# Are there AES128 keys such that first round key equals last round key?

I am looking for AES128 keys such that the last round key is exactly the first round key (which is simply the key). Any pointer to a proof that they exist or that they don't would be welcome.

In the same line, I am looking for last round keys which are the bitwise inverse of the key or some similarly simple relation with the key.

• The relation between the first subkey and the last subkey is highly nonlinear (because of the sbox lookups done as a part of the operation). It would be surprising if anyone could prove anything either way. – poncho Dec 15 '15 at 15:13
• It is understood that for the best part of the key space such relation does not exist. The question is on the existence of keys with those properties, and any idea on their numbers would be welcome too. – acapola Dec 15 '15 at 15:29
• I would assume that in AES-256 this is possible because of the way the round keys are generated, but in AES-128 it is not likely – Richie Frame Dec 15 '15 at 18:07
• What is the motivation here? Finding a weak key? – Thomas M. DuBuisson Dec 16 '15 at 19:23
• @RichieFrame: actually, if we model the first-to-last-round-key transform as a random permutation, then the probability of there being some AES-128 key having the first and last round keys the same is about $1 - 1/e \approx 0.63212$ – poncho Dec 17 '15 at 13:39

Not an answer but larger than a comment.

You can ask automated solvers to provide you with keys where the first and last rounds keys match. Existing solvers likely won't terminate quickly on AES128 for reasons mentioned in the question and comments. AES256, on the other hand, does yield results. For example the keys 0x623cacba4d7fc6b7914b6bd000a2bcccf0967f268cbafde97ffc5bae4be5d2, 0xfea74943353b4d96d69457a2e6fbe56b1029ca48dc179d1967200df51cee7, and 0xf4e810b7b1c9253e75683304ac4f03f90be6534757600685706d8f6a97bee all retain the property that expandedKey[0] == expandedKey[nrRounds]

• interesting, "automated solver"="SAT solver" ? I am not familiar with that stuff, could you indicate which tool to use to reproduce your finding on AES256 ? – acapola Dec 18 '15 at 15:20
• Yes, I'm taking about SAT solvers. I used cryptol to compute the above values. – Thomas M. DuBuisson Dec 18 '15 at 15:29