Does AES have any fixed-points?

Question

Is there any pair of 128-bit strings M and K such that AES$_K$(M) = M?

If yes, how do I go about (efficiently) finding such a pair?

Answer 1

Short version: It is quite likely that a large proportion of the keys have fixed points, but I don't have any idea on how to find them.

Long version: A stochastic argument

There are $2^{128}!$ permuations of 128-bit blocks, and of these, $!2^{128}$ (this is the subfactorial) are fixpoint-free. It is known that $\lim_{N\to\infty}\frac{!N}{N!} = \frac 1e \approx 0.3679$ (and this limit is approached quite quickly), i.e. slightly more than one third of all permutations are fixpoint-free.

AES-128 selects $2^{128}$ from these $2^{128}!$ permutations. Assuming this selection behaves like a random one, about 63% of all keys have at least one fixed point.

(This argument is valid for any block cipher with sufficiently large blocks, nothing AES-specific here.)

But ...

Of course, AES (and any block cipher usable in practice) is not a random selection of permutations – for example, all permutations selected by AES are even (AES is composed of operations which each leave some bits unchanged, these are even, and compositions of even permutations are even), thus the available space is halved.

There might be some similar property which makes fixpoint-less permutations less or more likely than a random selection, or even make every key (or no key) have fixed points (both the number of fixed-point-free and non-fixed-point-free permutations are much much larger than the number of available AES keys). I don't know anything here (and as Thomas points out, knowing more might indicate a weakness in AES).

Also, this heuristic gives no way of finding these fixed points (other than brute force).

Answer 2

To my knowledge, no such fixed point is known, but it would be considered highly improbable that there is none (as @Paŭlo points out). We can say that the absence of a fixed point would be viewed as suggestive of a weakness: AES is supposed to "look like" a random permutation.

On the other hand, even being able to prove (non constructively) the presence of a fixed point would already be considered as suspicious: such a proof cannot exist on a really random permutation, so the proof itself would have to exploit the internal structure of AES. Consequently, we currently cannot prove the existence of a fixed point.

There is no known efficient algorithm for finding a fixed point; the best currently known algorithm is trying random keys and messages until a fixed point is hit, with average computational cost $2^{128}$ evaluation of AES.