1

The title is asking the question in layman terms, but what I really mean to ask is this:

Let $x \in \lbrace 0,1 \rbrace^{128}$ (an arbitrary input block) and let $K \in \lbrace 0, 1 \rbrace^{128}$ (an arbitrary key for 128-bit AES). Let's mark AES decryption with $AES_K^{-1}$. My questions are:

  1. Is $AES^{-1}_K$ defined for (arbitrary) input $x$? (i.e. Is AES onto $\lbrace 0, 1 \rbrace ^{128}$ for any key?)
  2. If so, is $AES_K( AES^{-1}_K (x) ) = x$ ?

Are those questions trivial or do they require proof?

mikeazo
  • 38,563
  • 8
  • 112
  • 180
Ilya
  • 113
  • 6
  • Related question: http://crypto.stackexchange.com/questions/9669/can-aes-decryption-be-used-as-encryption – Ilya Dec 01 '13 at 15:40

1 Answers1

3

AES-128 uses the full set $\{0, 1\}^{128}$ as keyspace, and for each key the blockcipher is defined for each input block in $\{0, 1\}^{128}$. The same goes for AES-256, but it uses a 256-bit keyspace (but still a 128-bit block).

So the answer to 1 is yes.

For 2, we have this equation:

$$AES_K(AES_K^{-1}(x)) = x$$

We can decrypt both sides:

$$AES_K^{-1}(AES_K(AES_K^{-1}(x))) = AES_K^{-1}(x)$$

Because we know that $AES_K^{-1}(AES_K(a)) = a\:$ by the definition of the inverse we can cancel out an encryption/decryption cycle on the left hand side:

$$AES_K^{-1}(x) = AES_K^{-1}(x)$$

So it's true.

orlp
  • 4,230
  • 20
  • 29
  • Question 2 might seem trivial so what I really mean to ask is about AES decryption, not about the inverse function notation. But of course, if part 1 is true, part 2 naturally follows (from purely 'inverse of function' considerations).

    About question 1, you're talking about AES being a function over $\lbrace 0,1 \rbrace^{128}$, while I'm asking whether it's onto $\lbrace 0,1 \rbrace^{128}$... But now that I think about it, it follows from AES being reversible.

     – Ilya Dec 01 '13 at 16:53
  • 1
    @Ilya Any blockcipher is a fixed-size permutation. AES-128, AES-192 and AES-256 are all permutations with a 128-bit block size. – orlp Dec 01 '13 at 17:06
  • 2
    Any symmetric block cipher where plaintext and ciphertext are of the same size is defined over the full range. Otherwise, it could not be bijective (needed for inversion) could only handle a part of the domain. – tylo Dec 02 '13 at 13:22