Abstract
<jats:p>This paper introduces Hill-Enigma-SPN (HESPN), a 128-bit byte-oriented substitution–permutation network (SPN) research construction that revisits the classical Hill cipher’s linearity through rotor-scheduled GF(2) byte-matrix diffusion inspired by the Enigma machine, combined with AES S-box substitution, a round-dependent inter-byte permutation, and an Argon2id profile for password-based key derivation. HESPN is not proposed as a deployment-ready alternative to standardized ciphers; its contribution is architectural. The design trades weaker per-round intra-byte diffusion a branch-number floor of B ≥ 4 over GF(2), guaranteed by the key-setup admissibility filter, for higher structural variability, with 64 scheduled key-dependent (seed, orientation) matrix pairs across 16 rounds. Across four experimental runs, HESPN exhibits behavior consistent with a well-diffused SPN on the evaluated metrics: avalanche, sampled-differential, random-mask-uniformity, and algebraic-degree screens reach their observable ideals by 16 rounds, and counter-mode keystream shows no systematic failure of the implemented seven-test NIST SP 800-22 subset in an extended 300-sequence run. A structured-input correlation identified at 12 rounds motivated the final 16-round specification. These bounded empirical screens do not establish resistance to trail-optimized cryptanalysis; in particular, low-weight iterative differential trails remain an open threat (Section 3.6.1).</jats:p>