The title is asking the question in layman terms, but what I really mean to ask is this:

Let $x \in \lbrace 0,1 \rbrace^{128}$ (an arbitrary input block) and let $K \in \lbrace 0, 1 \rbrace^{128}$ (an arbitrary key for 128-bit AES). Let's mark AES decryption with $AES_K^{-1}$. My questions are:

  1. Is $AES^{-1}_K$ defined for (arbitrary) input $x$? (i.e. Is AES onto $\lbrace 0, 1 \rbrace ^{128}$ for any key?)
  2. If so, is $AES_K( AES^{-1}_K (x) ) = x$ ?

Are those questions trivial or do they require proof?


1 Answer 1


AES-128 uses the full set $\{0, 1\}^{128}$ as keyspace, and for each key the blockcipher is defined for each input block in $\{0, 1\}^{128}$. The same goes for AES-256, but it uses a 256-bit keyspace (but still a 128-bit block).

So the answer to 1 is yes.

For 2, we have this equation:

$$AES_K(AES_K^{-1}(x)) = x$$

We can decrypt both sides:

$$AES_K^{-1}(AES_K(AES_K^{-1}(x))) = AES_K^{-1}(x)$$

Because we know that $AES_K^{-1}(AES_K(a)) = a\:$ by the definition of the inverse we can cancel out an encryption/decryption cycle on the left hand side:

$$AES_K^{-1}(x) = AES_K^{-1}(x)$$

So it's true.

  • $\begingroup$ Question 2 might seem trivial so what I really mean to ask is about AES decryption, not about the inverse function notation. But of course, if part 1 is true, part 2 naturally follows (from purely 'inverse of function' considerations). About question 1, you're talking about AES being a function over $\lbrace 0,1 \rbrace^{128}$, while I'm asking whether it's onto $\lbrace 0,1 \rbrace^{128}$... But now that I think about it, it follows from AES being reversible. $\endgroup$
    – Ilya
    Dec 1, 2013 at 16:53
  • 1
    $\begingroup$ @Ilya Any blockcipher is a fixed-size permutation. AES-128, AES-192 and AES-256 are all permutations with a 128-bit block size. $\endgroup$
    – orlp
    Dec 1, 2013 at 17:06
  • 2
    $\begingroup$ Any symmetric block cipher where plaintext and ciphertext are of the same size is defined over the full range. Otherwise, it could not be bijective (needed for inversion) could only handle a part of the domain. $\endgroup$
    – tylo
    Dec 2, 2013 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.