Equivalence of Product Ciphers to Substitution Ciphers and their Security Implications

Product/Compound ciphers composed of multi-byte permutations and substitutions are generally considered to be more secure than their standalone individual component-cipher counterparts (i.e., substitution (S) and permutation (P) ciphers). In this paper, we show that a permutation-substitution-permutation (PSP) cipher that uses any form of regular byte-block boundaries, along with a regular encoding (such as ASCII), is no more secure than a multi-byte S cipher. In addition, we also show that, under certain conditions, a PSP cipher can be reduced to an S cipher. In addition to introducing the concept of isomorphic cipher reduction, we show that our theoretical findings translate into practical means by using a plaintext attack. In doing so, we shed light on the problems of encryption security that arise due to employing a product cipher in conjunction with any form of regular byte-block boundaries, and propose appropriate countermeasures.