I am looking for AES-128 keys such that the last round key is exactly the first round key (which is simply the key). Any pointer to a proof that they exist or that they don't would be welcome.

In the same line, I am looking for last round keys which are the bitwise inverse of the key or some similarly simple relation with the key.

  • 3
    $\begingroup$ The relation between the first subkey and the last subkey is highly nonlinear (because of the sbox lookups done as a part of the operation). It would be surprising if anyone could prove anything either way. $\endgroup$ – poncho Dec 15 '15 at 15:13
  • $\begingroup$ It is understood that for the best part of the key space such relation does not exist. The question is on the existence of keys with those properties, and any idea on their numbers would be welcome too. $\endgroup$ – acapola Dec 15 '15 at 15:29
  • $\begingroup$ I would assume that in AES-256 this is possible because of the way the round keys are generated, but in AES-128 it is not likely $\endgroup$ – Richie Frame Dec 15 '15 at 18:07
  • $\begingroup$ What is the motivation here? Finding a weak key? $\endgroup$ – Thomas M. DuBuisson Dec 16 '15 at 19:23
  • 1
    $\begingroup$ @RichieFrame: actually, if we model the first-to-last-round-key transform as a random permutation, then the probability of there being some AES-128 key having the first and last round keys the same is about $1 - 1/e \approx 0.63212$ $\endgroup$ – poncho Dec 17 '15 at 13:39

Not an answer but larger than a comment.

You can ask automated solvers to provide you with keys where the first and last rounds keys match. Existing solvers likely won't terminate quickly on AES-128 for reasons mentioned in the question and comments.

AES-256, on the other hand, does yield results. For example the keys:

  • 0x623cacba4d7fc6b7914b6bd000a2bcccf0967f268cbafde97ffc5bae4be5d2,
  • 0xfea74943353b4d96d69457a2e6fbe56b1029ca48dc179d1967200df51cee7 and
  • 0xf4e810b7b1c9253e75683304ac4f03f90be6534757600685706d8f6a97bee

all retain the property that expandedKey[0] == expandedKey[nrRounds].

  • $\begingroup$ interesting, "automated solver"="SAT solver" ? I am not familiar with that stuff, could you indicate which tool to use to reproduce your finding on AES256 ? $\endgroup$ – acapola Dec 18 '15 at 15:20
  • 1
    $\begingroup$ Yes, I'm taking about SAT solvers. I used cryptol to compute the above values. $\endgroup$ – Thomas M. DuBuisson Dec 18 '15 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.