Editing Substitution–permutation network (section)

== Performance ==
Although a [[Feistel network]] that uses S-boxes (such as [[Data Encryption Standard|DES]]) is quite similar to SP networks, there are some differences that make either this or that more applicable in certain situations. For a given amount of [[confusion and diffusion]], an SP network has more "inherent parallelism"<ref>
[http://www.ddj.com/184410756 "Principles and Performance of Cryptographic Algorithms"] by Bart Preneel, Vincent Rijmen, and Antoon Bosselaers.
</ref> and so — given a CPU with many [[execution unit]]s — can be computed faster than a Feistel network.<ref>[http://www.schneier.com/skein1.1.pdf "The Skein Hash Function Family"] {{Webarchive|url=https://web.archive.org/web/20090115213250/http://www.schneier.com/skein1.1.pdf |date=2009-01-15 }} 2008
by [[Niels Ferguson]], [[Stefan Lucks]], [[Bruce Schneier]], Doug Whiting, [[Mihir Bellare]], Tadayoshi Kohno, [[Jon Callas]], Jesse Walker
page 40.</ref> CPUs with few execution units — such as most [[smart card]]s — cannot take advantage of this inherent parallelism. Also SP ciphers require S-boxes to be invertible (to perform decryption); Feistel inner functions have no such restriction and can be constructed as [[one-way function]]s.