction compared to previous works, as it effectively addresses the practical implementation challenges of dynamic block ciphers. The dynamic AES cipher is carefully evaluated, demonstrating higher security than the original AES, meeting randomness standards, and enabling efficient implementation. Based on this, the remainder of the paper is organized as follows. Preliminary knowledge and notation are presented in Section 2. Section 3 introduces a generalized SPN block cipher model along with theoretical results on the lower bound of active S-boxes for four rounds of this cipher. A dynamic AES block cipher algorithm is proposed in Section 4. Section 5 A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 77 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) provides a security analysis of the dynamic AES cipher. Section 6 evaluates the randomness properties of the dynamic AES cipher. Section 7 analyzes the implementation efficiency of the dynamic AES cipher on a software platform. The conclusion is in Section 8. 2. PRELIMINARIES Some notations used in this paper include: 𝔽 : the binary field consisting of two elements, 0 and 1. 𝔽 : the Galois field containing 2 elements, with addition denoted by XOR (⊕) and multiplication denoted by (⊗). ℤ : the set of positive integers. 𝑥 ∥ 𝑦: the concatenation of bit string 𝑦 to bit string 𝑥. {𝑥} : a bit string 𝑥 of length 𝑑 bits. 𝑤𝑡(𝑥): the Hamming weight of the binary vector 𝑥. Given a vector 𝑥 represented as 𝑥 = 𝑥 ∥ 𝑥 ∥ ⋯ ∥ 𝑥 with 𝑥 ∈ {0,1} , the quantity 𝑤𝑡 (𝑥) is called the bundle weight of the vector 𝑥 and is defined as follows: 𝑤𝑡 (𝑥) = #{𝑥 |𝑥 ≠ 0}. Let 𝐴 be a linear transformation: 𝔽 ⟶ 𝔽 , we define the branch number of 𝐴, denoted by 𝐵𝑟 (𝐴), as follows: 𝐵𝑟 (𝐴) = 𝑚𝑖𝑛 ∈𝔽 , (𝑤𝑡 (𝑥) + 𝑤𝑡 (𝐴(𝑥))) Here, ⌈𝑥⌉ denotes the smallest integer 𝑞 such that 𝑞 ≥ 𝑥. 3. PROPOSE A GENERALIZED SPN CIPHER MODEL AND EVALUATE A LOWER BOUND ON THE NUMBER OF ACTIVE S-BOXES. In this section, we first introduce a generalized word-oriented SPN cipher model. We then present some theoretical results on the lower bound of the number of active S-boxes for this type of cipher. The security of this block cipher structure against linear and differential cryptanalysis is typically based on the lower bound of the number of active S-boxes. 3.1. Propose a Generalized SPN Cipher Model Inspired by the AES Structure In this section, we present a word-oriented SPN block cipher model based on three transformations that play roles similar to the SubBytes, ShiftRows, and MixColumns operations in AES. First, we define an 𝑚-diffuse linear transformation as follows: Definition 1. Let 𝜋 be a word-oriented linear transformation from {0,1} × to {0,1} × , where 𝑚, 𝑡 ∈ 𝑍 , and 𝑡 = 𝑚 × 𝑙 × 𝑛. Then, 𝜋 is called an 𝒎-diffuse transformation if each input and output state (belonging to {0,1} × ) is partitioned into 𝑚 disjoint consecutive subsets of {0,1} , satisfying the following property: in each output subset, there exist 𝑙 distinct 𝑤-bit words originating from all the input subsets of the transformation. For each string 𝑥 ∈ {0,1} × with 𝑚, 𝑡 ∈ 𝑍 , and 𝑡 = 𝑚 × 𝑙 × 𝑛 , besides the representation as 𝑛-bit words (in which case we can compute the bundle weight 𝑤𝑡 (𝑥)), 𝑥 can also be represented as 𝑡-bit words, where 𝑡 = 𝑚 × 𝑙 × 𝑛. Let 𝑥 = 𝑥 ∥ ⋯ ∥ 𝑥 , with 𝑥 ∈ {0,1} , 1 ≤ 𝑖 ≤ 𝑚. In this representation, we can also compute the bundle weight 𝑤𝑡 (𝑥). In this form, each 𝑥 is called a substate, and the transformation 𝜋 can be illustrated in Figure 3.1. 78 N.V. LONG, T.T. LUONG, N.B. CUONG, T.M. PHUONG Copyright ©2025 ASSA Adv. in Systems Science and Appl. (2025) Fig. 3.1. Illustration of the transformation π, where the black arrows represent the transfer of l′ n-bit words from each input state to the output substates We present some properties related to the 𝑚-diffuse transformation as follows: Lemma 3.1. Let 𝜋 be an 𝑚 -diffuse transformation from the set {0,1} × to {0,1} × , where 𝑚, 𝑘 ∈ 𝑍 , and 𝑡 = 𝑚 × 𝑙 × 𝑛. Then: 1. 𝜋 is also m-diffuse. 2. 𝑤𝑡 𝜋(𝑥 ) × 𝑙 ≥ 𝑤𝑡 𝑥 , for all 𝑗 = 1, … , 𝑚, where 𝑥 = 𝑥 , ∥ 𝑥 , ∥ ⋯ ∥ 𝑥 , , and 𝑥 , ∈ {0,1} . Proof. It is straightforward to verify this from the definition of an 𝑚-diffuse permutation. Consider the weight of 𝑥 as follows:  When 𝑤𝑡(𝑥 ) = 0, we have 𝑤𝑡 (𝑥 ) = 𝑚𝑖𝑛 ,…, 𝑤𝑡 (𝑥 , ) = 0.  When 𝑤𝑡(𝑥 ) > 0 , there exists some 𝑗 such that 𝑥 , ≠ 0 ∈ {0,1} . Suppose 𝑤𝑡 𝑥 , = 𝑑 , where 1 ≤ 𝑑 ≤ 𝑡 . Then, 𝑛 -bit blocks in 𝑥( , ) have nonzero bundle weight. Since the permutation 𝜋 has the 𝑚 -diffuse property, these 𝑛 -bit blocks in 𝑥( , ) will be diffused into 𝑡-bit substate blocks in 𝜋(𝑥 ). Thus, 𝑤𝑡 (𝜋(𝑥 )) ≥ 𝑑 𝑙′ = 𝑤𝑡 (𝑥 , ) 𝑙′ Therefore, 𝑤𝑡 (𝜋(𝑥 )) × 𝑙 ≥ 𝑤𝑡 (𝑥 , ) for all 𝑗 = 1, … , 𝑚. ■ Next, we consider the local diffusion transformation 𝜃: {0,1} × → {0,1} × , constructed from smaller-dimensional diffusion transformations 𝜃 : {0,1} → {0,1} for 1 ≤ 𝑖 ≤ 𝑚 , defined as follows: 𝜃(𝑥) = 𝜃 (𝑥 ) ∥ 𝜃 (𝑥 ) ∥ ⋯ ∥ 𝜃 (𝑥 ) (1) where 𝑥 = 𝑥 ∥ 𝑥 ∥ ⋯ ∥ 𝑥 , 𝑥 ∈ {0,1} . In this case, we obtain the following result about a transformation composed of 𝜋 and 𝜃 to achieve an optimally diffusive transformation with a higher dimension. Theorem 3.1. Let 𝜋, 𝜋 : {0,1} × → {0,1} × be two 𝑚 -diffuse permutations, and let 𝜃: {0,1} × → {0,1} × be a transformation defined by (1) based on 𝑚 n-bit-oriented transformations 𝜃 : {0,1} → {0,1} satisfying 𝐵𝑟(𝜃 ) = 𝑡 . Then, the transformation 𝜎 = 𝜋 ∘ 𝜃 ∘ 𝜋 satisfies: 𝑚𝑖𝑛 ∈{ , } × , 𝟎{𝑤𝑡 (𝑥) + 𝑤𝑡 (𝜎(𝑥))} × 𝑙′ ≥ 𝑚𝑖𝑛 ∈{ ,.., } {𝑡 } Proof. Consider the input to the transformation 𝜎 of the form 𝑥 = (𝑥 , . . , 𝑥 × ), where 𝑥 ∈ {0,1} for 𝑗 = 1, … , 𝑡 × 𝑚 . Let 𝑥 , 𝑥 , 𝑦 ∈ {0,1} × satisfy 𝑥 = 𝜋(𝑥 ), 𝑥 = 𝜃(𝑥 ) , and 𝑥 = 𝜋 (𝑥 ). Then, we have: A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 79 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) 𝑚𝑖𝑛 ∈{ , } × , 𝟎 𝑤𝑡 (𝑥 ) + 𝑤𝑡 𝜎(𝑥 ) = 𝑚𝑖𝑛 ∈{ , } × , 𝟎{𝑤𝑡 (𝑥 ) + 𝑤𝑡 (𝑥 )} = 𝑚𝑖𝑛 ∈{ , } × , 𝟎 𝑤𝑡 (𝜋 (𝑥 )) + 𝑤𝑡 𝜋 𝜃(𝑥 ) . Since 𝑥 ≠ 𝟎 (where 0 is the all-zero vector), there exists a subset in the partition of 𝑥 into 𝑚 disjoint consecutive subsets of the form 𝑥 , = (𝑥( )× , … , 𝑥 × ) satisfying 𝑤𝑡 𝑥 , = 𝑑 with 1 ≤ 𝑑 ≤ 𝑙 × 𝑚, 1 ≤ 𝑗 ≤ 𝑚. Then, since 𝐵𝑟 𝜃 = 𝑡, we have: 𝑤𝑡 𝑥 , + 𝑤𝑡 𝜃 𝑥 , ≥ 𝑡 . From Lemma 3.1 and the fact that 𝜋 and 𝜋 are 𝑚-diffuse transformations, we have: 𝑤𝑡 (𝜋 (𝑥 )) × 𝑙′ ≥ 𝑤𝑡 𝑥 , và 𝑤𝑡 𝜋(𝜃 𝑥 , ) × 𝑙′ ≥ 𝑤𝑡 𝜃 𝑥 , It follows that: 𝑤𝑡 (𝜋 (𝑥 )) + 𝑤𝑡 𝜋 𝜃(𝑥 ) × 𝑙′ ≥ 𝑡 , ∀𝑥 ∈ {0,1} × \{0}, 𝑗 = 1, … , 𝑚. 𝑚𝑖𝑛 ∈{ , } × , 𝟎{𝑤𝑡 (𝑥) + 𝑤𝑡 (𝜎(𝑥))} × 𝑙′ ≥ 𝑚𝑖𝑛 ∈{ ,.., } {𝑡 }. ■ Fig. 3.2. Description of the round function of the proposed generalized SPN cipher From the two diffusion transformations above, we propose a specific iterative block cipher with an SPN structure and an 𝑙-bit word-oriented round function, where the block size is 𝑛 bits, with 𝑙 = 𝑚 × 𝑙 × 𝑤. The input and output states of the round function of the block cipher are strings represented as states consisting of 𝑚 × 𝑙 blocks of 𝑛 bits, denoted by 𝑥 = (𝑥 , 𝑥 , … , 𝑥 × ) , where each 𝑥 is an 𝑛 -bit block. These are transformed through the following four basic operations: The round key addition: 𝐾 with the input state 𝑥. However, this addition does not affect the number of active S-boxes for different fault patterns, so we can omit it from consideration. The nonlinear transformation 𝛾: uses a 𝑤-bit S-box 𝑠, which is applied in parallel across the state as follows: 𝛾(𝑥) = 𝛾(𝑥 , 𝑥 , … , 𝑥 × ) = 𝑠(𝑥 ) ∥ 𝑠(𝑥 ) ∥ ⋯ ∥ 𝑠(𝑥 × ) ∥ 𝑠(𝑥 × ) The permutation 𝜋: provides full diffusion, permuting the 𝑛-bit words within each state as follows: 𝜋(𝑥 , … , 𝑥 × ) = 𝑥 ( ) ∥ 𝑥 ( ) ∥ ⋯ ∥ 𝑥 ( × ), where 𝜌 is a permutation of the set {1, … , 𝑙′ × 𝑚 } such that 𝜋 s an 𝑚-diffuse from {0,1} × → {0,1} × , with 𝑡 = 𝑙′ × 𝑚 × 𝑛. 80 N.V. LONG, T.T. LUONG, N.B. CUONG, T.M. PHUONG Copyright ©2025 ASSA Adv. in Systems Science and Appl. (2025) The mixing step 𝜃: is applied in parallel to substates of size (𝑚 ⋅ 𝑙 ) × (𝑚 ⋅ 𝑙 ) over the field GF(2 ) , based on a matrix 𝑀 with branch number Br(𝑀) . The state is divided into 𝑚 substates, each of which is transformed through this mixing step. We refer to the SPN cipher with this proposed structure as 𝛾𝜋𝜃_𝑆𝑃𝑁. This structure is illustrated in Figure 3.2. Based on the proposed generalized SPN cipher (𝛾𝜋𝜃_𝑆𝑃𝑁), we describe several existing SPN block ciphers in terms of the transformations and parameters of the proposed generalized SPN structure. Table 3.1 lists several word-oriented block ciphers that use this structure with a block size of 128 bits and their corresponding transformations. For the case of 128-bit byte-oriented block ciphers, Table 3.1 includes all existing SPN ciphers whose transformations satisfy the properties and conditions we analyzed above. Note that for 𝑚 = 8, there is no permutation 𝜋 that satisfies the 𝑚-diffuse property. Table 3.1. Some specific instances of the proposed generalized SPN structure Cipher 𝒏 𝒎 𝒍′ 𝜸 𝝅 𝜽 Source AES 8 4 1 SubBytes ShiftRows MixColumns (4 × 4 MDS matrix over 𝔽 ) [2] Kalyna128 8 2 4 𝜋 𝜏 𝜓 (8 × 8 MDS matrix over 𝔽 ) [4] Kuznyechik 8 1 16 𝜋′ Identity mapping 𝐿 (16 × 16 MDS matrix over 𝔽 ) [5] 3.2. Lower Bound Evaluation of the Number of Active S-Boxes in the Proposed Generalized SPN Cipher Model In this section, we present the lower bound on the number of active S-boxes over four rounds of the proposed generalized SPN cipher 𝛾𝜋𝜃_𝑆𝑃𝑁. Theorem 3.2. Four consecutive rounds of a block cipher using a round function structured in the form of 𝛾𝜋𝜃_𝑆𝑃𝑁 will have a number of active S-boxes no less than ( ) × 𝐵𝑟(𝑀). Proof. For the convenience of presentation, we denote the input difference of a transformation— such as the transformation 𝜃 —at round 𝑖 as Δ𝑖𝑛 , = (Δ𝑖𝑛 , , … , Δ𝑖𝑛 , ) , where Δ𝑖𝑛 , ∈ {0,1}, 1 ≤ 𝑗 ≤ 𝑙. Then, the total number of active S-boxes over rounds 1, 2, 3, and 4 is: 𝑛 + 𝑛 + 𝑛 + 𝑛 = 𝑤𝑡 (Δ𝑖𝑛 , ) + 𝑤𝑡 (Δ𝑖𝑛 , ) + 𝑤𝑡 (Δ𝑖𝑛 , ) + +𝑤𝑡 (Δ𝑖𝑛 , ). Since the 𝑛-bit S-boxes only shuffle within 𝑛-bits, and the transformations 𝜋 and 𝜋 are word-oriented 𝑚-diffuse transformations over 𝑤-bit words, it is easy to prove that: 𝑤𝑡 (Δ𝑖𝑛 , ) = 𝑤𝑡 (Δ𝑜𝑢𝑡 , ), ∀𝑟 ∈ {1, … ,4} 𝑤𝑡 (𝑥) = 𝑤𝑡 𝜋 𝜃 𝜋 (𝑥) , ∀𝑥 ∈ {0,1} × . To facilitate the calculation of the number of active S-boxes, we add two transformations, 𝜋 and 𝜋 , to the output of the 𝜃 transformation in the second round. Then, by applying the result of Theorem 3.1 to the inputs of the three transformations—𝜋 (of the second round), 𝜃 (of the second round), and the added 𝜋 transformation—we obtain: 𝑤𝑡 (Δ𝑖𝑛 , ) + 𝑤𝑡 𝜋 𝜃 𝜋(Δ𝑖𝑛 , ) × 𝑙′ ≥ 𝐵𝑟(𝑀) Since: 𝜋 𝜃 𝜋(Δ𝑖𝑛 , ) = 𝜋 Δ𝑖𝑛 , , therefore, we obtain: A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 81 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) 𝑤𝑡 (Δ𝑖𝑛 , ) + 𝑤𝑡 𝜋 Δ𝑖𝑛 , × 𝑙′ ≥ 𝐵𝑟(𝑀) Thus, the input differences of the substitution-diffusion-substitution structures in rounds (1, 2) and (3, 4) will activate a number of S-boxes equal to ( ) (see illustration in Figure 3). Since in each of these patterns, the number of active S-boxes is no less than 𝐵𝑟(𝑀), the total number of active S-boxes for any input difference will be no less than ( ) × 𝐵𝑟(𝑀).■ Fig. 3.3. Illustration of difference propagation through four rounds of the block cipher γπθ_SPN From Theorem 3.2, we derive the following corollary. Corollary 3.1. Four consecutive rounds of iterative block ciphers using a round function structured like 𝛾𝜋𝜃_𝑆𝑃𝑁 , where the transformation 𝜃 employs MDS matrices of size (𝑚 ⋅ 𝑙 ) × (𝑚 ⋅ 𝑙 ) over the field 𝔽 , will have a number of active S-boxes no less than (𝑚 + 1) × (𝑚 ⋅ 𝑙 + 1). Indeed, this follows directly from the fact that 𝐵𝑟(𝑀) = (𝑚 ∙ 𝑙′ + 1 ). By applying Corollary 3.1, we can recover known results for practical SPN block ciphers (see Table 2.2). This further confirms the validity of our Theorem 3.2and Corollary 3.1. Table 3.2. Lower bounds on the number of active S-boxes over 4 rounds for several SPN ciphers Cipher 𝒏 𝒎 𝒍′ Lower bound on the number of active S-boxes AES 8 4 1 25 Kalyna 8 2 4 27 Kuneztik 8 1 16 34 Remark 3.1. A natural question arises: if we remove the 𝑚-diffuse condition from the ShiftRows-type transformation such as 𝜋 in 𝛾𝜋𝜃 − 𝑆𝑃𝑁, will the lower bound on the number of active S-boxes over four rounds be affected? The answer is yes. We examined a specific 82 N.V. LONG, T.T. LUONG, N.B. CUONG, T.M. PHUONG Copyright ©2025 ASSA Adv. in Systems Science and Appl. (2025) case with AES, where its ShiftRows transformation does not satisfy the 𝑚-diffuse property, and the result shows that for its four-round transformation, the number of active S-boxes is always less than 25. Thus, the role of the transformation 𝜋 in the generalized SPN cipher model is truly significant. Its design not only directly impacts the security level but also affects the implementation efficiency of the block cipher algorithm. Based on the theoretical foundation presented in this section, in the next section, we propose a modification to the ShiftRows layer in AES to obtain a key-dependent dynamic version of AES, which maintains the required level of security without significantly compromising the high-speed implementation capability of the original AES algorithm. 4. PROPOSAL OF A SECURE AND EFFICIENT KEY-DEPENDENT DYNAMIC AES ALGORITHM The original AES algorithm is not only secure but also achieves high execution speed on many platforms. The implementation method using lookup tables for this type of block cipher has become popular and familiar within the cryptographic community. It is regarded as a “must- have property” of a byte-oriented SPN block cipher. Many dynamic AES algorithm approaches have been proposed, but it seems that they do not maintain the flexible implementation using the lookup tables of the original AES. This may be a limitation in the applicability of the dynamic algorithm. To overcome this issue, we propose a modification in the ShiftRows transformation of the original AES to obtain a secure and efficient key- dependent dynamic AES variant. As we know, the AES algorithm processes a 128-bit data block divided into 16 bytes arranged into a 4 × 4 two-dimensional state matrix. We name the proposed dynamic AES algorithm AES_DST, which includes the following basic transformations:  The AddRoundKeys operation is the same as in the original AES  The SubBytes operation is the same as in the original AES  The MixColumns operation is the same as in the original AES  The key schedule is the same as in the original AES The byte permutation consists of two key-dependent transformations: ShiftRows and TranBytes. Among them, the ShiftRows operation is the same as in the original AES, while TranBytes is a transpose of the 4 × 4 data state matrix. These two transformations are selected based on a secret key. The steps performed in the dynamic block cipher algorithm AES_DST are described as in Algorithm 4.1. Algorithm 4.1. The dynamic block cipher algorithm AES_DST INPUT: - A 128-bit input data block (in) is organized into a 4 × 4 state matrix state. - The master key (masterKey) has a length of 𝑘 bits ( 𝑘 = 128, 192, 256 bits corresponding to the dynamic AES-128, AES-192, and AES-256 versions with 𝑛 = 10, 12, 14 rounds, respectively). - The dynamic key 𝑘𝑑 has a length of 𝑛 bits. OUTPUT: 128-bit ciphertext block. Step 1. From the master key (masterKey) compute the array of round keys (𝑤) through the key schedule. Step 2. Encryption process – Procedure 𝐶𝑖𝑝ℎ𝑒𝑟(𝑖𝑛, 𝑑𝐾𝑒𝑦, 𝑛 , 𝑤): 1. 𝑠𝑡𝑎𝑡𝑒 ← 𝑖𝑛 2. 𝑠𝑡𝑎𝑡𝑒 ← 𝐴𝑑𝑑𝑅𝑜𝑢𝑛𝑑𝐾𝑒𝑦(𝑠𝑡𝑎𝑡𝑒, 𝑤[0. .3]) A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 83 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) 3. for round from 1 to 𝑛 − 1 do 4. 𝑠𝑡𝑎𝑡𝑒 ← 𝑆𝑢𝑏𝐵𝑦𝑡𝑒𝑠(𝑠𝑡𝑎𝑡𝑒) 5. if 𝑘𝑑[𝑟𝑜𝑢𝑛𝑑 − 1] = 1 then 6. 𝑠𝑡𝑎𝑡𝑒 ← 𝑆ℎ𝑖𝑓𝑡𝑅𝑜𝑤𝑠(𝑠𝑡𝑎𝑡𝑒) 7. else 8. 𝑠𝑡𝑎𝑡𝑒 ← 𝑇𝑟𝑎𝑛𝐵𝑦𝑡𝑒𝑠(𝑠𝑡𝑎𝑡𝑒) 9. end if 10. 𝑠𝑡𝑎𝑡𝑒 ← 𝑀𝑖𝑥𝐶𝑜𝑙𝑢𝑚𝑛𝑠(𝑠𝑡𝑎𝑡𝑒) 11. 𝑠𝑡𝑎𝑡𝑒 ← 𝐴𝑑𝑑𝑅𝑜𝑢𝑛𝑑𝐾𝑒𝑦𝑠(𝑠𝑡𝑎𝑡𝑒, 𝑤[4 ⋅ 𝑟𝑜𝑢𝑛𝑑. .4 ⋅ 𝑟𝑜𝑢𝑛𝑑 + 3]) 12. end for 13. 𝑠𝑡𝑎𝑡𝑒 ← 𝑆𝑢𝑏𝐵𝑦𝑡𝑒𝑠(𝑠𝑡𝑎𝑡𝑒) 14. if 𝑘𝑑[𝑛 ] = 1 then 15. 𝑠𝑡𝑎𝑡𝑒 ← 𝑆ℎ𝑖𝑓𝑡𝑅𝑜𝑤𝑠(𝑠𝑡𝑎𝑡𝑒) 16. else 17. 𝑠𝑡𝑎𝑡𝑒 ← 𝑇𝑟𝑎𝑛𝐵𝑦𝑡𝑒𝑠(𝑠𝑡𝑎𝑡𝑒) 18. end if 19. 𝑠𝑡𝑎𝑡𝑒 ← 𝐴𝑑𝑑𝑅𝑜𝑢𝑛𝑑𝐾𝑒𝑦𝑠(𝑠𝑡𝑎𝑡𝑒, 𝑤[4 ⋅ 𝑟 . .4 ⋅ 𝑟 + 3]) 20. return 𝑠𝑡𝑎𝑡𝑒. Here, we only describe the procedure for the encryption process; the decryption process can be performed similarly but in reverse order. 5. SECURITY EVALUATION OF THE DYNAMIC BLOCK CIPHER AES_DST First, we can observe that the TranBytes operation is a transposition of the state matrix. It can be easily verified that it satisfies Definition 1, or in other words, it possesses the 𝑚-diffusion property. This means that four encryption rounds of our dynamic AES variant still conform to the results stated in Corollary 3.1. Figure 4 illustrates the encryption/decryption diagram of the dynamic block cipher AES_DST. In the field of block cipher analysis, several attack techniques have been developed, including differential cryptanalysis [29, 30, 31], linear cryptanalysis [32, 33], and algebraic attacks [31, 34], among others. This section concentrates on two of the most influential and widely studied methods: linear and differential cryptanalysis. These techniques play a key role in assessing the robustness of block cipher designs. Linear cryptanalysis seeks to uncover approximate linear correlations between input bits, output bits, and key bits, which can then be exploited to infer parts of the secret key. In contrast, differential cryptanalysis examines how specific differences in input values affect the output, allowing attackers to detect high probability patterns that can aid in key recovery. Together, these methods serve as critical benchmarks for measuring the cryptographic strength of modern block ciphers. 5.1. Preservation of the Wide Trail Strategy in AES_DST By incorporating key-dependent dynamic byte permutation transformations (including ShiftRows and TranBytes) based on the bits of the key 𝑘𝑑, we obtain the dynamic block cipher AES_DST without compromising the wide trail strategy used in the design of the original AES [2]. To clarify this point, we analyze the diffusion level of active bytes as they pass through two consecutive rounds in the AES_DST algorithm. 84 N.V. LONG, T.T. LUONG, N.B. CUONG, T.M. PHUONG Copyright ©2025 ASSA Adv. in Systems Science and Appl. (2025) Fig. 5.1. Round Structure Diagram of the AES_DST Encryption/Decryption Process Figures 5.1 and Figures 5.2 illustrate the role of the ShiftRows transformation in propagating active bytes. Input State After SubByte After ShiftRow After Mixcolumn Fig. 5.2. Distribution of active bytes during the first round of the AES_DST dynamic block cipher using ShiftRows Figure 5.1 demonstrates the diffusion behavior during the first round of AES, beginning with a state matrix that contains only one active byte. After the SubBytes and ShiftRows operations, the state still has a single active byte; however, the MixColumns transformation, thanks to the diffusion characteristics of the MDS matrix, expands this to four active bytes. This number remains unchanged after the AddRoundKey step. Therefore, a single active byte at the start of the round propagates to four active bytes by the end of the first round. Active bytes are highlighted as black squares. A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 85 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) Input State After SubByte After ShiftRow After Mixcolumn Fig. 5.2. Spread of active bytes during the second round of the AES_DST dynamic block cipher using ShiftRows Figure 5.2 illustrates the key role of ShiftRows in distributing active bytes from one column across all four columns of the state matrix. Consequently, following the MixColumns operation, the active bytes spread to cover all 16 bytes in the state matrix. Figure 5.3 and Figure 5.4 demonstrate how the TranBytes transformation contributes to the diffusion of active bytes. Input State After SubByte After TranBytes After Mixcolumn Fig.5.3. Spread of active bytes during the first round of the AES_DST dynamic block cipher using TranBytes Input State After SubByte After TranBytes After Mixcolumn Fig. 5.4. Distribution of active bytes during the second round of the AES_DST dynamic block cipher using TranBytes Similar to the ShiftRows transformation, thanks to the TranBytes transformation, starting from a single active byte, the number of active bytes expands to the maximum of 16 bytes across the entire state matrix after two rounds. From the above illustrations, it is evident that both ShiftRows and TranBytes transformations enable the dynamic block cipher AES_DST to adhere to the wide trail strategy used in the design of the original AES. According to the philosophy of dynamic block ciphers proposed by Knudsen in 2015 [7], our dynamic AES version not only inherits the security properties of the original AES but, in some respects, also increases the complexity of cryptanalysis. In differential cryptanalysis and its variants, when differential trails depend on the key, the complexity of attacks rises. This is because the attacker must consider all possible cases—on the order of 2 , where 𝑛 is the number of encryption rounds—to determine which differential path the data follows. Furthermore, the security of the dynamic block cipher is also supported by Vincent Rijmen [8], one of the two principal designers of the AES block cipher. We will provide a more detailed analysis of this in the following sections. 5.2. Analysis of Linear Cryptanalysis on the Dynamic Block Cipher AES_DST To perform linear cryptanalysis on the block cipher, one needs to build a linear approximation covering 𝑛 − 1 rounds, along with a corresponding linear expression for the full 𝑛 -round cipher. The procedure involves the following steps: Develop a linear approximation spanning 𝒏𝒓 − 𝟏 rounds along with an associated linear equation for the 𝒏𝒓-round block cipher. Step 1: Generate the linear approximation matrix for the S-box. 86 N.V. LONG, T.T. LUONG, N.B. CUONG, T.M. PHUONG Copyright ©2025 ASSA Adv. in Systems Science and Appl. (2025) Step 2: Determine which S-boxes are active (with non-zero input and output masks) in the rounds and assign suitable linear approximations from the matrix created in Step 1 to these S- boxes. Step 3: Develop the overall linear equation for the block cipher and assess its deviation from uniform probability. Fig. 5.5. The final round of the AES_DST dynamic block cipher AES_DST, the dynamic block cipher, performs 𝑛 rounds on a 128-bit input block and employs 8 × 8 substitution boxes. Let 𝐾 represent the secret key for AES_DST, from which the round keys 𝐾 , 𝐾 , … , 𝐾 , 𝐾 are generated. Denote by 𝑃 the plaintext and by 𝐶 the ciphertext produced by the AES_DST dynamic block cipher. For the 𝑖-th round, let 𝐴 and 𝐵 be the inputs and outputs of the S-boxes, respectively. The bit 𝐴 , refers to the 𝑗-th bit of 𝐴 , where 𝑖 ranges from 1 to 𝑛 and 𝑗 ranges from 1 to 128. In AES_DST, the permutation is represented by 𝐷 . It is important to note that the linear approximation of AES depends solely on the plaintext, the input bits to the last round (𝑛 -th round), and the bits of the subkeys 𝐾 , 𝐾 , … , 𝐾 . In AES_DST, the permutation 𝐷 —encompassing both the ShiftRows/TranBytes and MixColumns steps—is transformed from a fixed operation into a dynamic one. Specifically, unlike the original static ShiftRows, this version employs a key-dependent dynamic ShiftRows/TranBytes. The ShiftRow/TranBytes operation works on a 4 × 4 byte state array. Let 𝑆 denote the input state array for ShiftRow/TranBytes, with its bytes numbered from 1 to 16 as follows: 𝑆 = 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 𝑠 The ShiftRow transformation works by keeping the first row of the state array intact, while the second row is shifted left by one byte, the third row by two bytes, and the fourth row by three bytes. A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 87 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) Hence, ShiftRow can be described as a specific permutation of bytes as follows: 𝑆 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 𝑆ℎ𝑖𝑓𝑡𝑅𝑜𝑤(𝑆) 1 6 11 16 5 10 15 4 9 14 3 8 13 2 7 12 The inverse of the ShiftRow transformation, denoted as 𝑆ℎ𝑖𝑓𝑡𝑅𝑜𝑤 , can likewise be expressed through a byte permutation as shown below: 𝑆 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 𝑆ℎ𝑖𝑓𝑡𝑅𝑜𝑤 (𝑆) 1 14 11 8 5 2 15 12 9 6 3 16 13 10 7 4 TranBytes functions by rearranging the state matrix, and as such, it can be represented as a byte-level permutation as follows: 𝑆 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 𝑇𝑟𝑎𝑛𝐵𝑦𝑡𝑒𝑠(𝑆) 1 5 9 13 2 6 10 14 3 7 11 15 4 8 12 16 The inverse TranBytes operation, 𝑇𝑟𝑎𝑛𝐵𝑦𝑡𝑒𝑠 , can similarly be expressed as a byte permutation as follows: 𝑆 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 𝑇𝑟𝑎𝑛𝐵𝑦𝑡𝑒𝑠 (𝑆) 1 5 9 13 2 6 10 14 3 7 11 15 4 8 12 16 In the AES_DST dynamic block cipher, a major obstacle for attackers lies in forming a linear approximation over 𝑛 − 1 rounds and deriving a linear expression for the full cipher. While the initial step of cryptanalysis is carried out normally, difficulties arise in the next step when choosing active S-boxes in each round, due to the unknown nature of the permutation. This uncertainty complicates correlating S-boxes between rounds, forcing attackers to select them randomly. Even if by chance an attacker succeeds in constructing a linear approximation spanning 𝑛 − 1 rounds and a corresponding expression for the entire AES_DST, the process remains highly challenging. Assume that this linear expression takes the following form: 𝐴 , ⊕ 𝐴 , ⊕ … ⊕ 𝐴 , ⊕ ((𝑃 ⊕ 𝑃 ⊕ … ⊕ 𝑃 ) ⊕ 𝐾 , ⊕ … 𝐾 , ⊕ 𝐾 , ⊕ … .⊕ 𝐾 , ⊕ … ⊕ 𝐾 , ) = 0 (2) Referring to the last round (see Fig. 9), let’s assume the attacker can extract certain bits of the subkey 𝐾 , which correspond to the active S-boxes identified in round 𝑛 . Additionally, the attacker can derive some essential bits of 𝐴 . 𝐴 = 𝐷 𝐵 ⊕ 𝐾 (3) Using equation (3) as a starting point, the attacker continues by making guesses on the associated key bits of 𝐾 , subsequently trying to derive the required bits of 𝐵 following equation (4). 𝐵 = 𝐷 𝐴 ⊕ 𝐾 (4) In dynamic AES block ciphers, the diffusion-layer permutation 𝐷 varies depending on the key. This means the attacker cannot identify the exact 𝐷 used in the cipher, preventing them from calculating the required bits of 𝐵 based on equation (4). As a result, the attacker is unable to extract the corresponding key bits of 𝐾 , and faces similar obstacles with the other subkeys as well. Therefore, under these circumstances, the attacker is limited to obtaining some bits of the subkey 𝐾 and is unable to deduce any further key bits from the remaining subkeys. To perform standard linear cryptanalysis, the attacker needs to determine the specific permutation 𝐷 applied within the dynamic AES block cipher before they can continue with the attack. Initially, it is assumed that during the process of forming a linear approximation for the dynamic AES block cipher, the attacker encounters more difficulties in Step 2 than with the original AES. Because the permutation used in AES_DST varies dynamically and is unknown, the attacker is forced to pick S-boxes randomly across rounds. These selections may lack correlation, which hampers the construction of 𝑛 − 1-round linear approximations and the overall linear expression for the dynamic AES_DST cipher. 88 N.V. LONG, T.T. LUONG, N.B. CUONG, T.M. PHUONG Copyright ©2025 ASSA Adv. in Systems Science and Appl. (2025) By introducing key-dependent ShiftRow/TranBytes operations that make the permutation layer dynamic in the AES_DST block cipher, the difficulty of carrying out linear cryptanalysis rises considerably compared to the conventional static AES cipher. 5.3. Analysis of Differential Cryptanalysis on the Dynamic Block Cipher AES_DST To conduct differential cryptanalysis on the block cipher, it is necessary to develop a differential characteristic spanning 𝑛 − 1 rounds, as well as the associated differential for the full 𝑛 -round cipher. The process for building these is outlined below: Develop a differential characteristic covering 𝒏𝒓 − 𝟏 rounds along with the matching differential applicable to the entire 𝒏𝒓 -round block cipher. Step 1*: Create the differential distribution table for the S-box. Step 2*: Identify specific active S-boxes in each round (i.e., those exhibiting non-zero differentials) and assign corresponding differentials from the table developed in Step 1*. Step 3*: Calculate the overall differential characteristic of the block cipher and evaluate its probability. It is important to highlight that the block cipher’s differential is linked to a differential characteristic spanning 𝑛 − 1 rounds. This differential is denoted by (∆𝐴, ∆𝐵) , with ∆𝐴 representing the input difference at the plaintext stage, and ∆𝐵 indicating the input difference at the final round. The overall differential characteristic encompasses the individual differentials of the chosen S-boxes across the rounds. AES_DST, the dynamic block cipher, performs 𝑛 rounds on a 128-bit input block and employs 8 × 8 substitution boxes. Let 𝐾 represent the secret key for AES_DST, from which the round keys 𝐾 , 𝐾 , … , 𝐾 , 𝐾 are generated. Denote by 𝑃 the plaintext and by 𝐶 the ciphertext produced by the AES_DST dynamic block cipher. For the 𝑖-th round, let 𝐴 and 𝐵 be the inputs and outputs of the S-boxes, respectively. The bit 𝐴 , refers to the 𝑗-th bit of 𝐴 , where 𝑖 ranges from 1 to 𝑛 and 𝑗 ranges from 1 to 128. Let Δ𝐴 = 𝐴 ⊕ 𝐴 and Δ𝐵 = 𝐵 ⊕ 𝐵 represent the input and output differences of the S-boxes at round 𝑖. Here, ∆𝐴 , denotes the 𝑗-th bit of Δ𝐴 , with 1 ≤ 𝑖 ≤ 𝑛 and 1 ≤ 𝑗 ≤ 128. The permutation operation in AES_DST is still represented by 𝐷 . For the AES_DST dynamic cipher, a significant obstacle encountered by attackers lies in forming an 𝑛 − 1-round differential characteristic along with the matching differential for the complete cipher. Although Step 1* proceeds as usual, Step 2*, which involves choosing active S-boxes in various rounds, proves problematic since the permutation is unknown. This uncertainty complicates the task of correlating S-boxes across rounds, forcing the attacker to select these S-boxes randomly. Assuming the attacker is fortunate enough, they might still construct a valid differential characteristic for the entire AES_DST cipher. Assuming the attacker manages to recover specific bits of the subkey 𝐾 , particularly those associated with the selected active substitution boxes in the final round, they may also be capable of deriving some necessary bits from both inputs 𝐴 and 𝐴 of that round. Using equation (3), the cryptanalyst can infer 𝐵 based on equation (4) (𝐵 = 𝐷 𝐴 ⊕ 𝐾 ). Following this, the attacker attempts to estimate the key bits of the subkey 𝐾 that influence the output of the round. With these guesses, they reconstruct 𝐵 , and do the same to get 𝐵 . The bitwise difference is then calculated as: Δ𝐵 = 𝐵 ⊕ 𝐵 Then, if the derived bits of Δ𝐵 match those in the differential characteristic previously constructed, the guessed key bits are likely correct for 𝐾 . A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 89 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) In contrast to static designs, the AES_DST cipher employs a key-dependent, dynamically changing permutation 𝐷 . This uncertainty prevents the attacker from identifying the exact permutation applied during encryption. Without knowing 𝐷 , they are unable to accurately compute the critical bits of 𝐵 , making it impossible to verify whether the guessed subkey bits for 𝐾 — or any other round keys — are valid. In this case, the attacker can only retrieve a limited number of key bits from the subkey 𝐾 , with no feasible way to uncover additional key bits from the remaining round keys. Moreover, as mentioned earlier, developing a differential characteristic for AES_DST proves more challenging than for the standard AES, particularly in Step 2*. The core issue stems from the fact that the internal permutation used in AES_DST varies with the key and is not known to the attacker. This forces the attacker to select active S-boxes at random across rounds, reducing the likelihood that those S-boxes are meaningfully connected. As a result, constructing a coherent 𝑛 − 1-round differential characteristic and a complete differential trail becomes nearly impossible in the context of AES_DST. To apply traditional differential cryptanalysis to the AES_DST cipher, an attacker must first identify the specific permutation 𝐷 employed within the cipher. Without this information, the attack cannot effectively proceed. By introducing dynamic, key-dependent transformations in the diffusion stage— specifically through the ShiftRow and TranBytes operations—the AES_DST cipher substantially raises the difficulty level for differential attacks. This added complexity marks a significant departure from the more predictable structure of standard, static AES, thereby enhancing resistance against such cryptanalytic techniques. 6. EVALUATION OF THE RANDOMNESS OF AES_DST This section presents a randomness analysis of the AES_DST dynamic block cipher, based on statistical tests recommended by the NIST framework [35]. Our evaluation integrates the randomness testing strategy outlined in NIST SP 800-22 [35] with the structured plaintext generation approach introduced by Sulak [36]. This allows us to investigate how AES_DST behaves under controlled, non-random plaintext conditions across different encryption rounds. Specifically, we construct several deterministic input sets—such as Low Weight (LW), High Weight (HW), 1-bit difference (AV1), and rotated plaintexts (Rot)—as test vectors. We then apply the two-tiered testing strategy from NIST SP 800-22 to assess the pseudorandomness of the resulting ciphertexts. Notably, the evaluation is limited to test cases optimized for short data sequences, by the guidance from [37]. Based on the analysis (Table 6.1 and Table 6.2), it is evident that employing random keys necessitates at least three rounds of encryption in the dynamic block cipher AES_DST to generate output data exhibiting adequate randomness for the HW, AV1, and LW datasets. This implies that for the AES_DST system to maintain essential randomness in its encrypted output, a minimum of three rounds must be executed when random keys are used. Additionally, the findings reveal that the randomness level produced by AES_DST matches that of the conventional AES cipher. Table 6.1. Outcomes of second-level p-value assessments for AES_DST based on statistical tests applied to short data sequences No. of rounds Freq. Test Runs Test Test for longest run of ones Serial Test AppEn. Test CuSum. Test Bit AutoCorr. Test Byte Autocor. Test AV1 Input Data 1 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 2 0.004821 0.000000 0.000000 0.000001 0.000000 0.000001 0.000000 0.023187 3 0.388140 0.690279 0.296774 0.360755 0.113957 0.492432 0.560673 0.009957 4 0.925600 0.526663 0.773360 0.996072 0.965937 0.265690 0.917013 0.909591 5 0.969725 0.359059 0.562529 0.691677 0.590030 0.337997 0.255215 0.770595 6 0.001659 0.357359 0.867525 0.277019 0.118567 0.250200 0.739263 0.051301 90 N.V. LONG, T.T. LUONG, N.B. CUONG, T.M. PHUONG Copyright ©2025 ASSA Adv. in Systems Science and Appl. (2025) No. of rounds Freq. Test Runs Test Test for longest run of ones Serial Test AppEn. Test CuSum. Test Bit AutoCorr. Test Byte Autocor. Test 7 0.715970 0.965837 0.099518 0.856579 0.752517 0.815556 0.335218 0.858150 8 0.915977 0.620556 0.255037 0.102592 0.255590 0.781520 0.087702 0.853995 9 0.677561 0.058897 0.926591 0.799319 0.733049 0.206479 0.023996 0.299263 10 0.190943 0.907337 0.907299 0.506631 0.375749 0.641292 0.409264 0.060240 HW Input Data 1 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 2 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 3 0.672962 0.790742 0.956944 0.507715 0.767315 0.557299 0.063931 0.932396 4 0.971935 0.713995 0.569726 0.130933 0.555359 0.712793 0.715195 0.717960 5 0.550656 0.016966 0.930257 0.000669 0.000229 0.193905 0.009111 0.157356 6 0.712010 0.125157 0.269899 0.169880 0.103291 0.611226 0.226911 0.551235 7 0.738873 0.075857 0.790729 0.239091 0.108675 0.953965 0.978852 0.955501 8 0.785150 0.693697 0.305570 0.595033 0.762953 0.777388 0.288855 0.572716 9 0.597013 0.525833 0.287850 0.365215 0.378768 0.837909 0.252725 0.007599 10 0.162613 0.932569 0.722379 0.636367 0.716321 0.316012 0.670659 0.005735 LW Input Data 1 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 2 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 0.000000 3 0.815197 0.936996 0.896293 0.907959 0.950627 0.915199 0.591385 0.256157 4 0.059672 0.760510 0.263700 0.597756 0.657905 0.999708 0.352198 0.628523 5 0.721655 0.928550 0.502976 0.997965 0.995961 0.530596 0.275560 0.769510 6 0.360959 0.275531 0.770137 0.099165 0.095005 0.999728 0.389153 0.370810 7 0.821301 0.850561 0.223176 0.729395 0.728277 0.529035 0.703023 0.110923 8 0.906001 0.922559 0.926138 0.963057 0.931601 0.875985 0.571562 0.035327 9 0.959171 0.162170 0.737297 0.155859 0.356525 0.599980 0.323053 0.565623 10 0.060375 0.297092 0.636063 0.621519 0.537975 0.505325 0.657715 0.266918 Rot Input Data 1 0.357559 0.526258 0.200096 0.750682 0.925820 0.029858 0.526090 0.565327 2 0.595618 0.667512 0.615079 0.635559 0.350689 0.535297 0.951519 0.115702 3 0.779571 0.528596 0.569855 0.506580 0.112316 0.089115 0.093269 0.369525 4 0.690950 0.144490 0.229079 0.297999 0.236025 0.194579 0.215946 0.203690 5 0.199359 0.901740 0.279104 0.979264 0.975541 0.951572 0.769115 0.743401 6 0.355609 0.419073 0.377150 0.647660 0.523603 0.963475 0.929479 0.315552 7 0.057450 0.965519 0.491526 0.749116 0.957566 0.229471 0.961226 0.410902 9 0.298895 0.059195 0.771945 0.507281 0.758229 0.148971 0.509822 0.511561 9 0.751565 0.815415 0.560448 0.877156 0.869469 0.405955 0.789552 0.552502 10 0.207595 0.158116 0.659577 0.752650 0.480489 0.850594 0.124907 0.122742 Table 6.2. Outcomes of proportion tests for AES_DST conducted on short sequence datasets No. of Rouns Freq. Test Runs Test Test for longest run of ones Serial Test AppEn. Test CuSum. Test Bit AutoCorr. Test Byte Autocor. Test AV1 Input Data 1 98.98 98.92 99.08 98.99 98.95 99.09 99.29 99.16 2 99.92 99.95 99.07 98.95 98.91 98.98 99.24 99.22 3 99.00 99.96 99.09 99.04 99.95 99.09 99.25 99.22 4 99.99 99.96 99.08 99.01 98.95 99.08 99.25 99.21 5 99.00 98.95 99.09 99.01 98.94 99.08 99.26 99.24 6 99.99 99.94 99.09 99.01 98.94 99.06 99.24 99.21 7 98.98 98.97 99.07 99.01 98.95 99.06 99.25 99.21 8 98.98 99.95 99.08 99.01 98.94 99.06 99.25 99.22 9 98.99 98.95 99.09 99.04 98.95 99.07 99.25 99.22 10 98.99 98.95 99.08 99.00 98.94 99.07 99.25 99.21 HW Input Data 1 98.74 98.96 99.24 98.65 99.67 98.82 99.01 99.44 2 98.91 99.11 99.29 99.01 99.05 99.04 99.41 99.20 3 98.99 99.94 99.06 99.00 99.94 99.07 99.24 99.22 4 98.98 98.95 99.10 99.02 98.94 99.06 99.25 99.20 5 99.00 98.94 99.10 99.01 98.95 99.08 99.26 99.21 6 98.96 98.95 99.09 98.99 98.91 99.05 99.22 99.21 7 98.99 98.94 99.10 99.02 98.94 99.06 99.25 99.21 8 99.00 98.95 99.09 99.04 98.96 99.06 99.25 99.21 9 99.00 98.96 99.08 99.02 98.95 99.06 99.26 99.21 10 99.00 98.95 99.09 99.02 98.95 99.06 99.25 99.21 LW Input Data 1 99.14 99.16 99.40 99.12 99.04 99.15 99.46 99.46 2 99.14 99.04 99.18 99.11 99.12 99.06 99.25 99.25 3 99.01 98.94 99.09 99.02 98.95 99.09 99.25 99.21 4 99.00 98.94 99.08 99.01 98.94 99.08 99.24 99.22 5 98.99 98.96 99.08 99.02 98.94 99.06 99.25 99.20 6 99.00 98.96 99.08 99.05 98.96 99.06 99.26 99.22 A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 91 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) 7 98.99 98.95 99.08 99.01 98.94 99.06 99.25 99.22 8 98.99 98.96 99.09 99.04 98.95 99.08 99.26 99.20 9 98.99 98.95 99.08 99.01 98.94 99.07 99.25 99.20 10 98.99 98.95 99.07 99.04 98.95 99.07 99.25 99.22 Rot Input Data 1 98.98 98.95 99.08 99.02 98.94 99.07 99.25 99.21 2 98.99 98.95 99.09 99.02 98.94 99.07 99.25 99.21 3 98.97 98.97 99.09 99.02 98.94 99.06 99.26 99.20 4 98.99 98.96 99.10 99.01 98.94 99.07 99.25 99.22 5 99.00 98.96 99.09 99.04 98.96 99.08 99.26 99.24 6 98.98 98.94 99.09 99.02 98.94 99.06 99.24 99.22 7 98.99 98.95 99.07 99.01 98.94 99.07 99.24 99.21 8 98.99 98.95 99.08 99.01 98.94 99.06 99.25 99.21 9 99.00 98.94 99.09 99.02 98.94 99.06 99.24 99.24 10 98.99 98.94 99.07 99.02 98.94 99.06 99.25 99.24 7. ANALYSIS OF THE IMPLEMENTATION EFFICIENCY OF THE DYNAMIC BLOCK CIPHER AES_DST ON A SOFTWARE PLATFORM Unlike previously published versions of dynamic AES block ciphers, our dynamic AES block cipher maintains implementation efficiency on 32-bit software platforms. Before analyzing the approach to handling the dynamic byte permutation layer, we briefly review the lookup table implementation technique of the original AES [2]. Let 𝑒 denote the data state after the MixColumns transformation, 𝑎 be the input data state to the SubBytes transformation, 𝑏 be the input data state to the ShiftRows transformation, and 𝑐 be the input data state to the MixColumns transformation. Then, we have: 𝑒 , 𝑒 , 𝑒 , 𝑒 , = 2 3 1 2 1 1 3 1 1 1 3 1 2 3 1 2 ⊗ 𝑐 , 𝑐 , 𝑐 , 𝑐 , , with 𝑐 , 𝑐 , 𝑐 , 𝑐 , = ⎣ ⎢ ⎢ ⎢ ⎡ 𝑏 , 𝑏 , 𝑏 , 𝑏 , ⎦ ⎥ ⎥ ⎥ ⎤ = ⎣ ⎢ ⎢ ⎢ ⎡ 𝑆 𝑎 , 𝑆 𝑎 , 𝑆 𝑎 , 𝑆 𝑎 , ⎦ ⎥ ⎥ ⎥ ⎤ , (5) where 𝑆 is the S-box of the original AES, the operation " − " is defined modulo 4, and 𝑗 = 0,1,2,3. Thus, we have 𝑒 , 𝑒 , 𝑒 , 𝑒 , = 𝑆 𝑎 , ⊗ 2 1 1 3 ⊕ 𝑆 𝑎 , ⊗ 3 2 1 1 ⊕ 𝑆 𝑎 , ⊗ 1 3 2 1 ⊕ 𝑆 𝑎 , ⊗ 1 1 3 2 (6) Then, if we compute the following four tables: 𝑇 [𝑎] = 𝑆[𝑎] ⊗ 2 𝑆[𝑎] 𝑆[𝑎] 𝑆[𝑎] ⊗ 3 , 𝑇 [𝑎] = 𝑆[𝑎] ⊗ 3 𝑆[𝑎] ⊗ 2 𝑆[𝑎] 𝑆[𝑎] , 𝑇 [𝑎] = 𝑆[𝑎] 𝑆[𝑎] ⊗ 3 𝑆[𝑎] ⊗ 2 𝑆[𝑎] , 𝑇 [𝑎] = 𝑆[𝑎] 𝑆[𝑎] 𝑆[𝑎] ⊗ 3 𝑆[𝑎] ⊗ 2 , where 𝑎 ∈ 𝔽 , and the operation " ⊗ " represents multiplication in 𝔽 . Each table consists of 256 entries, each of which is 32 bits long. Thus, the 𝑗-th column of the state 𝑒 is calculated as follows: 𝑒 = 𝑇 𝑎 , ⊕ 𝑇 𝑎 , ⊕ 𝑇 𝑎 , ⊕ 𝑇 𝑎 , (7) 92 N.V. LONG, T.T. LUONG, N.B. CUONG, T.M. PHUONG Copyright ©2025 ASSA Adv. in Systems Science and Appl. (2025) Now, if we replace ShiftRows with TranBytes, then equation (5) becomes: 𝑐 , 𝑐 , 𝑐 , 𝑐 , = ⎣ ⎢ ⎢ ⎢ ⎡ 𝑏 , 𝑏 , 𝑏 , 𝑏 , ⎦ ⎥ ⎥ ⎥ ⎤ = ⎣ ⎢ ⎢ ⎢ ⎡ 𝑆 𝑎 , 𝑆 𝑎 , 𝑆 𝑎 , 𝑆 𝑎 , ⎦ ⎥ ⎥ ⎥ ⎤ , (8) Equation (6) becomes: 𝑒 , 𝑒 , 𝑒 , 𝑒 , = 𝑆 𝑎 , ⊗ 2 1 1 3 ⊕ 𝑆 𝑎 , ⊗ 3 2 1 1 ⊕ 𝑆 𝑎 , ⊗ 1 3 2 1 ⊕ 𝑆 𝑎 , ⊗ 1 1 3 2 , (9) And equation (7) becomes: 𝑒 = 𝑇 𝑎 , ⊕ 𝑇 𝑎 , ⊕ 𝑇 𝑎 , ⊕ 𝑇 𝑎 , (10) From (7) and (10), we see that it is sufficient to use only 4 tables 𝑇 , 𝑗 = 0,1,2,3 to compute the output after the MixColumns transformation. To eliminate the “if-else” branching in the encryption procedure described in the dynamic AES_DST block cipher algorithm in section 4.1, we calculate the 𝑗-th column in state 𝑒 at round 𝑟 based on the dynamic key bit 𝑘𝑑 as follows: 𝑒 = 𝑇 𝑘𝑑 ⋅ 𝑎 , ⊕ 𝑘𝑑 ⋅ 𝑎 , ⊕ 𝑇 𝑘𝑑 ⋅ 𝑎 , ⊕ 𝑘𝑑 ⋅ 𝑎 , ⊕ 𝑇 𝑘𝑑 ⋅ 𝑎 , ⊕ 𝑘𝑑 ⋅ 𝑎 , ⊕ 𝑇 𝑘𝑑 ⋅ 𝑎 , ⊕ 𝑘𝑑 ⋅ 𝑎 , , (11) where the symbol " ⋅ " denotes multiplication in the decimal system, and 𝑘𝑑 represents the negation of the bit 𝑘𝑑 . In this way, we have eliminated branching in the encryption procedure. Moreover, the implementation using precomputed lookup tables can be fully applied to our proposed dynamic AES_DST block cipher. The only difference lies in how the addresses are obtained to access the tables 𝑇 , 𝑗 = 0,1,2,3. To evaluate the execution speed, we implemented the proposed dynamic AES_DST block cipher in C++ using the precomputed lookup table method. Below are some statistical results on execution performance along with comparisons to other commonly used block ciphers (compiled and run on the same platform). All tests were conducted on a single-core machine equipped with an Intel® Core™ i5-7200U CPU @ 2.50GHz (2.471GHz effective), 12GB RAM, running Windows 10 64-bit, using Visual Studio 2019 compiler in Release mode (x64). The block cipher implementations did not use any assembly instructions and operated in ECB mode. The performance evaluation and speed comparison results are presented in Table 7.1. Table 7.1. Performance evaluation and comparison of the dynamic AES_DST block cipher execution speed No. Block Cipher Block/Key Size Number of Rounds Lookup Table Size (Encryption + Decryption) KBytes Encryption/ Decryption Speed (Mb/s) Implementation Source 1 Kalyna 128/128 10 128 1598 Oliynykov† 128/256 14 128 1186 2 Kuznyechik 128/256 10 128 640 3 AES 128/128 10 8 1696 Gladman‡ (on a 32-bit platform) 128/192 12 8 1510 128/256 14 8 1302 4 AES_DST 128/128 10 8 1402 Ours 128/192 12 8 1210 † https://github.com/Roman-Oliynykov/ciphers-speed ‡ http://brg.a2hosted.com//oldsite/cryptography_technology/rijndael/index.php A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 93 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) 128/256 14 8 1087 From Table 7.1, it can be observed that with our dynamic approach, the encryption speed of the AES_DST dynamic block cipher decreases only slightly compared to the original AES version (about a 20% reduction). Compared to several other block ciphers, the dynamic AES version still maintains a comparable encryption speed. This means that the dynamic AES version we propose can meet the demands of building high-speed cryptographic applications while also enhancing security compared to the original AES block cipher. 8. CONCLUSION The paper provides a different perspective on the security of byte-oriented AES-style block ciphers. To do this, we propose a general SPN cipher model. Then, we prove using number theory the minimal number of active S-boxes after 4 rounds of encryption in this cipher. Our method is generalized and can be applied to evaluate AES-like ciphers such as Kalyna, LED, Kuznyechik, and block ciphers used in hash functions like GOST R 34.11-2012, Whirlpool, and others. From this analysis, we observe that the role of the byte permutation layer—such as ShiftRows in AES—is especially critical. This layer must ensure the 𝑚-diffusion property to preserve the block cipher’s design based on the wide trail strategy. Based on these findings, we introduce a key-dependent dynamic variant of the AES block cipher (AES_DST). Unlike earlier methods, our approach leverages table lookup implementations without the need for pre-calculated lookup tables. Practical tests demonstrate that the dynamic AES cipher’s performance is comparable to well-established block ciphers globally. This dynamic version offers enhanced security over the standard AES while maintaining efficient software implementation. The insights gained here are valuable for the development of secure and adaptable block ciphers, as well as for providing a theoretical basis to assess cryptographic components in current encryption systems. Moving forward, we plan to analyze the dynamic AES cipher’s resilience against different types of attacks and estimate its quantum security, particularly considering attacks using Grover’s algorithm. ACKNOWLEDGEMENTS Funding: No funding was received for conducting this study. Financial interests: We declare that we have no financial interests. Data availability: Data sharing does not apply to this article as no datasets were used, generated, or analyzed during this study Declarations Competing interests : We declare that we have no competing interests. REFERENCES [1] Shannon, C.E. (1949) Communication theory of secrecy systems, The Bell System Technical Journal, 28(4), 656–715. [2] Daemen, J., Rijmen, V. (2002) The design of Rijndael, Vol. 2. New York, NY: Springer- Verlag. [3] Guo, J., Peyrin, T., Poschmann, A. & Robshaw, M. (2011) The LED block cipher, Proc. of 13th International Workshop (Nara, Japan), pp. 326–341. [4] Oliynykov, R., Gorbenko, I., Kazymyrov, O., Ruzhentsev, V., Kuznetsov, O., (2015) A new encryption standard of Ukraine: The Kalyna block cipher, Cryptology ePrint Archive, [Online]. Available: https://eprint.iacr.org/2015/650 [5] Dolmatov, V. (2016) GOST R 34.12-2015: Block Cipher "Kuznyechik", [Online]. Available: https://www.rfc-editor.org/rfc/rfc7801 94 N.V. LONG, T.T. LUONG, N.B. CUONG, T.M. PHUONG Copyright ©2025 ASSA Adv. in Systems Science and Appl. (2025) [6] Phuong, T.M. & Luong, T.T. (2023) Evaluating the number of active S-boxes in dynamic AES block ciphers using MDS matrices of size 4×4 and 8×8, TNU Journal of Science and Technology, 228(15), 190–199, doi: 10.34238/tnu-jst.9053 [7] Knudsen, L.R. (2014) Dynamic encryption, Journal of Cyber Security and Mobility, 3, 357–370. [8] Rijmen, V. (2017) Opinion on dynamic encryption, [Online]. Available: https://www.dencrypt.dk/wp-content/uploads/2017/05/Dencrypt-Vincent-Rijmen-opinion- on-Dynamic-Encryption.pdf (2017) [9] Al-Dweik, A.Y., Hussain, I., Saleh, M. & Mustafa, M.T. (2022) A novel method to generate key-dependent S-boxes with identical algebraic properties, Journal of Information Security and Applications, 64, 103065. [10] Kazlauskas, K. & Kazlauskas, J. (2009) Key-dependent S-box generation in AES block cipher system, Informatica, 20(1), 23–34. [11] Agarwal, P., Singh, A. & Kilicman, A. (2018). Development of key-dependent dynamic S-boxes with dynamic irreducible polynomial and affine constant, Advances in Mechanical Engineering, 10(7), doi: 10.1177/1687814018781638. [12] Abdulrazaq, N.N. (2024). Generating of a dynamic and secure S-box for AES block cipher system based on modified hexadecimal Playfair cipher, Zanco Journal of Pure and Applied Sciences, 36(5), 82–94. [13] Mahmoud, E.M., Hafez, A.A., Elgarf, T.A. & Zekry, A.H. (2013) Dynamic AES-128 with key-dependent S-box, International Journal of Engineering Research and Applications, 3(1), 1662–1670. [14] Assafli, H.T. & Hashim, I.A. (2020) Generation and evaluation of a new time-dependent dynamic S-box algorithm for AES block cipher cryptosystems, IOP Conference Series: Materials Science and Engineering, 978(1), 012042. [15] Murtaza, G., Khan, A.A., Alam, S.W. & Farooqi, A. (2011) Fortification of AES with dynamic mix-column transformation, Cryptology ePrint Archive [Online]. Available: https://eprint.iacr.org/2011/184 [16] Luong, T.T. (2022) Building the dynamic diffusion layer for SPN block ciphers based on direct exponent and scalar multiplication, Journal of Science and Technology on Information Security, 1(15), 38–45. [17] Luong, T.T. (2023) A dynamic algorithm for the linear layer of SPN block ciphers based on self-reciprocal recursive MDS matrices, Proc. of 2023 15th International Conference on Knowledge and Systems Engineering (Hanoi, Vietnam), pp. 1–6. [18] Shamsabad, M.R.M. & Dehnavi, S.M. (2020) Dynamic MDS diffusion layers with efficient software implementation, International Journal of Applied Cryptography, 4(1), 36–44 [19] Xu, T., Liu, F. & Wu, C. (2018) A white-box AES-like implementation based on key-dependent substitution-linear transformations, Multimedia Tools and Applications, 77, 18117–18137. [20] Altigani, A., Hasan, S., Barry, B., Naserelden, S., Elsadig, M.A., et al. (2021). A polymorphic advanced encryption standard–a novel approach, IEEE Access, 9, 20191–20207. [21] Freyre, P., Cuellar, O., Díaz, N. & Alfonso, A. (2020) From AES to dynamic AES, Journal of Science and Technology on Information Security, 1(11), 11–22. [22] Manoj Kumar, T. & Karthigaikumar, P. (2020) A novel method of improvement in advanced encryption standard algorithm with dynamic shift rows, sub byte and mixcolumn A WORD-ORIENTED SUBSTITUTION–PERMUTATION NETWORK CIPHER 95 Copyright ©2025 ASSA. Adv. in Systems Science and Appl. (2025) operations for the secure communication, International Journal of Information Technology, 12(3), 825–830. [23] Salih, A.I., Alabaichi, A. & Abbas, A.S. (2019) A novel approach for enhancing security of advance encryption standard using private XOR table and 3D chaotic regarding to software quality factor, An International Journal of Research and Surveys, 10(9), 823–832. [24] Salih, A.I., Alabaichi, A.M. & Tuama, A.Y. (2020) Enhancing advance encryption standard security based on dual dynamic XOR table and mixcolumns transformation, Indonesian Journal of Electrical Engineering and Computer Science, 19(3), 1574–1581. [25] Luong, T.T. (2023) Strengthening AES security through key-dependent ShiftRow and AddRoundKey transformations utilizing permutation, International Journal of Advanced Computer Science & Applications, 14(11). [26] Luong, T.T., Cuong, N.N. & Vo, B. (2024) AES security improvement by utilizing new key-dependent XOR tables, IEEE Access, PP(99), 1–1. [27] Luong, T.T. (2025) Improving block cipher resilience with dynamically generated XOR matrices using the Fisher-Yates shuffle method, Cryptogr. Commun., 17(4), 1051–1074, doi: 10.1007/s12095-025-00802-w [28] Adamu, M., Oyefolahan, O. I., Ojerinde, O. A. & Abdulmalik, M. D. (2024). Dynamic randomized advanced encryption standard (DR-AES): a solution to enhance the security of mobile learning system, ATBU Journal of Science, Technology and Education, 12(2), 191–202. [29] Kang, J.S., Hong, S., Lee, S., Yi, O., Park, C., et al. (2001) Practical and provable security against differential and linear cryptanalysis for substitution-permutation networks, ETRI Journal, 23(4), 158–167. [30] Lai, X., Massey, J.L. & Murphy, S. (1991) Markov ciphers and differential cryptanalysis, Proc. of the Workshop on the Theory and Application of Cryptographic Techniques (Brighton, UK), pp. 17–38. [31] Dobraunig, C., Rotella, Y. & Schoone, J. (2020) Algebraic and higher-order differential cryptanalysis of Pyjamask-96, IACR Transactions on Symmetric Cryptology, 2020(1), 289–312. [32] Keliher, L. T. (2003) Linear cryptanalysis of substitution-permutation networks. PhD thesis, Queen's University. [33] Matsui, M. (1993) Linear cryptanalysis method for DES cipher, Proc. of Workshop on the Theory and Application of Cryptographic Techniques (Lofthus, Norway), pp. 386–397. [34] Jakobsen, T. & Knudsen, L. R. (2001) Attacks on block ciphers of low algebraic degree, Journal of Cryptology, 14, 197–210. [35] Bassham, L. E., Rukhin, A. L., Soto, J., Nechvatal, J. R., Smid, M. E., et al. (2010) A statistical test suite for random and pseudorandom number generators for cryptographic applications, NIST Special Publication No. 800-22. [36] Sulak, F. (2011). Statistical analysis of block ciphers and hash functions. PhD thesis, Middle East Technical University. [37] Sulak, F., Doğanaksoy, A., Ege, B. & Koçak, O. (2010). Evaluation of randomness test results for short sequences, Proc. of Sequences and Their Applications–SETA 2010: 6th International Conference (Paris, France), pp. 309–319.