Static site. Every demo computes in your browser, and nothing you type is sent anywhere.
50%
Add the key, substitute, permute, and follow one S-box across the block.
Each round adds the round key, substitutes every nibble, then permutes the bits. Step through one operation at a time and watch where the bits of one S-box end up.
follow the bits of one S-box
Start: plaintext
state before
1
0
0
1
1
0
1
0
0
1
1
1
1
1
0
0
9A7C
state after
1
0
0
1
1
0
1
0
0
1
1
1
1
1
0
0
9A7C
The block as it arrives. Nothing has touched it yet.
Every step so far
Every operation applied so far, with the state after it in binary and hexadecimal, and the subkey where one was added.
Step
Round
Operation
State
Hex
Subkey
0
Plaintext
1001 1010 0111 1100
9A7C
Where the round keys come from
the cipher key this page encrypts with
0
0
1
1
1
1
1
1
0
1
0
1
1
0
1
1
3F5B
the round keys the schedule produces from it
The key schedule: the round key used at each key addition.
Used at
Round key
Hex
Round 1
0011 1111 0101 1011
3F5B
Round 2
1110 1011 0110 0111
EB67
Round 3
0110 1100 1111 1101
6CFD
Round 4
1001 1111 1010 1101
9FAD
Final key addition
1111 0101 1011 0011
F5B3
The sample schedule keeps the 16-bit key in a register and rotates it left by five bits between rounds, so the whole register is the round key. There is one more key than there are rounds, because the network closes with a key addition. Real schedules are harder to invert, and AES is where that starts.
S-box, for checking a substitution
Heys' S-box: the output nibble for each input nibble.
In
Out
0
E
1
4
2
D
3
1
4
2
5
F
6
B
7
8
8
3
9
A
A
6
B
C
C
5
D
9
E
0
F
7
Each nibble of the state is looked up here, left to right.
P-layer, for checking a permutation
The bit permutation: the destination position of each source bit, counted from the most significant bit.
From
To
0
0
1
4
2
8
3
12
4
1
5
5
6
9
7
13
8
2
9
6
10
10
11
14
12
3
13
7
14
11
15
15
The four marked rows are the bits of the S-box you picked. The P-layer does not create more differences, it moves them. Bit positions are counted from the left of the block.
Two details of the last round are worth naming, because both look like omissions and neither is.
Round 4, the last one
The steps of the last round and the closing key addition.
Step
State
Hex
round 4 add key
1100 0001 0011 1101
C13D
round 4 substitute
0101 0100 0001 1001
5419
ciphertext
1010 0001 1010 1010
A1AA
The final round omits the P-layer, because there is no later S-box layer to spread into: a final fixed permutation would only rearrange the output bits. A final key XOR then prevents the last S-box output from appearing directly as ciphertext.
Round trip
The plaintext, the ciphertext, and what the inverse network returned.
Value
Binary
Hex
Plaintext
1001 1010 0111 1100
9A7C
Ciphertext
1010 0001 1010 1010
A1AA
Recovered
1001 1010 0111 1100
9A7C
Every layer is reversible, so decryption is the inverse layers with the keys reversed. That is the cost of processing the whole block each round.
In a Feistel network F need not be reversible, because reversibility comes from the swap and the XOR. In an SPN every layer must be reversible, because decryption really does run each layer backwards. That single difference separates the two structures.