2
$\begingroup$

I am looking for AES-128 keys such that the last round key is exactly the first round key (which is simply the key). Any pointer to a proof that they exist or that they don't would be welcome.

In the same line, I am looking for last round keys which are the bitwise inverse of the key or some similarly simple relation with the key.

Improve this question
$\endgroup$
7
  • 3
    $\begingroup$ The relation between the first subkey and the last subkey is highly nonlinear (because of the sbox lookups done as a part of the operation). It would be surprising if anyone could prove anything either way. $\endgroup$
    – poncho
    Commented Dec 15, 2015 at 15:13
  • $\begingroup$ It is understood that for the best part of the key space such relation does not exist. The question is on the existence of keys with those properties, and any idea on their numbers would be welcome too. $\endgroup$
    – acapola
    Commented Dec 15, 2015 at 15:29
  • $\begingroup$ I would assume that in AES-256 this is possible because of the way the round keys are generated, but in AES-128 it is not likely $\endgroup$
    – Richie Frame
    Commented Dec 15, 2015 at 18:07
  • $\begingroup$ What is the motivation here? Finding a weak key? $\endgroup$
    – Thomas M. DuBuisson
    Commented Dec 16, 2015 at 19:23
  • 1
    $\begingroup$ @RichieFrame: actually, if we model the first-to-last-round-key transform as a random permutation, then the probability of there being some AES-128 key having the first and last round keys the same is about $1 - 1/e \approx 0.63212$ $\endgroup$
    – poncho
    Commented Dec 17, 2015 at 13:39

1 Answer 1

Reset to default
2
$\begingroup$

Not an answer but larger than a comment.

You can ask automated solvers to provide you with keys where the first and last rounds keys match. Existing solvers likely won't terminate quickly on AES-128 for reasons mentioned in the question and comments.

AES-256, on the other hand, does yield results. For example the keys:

  • 0x623cacba4d7fc6b7914b6bd000a2bcccf0967f268cbafde97ffc5bae4be5d2,
  • 0xfea74943353b4d96d69457a2e6fbe56b1029ca48dc179d1967200df51cee7 and
  • 0xf4e810b7b1c9253e75683304ac4f03f90be6534757600685706d8f6a97bee

all retain the property that expandedKey[0] == expandedKey[nrRounds].

Improve this answer
$\endgroup$
2
  • $\begingroup$ interesting, "automated solver"="SAT solver" ? I am not familiar with that stuff, could you indicate which tool to use to reproduce your finding on AES256 ? $\endgroup$
    – acapola
    Commented Dec 18, 2015 at 15:20
  • 1
    $\begingroup$ Yes, I'm taking about SAT solvers. I used cryptol to compute the above values. $\endgroup$
    – Thomas M. DuBuisson
    Commented Dec 18, 2015 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.