# AES Inverse Key Schedule

I have a 128-bit input-block and the corresponding cipher-block given. Additionally I have the last round-key given. Is it now possible to get (calculate) the associated cipher-key? I already implemented the normal key-schedule with the rcon to generate the round-keys out of a cipher-key (like on wikipedia: https://en.wikipedia.org/wiki/Rijndael_key_schedule), but it didn't help me much for the other way... Ist the AES Key Schedule easily invertible? I'm a bit baffled now because i thought it would be.

Yes, that is possible: It is quite obvious from the description of the key schedule that all involved operations are invertible. An implementation of that inversion is the function aes128_key_schedule_inv_round found in this C file.

• Wow, it's really that obvious...Big thanks for the helpful answer, altough it was a stupid question in hindsight.
– Tom
Dec 22, 2015 at 19:49
• @Tom Just because there is an easy answer doesn't mean that the question is stupid. It's actually a fine question. Don't forget to accept a winning answer. Dec 22, 2015 at 22:22
• @yyyyyyy The above link has become broken with the passage of time. Are you able to provide a redirect? Jun 26, 2019 at 20:59
• @KenGoss Thanks! I've updated the link. Jun 29, 2019 at 18:54

Yes. See the schema in this answer.

You are given $k_{43}, k_{42}, k_{41}, k_{40}$. So you can compute $k_{39}$ from $k_{43} = k_{42} \oplus k_{39}$ etc. Just follows the recursion backwards. There is only one unknown at every stage.

• I've overlooked that there's really only one unknown at every stage. I was so convinced that there are two unknowns at first, that i couldn't think further. Thanks!
– Tom
Dec 22, 2015 at 19:50