# Are there AES-128 keys such that first round key equals last round key?

I am looking for AES-128 keys such that the last round key is exactly the first round key (which is simply the key). Any pointer to a proof that they exist or that they don't would be welcome.

In the same line, I am looking for last round keys which are the bitwise inverse of the key or some similarly simple relation with the key.

• The relation between the first subkey and the last subkey is highly nonlinear (because of the sbox lookups done as a part of the operation). It would be surprising if anyone could prove anything either way. Dec 15, 2015 at 15:13
• It is understood that for the best part of the key space such relation does not exist. The question is on the existence of keys with those properties, and any idea on their numbers would be welcome too. Dec 15, 2015 at 15:29
• I would assume that in AES-256 this is possible because of the way the round keys are generated, but in AES-128 it is not likely Dec 15, 2015 at 18:07
• What is the motivation here? Finding a weak key? Dec 16, 2015 at 19:23
• @RichieFrame: actually, if we model the first-to-last-round-key transform as a random permutation, then the probability of there being some AES-128 key having the first and last round keys the same is about $1 - 1/e \approx 0.63212$ Dec 17, 2015 at 13:39

Not an answer but larger than a comment.

You can ask automated solvers to provide you with keys where the first and last rounds keys match. Existing solvers likely won't terminate quickly on AES-128 for reasons mentioned in the question and comments.

AES-256, on the other hand, does yield results. For example the keys:

• 0x623cacba4d7fc6b7914b6bd000a2bcccf0967f268cbafde97ffc5bae4be5d2,
• 0xfea74943353b4d96d69457a2e6fbe56b1029ca48dc179d1967200df51cee7 and
• 0xf4e810b7b1c9253e75683304ac4f03f90be6534757600685706d8f6a97bee

all retain the property that expandedKey[0] == expandedKey[nrRounds].

• interesting, "automated solver"="SAT solver" ? I am not familiar with that stuff, could you indicate which tool to use to reproduce your finding on AES256 ? Dec 18, 2015 at 15:20
• Yes, I'm taking about SAT solvers. I used cryptol to compute the above values. Dec 18, 2015 at 15:29