Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The title is asking the question in layman terms, but what I really mean to ask is this:

Let $x \in \lbrace 0,1 \rbrace^{128}$ (an arbitrary input block) and let $K \in \lbrace 0, 1 \rbrace^{128}$ (an arbitrary key for 128-bit AES). Let's mark AES decryption with $AES_K^{-1}$. My questions are:

  1. Is $AES^{-1}_K$ defined for (arbitrary) input $x$? (i.e. Is AES onto $\lbrace 0, 1 \rbrace ^{128}$ for any key?)
  2. If so, is $AES_K( AES^{-1}_K (x) ) = x$ ?

Are those questions trivial or do they require proof?

share|improve this question
Related question:… – Ilya Dec 1 '13 at 15:40
up vote 3 down vote accepted

AES-128 uses the full set $\{0, 1\}^{128}$ as keyspace, and for each key the blockcipher is defined for each input block in $\{0, 1\}^{128}$. The same goes for AES-256, but it uses a 256-bit keyspace (but still a 128-bit block).

So the answer to 1 is yes.

For 2, we have this equation:

$$AES_K(AES_K^{-1}(x)) = x$$

We can decrypt both sides:

$$AES_K^{-1}(AES_K(AES_K^{-1}(x))) = AES_K^{-1}(x)$$

Because we know that $AES_K^{-1}(AES_K(a)) = a\:$ by the definition of the inverse we can cancel out an encryption/decryption cycle on the left hand side:

$$AES_K^{-1}(x) = AES_K^{-1}(x)$$

So it's true.

share|improve this answer
Question 2 might seem trivial so what I really mean to ask is about AES decryption, not about the inverse function notation. But of course, if part 1 is true, part 2 naturally follows (from purely 'inverse of function' considerations). About question 1, you're talking about AES being a function over $\lbrace 0,1 \rbrace^{128}$, while I'm asking whether it's onto $\lbrace 0,1 \rbrace^{128}$... But now that I think about it, it follows from AES being reversible. – Ilya Dec 1 '13 at 16:53
@Ilya Any blockcipher is a fixed-size permutation. AES-128, AES-192 and AES-256 are all permutations with a 128-bit block size. – orlp Dec 1 '13 at 17:06
Any symmetric block cipher where plaintext and ciphertext are of the same size is defined over the full range. Otherwise, it could not be bijective (needed for inversion) could only handle a part of the domain. – tylo Dec 2 '13 at 13:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.