Could any kind of encryption method (AES, etc.) lead to data loss like in lossy compression? I'm interested if data (lossy compressed, lossless compressed, uncompressed) that is encrypted and decrypted will always come back in the same state as before the encryption process, no matter what encryption method is used.
Regards, Neil
A block cipher such as AES is a Pseudo Random Permutation or PRP. The mathematical properties of that does not allow for data loss. It's always possible to mess up the implementation though, for instance by treating the ciphertext as a string instead of binary data (encoding/decoding issues).
A mode of operation is required to perform encryption with a block cipher. These modes of operation should not confer any information about the plaintext (except the size). Therefore they need some kind of randomization or they will create the same ciphertext for identical data. This makes it impossible to distinguish $(E(x), E(x))$ from $(E(x), E(y))$ for $x \ne y$.
Because of this encryption will result in different ciphertext even for the same input. This is usually accomplished by using a unique initialization vector for each encryption. Still, modes of operation will still need to keep to the contract that $p=D_k(E_k(p))$. There may be limitations to the amount of plaintext that can or should be encrypted by a cipher.
Furthermore, integrity of data is not supported by all modes of operation, it is therefore important to use authenticated encryption (for instance by using GCM or by performing HMAC over the ciphertext) if data may be altered by an attacker or by a lower level (transport) layer.
Removing some verbosity:
I'm interested if data that is encrypted and decrypted will always come back in the same state as before the encryption process.
Yes, it's actually one of the first things you learn in Crypto 101: if $e$ is the encryption function of a cryptosystem and $d$ is its decryption function, then $d(e(m)) = m$ for all valid messages $m$. Any system which does not satisfy this property cannot really be called a cryptosystem.
There is at least one lossy cryptosystem: The Rabin cryptosystem. When you decrypt a cryptotext, you get four candidates of the actual message. (In many asesm three of these are usualy a nonsense.)
The lossness of the Rabin cryptosystem is however probably reason #1 it is not practicaly used. In everyday crypto, you can consider all the ciphers to be lossless.
