# Loss of data due to encryption

Could any kind of encryption method (AES, etc.) lead to data loss like in lossy compression? I'm interested if data (lossy compressed, lossless compressed, uncompressed) that is encrypted and decrypted will always come back in the same state as before the encryption process, no matter what encryption method is used.

Regards, Neil

A block cipher such as AES is a Pseudo Random Permutation or PRP. The mathematical properties of that does not allow for data loss. It's always possible to mess up the implementation though, for instance by treating the ciphertext as a string instead of binary data (encoding/decoding issues).

A mode of operation is required to perform encryption with a block cipher. These modes of operation should not confer any information about the plaintext (except the size). Therefore they need some kind of randomization or they will create the same ciphertext for identical data. This makes it impossible to distinguish $(E(x), E(x))$ from $(E(x), E(y))$ for $x \ne y$.

Because of this encryption will result in different ciphertext even for the same input. This is usually accomplished by using a unique initialization vector for each encryption. Still, modes of operation will still need to keep to the contract that $p=D_k(E_k(p))$. There may be limitations to the amount of plaintext that can or should be encrypted by a cipher.

Furthermore, integrity of data is not supported by all modes of operation, it is therefore important to use authenticated encryption (for instance by using GCM or by performing HMAC over the ciphertext) if data may be altered by an attacker or by a lower level (transport) layer.

• Forgive me for my lack of knowledge, but I understand that AES encryption uses a block cipher, therefore as long is it implemented correctly there's no possibility of the data loss that I talked about (data that comes in, comes out the same), correct? – user20190 Jan 6 '15 at 23:23
• Another (admittedly pedantic) comment: It is unknown whether AES (or any other practical block cipher) is a PRP in the theoretical sense. We only hope it was one. – yyyyyyy Jan 7 '15 at 0:44
• @yyyyyyy I hope you are OK with just an upvote of the comment. It's a bit too much to go and discuss the security of particular block ciphers in this answer :) – Maarten Bodewes Jan 7 '15 at 1:14
• @yyyyyyy While we are not sure that block ciphers are actually pseudorandom, the "permutation" part is usually uncontested. And this is what matters in the context of this question. – Paŭlo Ebermann Jan 7 '15 at 21:22

Removing some verbosity:

I'm interested if data that is encrypted and decrypted will always come back in the same state as before the encryption process.

Yes, it's actually one of the first things you learn in Crypto 101: if $e$ is the encryption function of a cryptosystem and $d$ is its decryption function, then $d(e(m)) = m$ for all valid messages $m$. Any system which does not satisfy this property cannot really be called a cryptosystem.

There is at least one lossy cryptosystem: The Rabin cryptosystem. When you decrypt a cryptotext, you get four candidates of the actual message. (In many asesm three of these are usualy a nonsense.)

The lossness of the Rabin cryptosystem is however probably reason #1 it is not practicaly used. In everyday crypto, you can consider all the ciphers to be lossless.

• I suppose that AES encryption can be considered an everyday crypto, therefore it's lossless, right? – user20190 Jan 7 '15 at 13:56
• Yes, sure, AES is lossless. In fact, there is not much need for lossy crypto at all. – v6ak Jan 7 '15 at 16:43