# Are there any encryption schemes where more than one key give the same encryption and decryption operations? [duplicate]

Given an encryption scheme that takes as input a key $$k$$ and converts it to an encryption operation $$E$$ via the function $$M(k) = E$$, is it possible that more than one $$k$$ can give the same $$E$$?

For example, let $$k$$ and $$k'$$ be two distinct keys. Is it possible that $$M(k) = M(k') = E$$. In this sense, the mapping from the 'key space' to the 'encryption operation space' is surjective.

It doesn't seem like it would be a vulnerability or flaw me given the number of different possible encryption operators given by the scheme is large enough, and that each distinct encryption operator is mapped onto by roughly the same number of keys. For instance, let's say the key space for a given key of length $$n$$ is $$2^n$$, but the corresponding encryption operation space is of size $$2^{\frac{n}{2}}$$. For large values of $$n$$, although a given key would have many 'collisions' (other keys that give the same encryption operator), the protocol could still be secure.

• I remember that we have a dupe for this. Block ciphers are a family of permutations and each permutation is represented with a key. If we model the selection of permutation uniform random then some keys will represent the same permutation. Well, hard to see one in real life and nearly impossible to find one AES... Jun 17 at 18:50
• Just consider that AES has $2^{128}$ permutations from $(2^{128})!$ permutations. If there is a uniform selection, what is the probability of the collision? Jun 17 at 18:58
• Jun 17 at 18:59

DES takes 64 bit keys [1]; of those key bytes, the lsbit of each byte is ignored. That is, $$DES_k$$ and $$DES_{k'}$$ are the same operation if $$k$$ and $$k'$$ differ only in the lsbits.