I have a 128-bit input-block and the corresponding cipher-block given. Additionally I have the last round-key given. Is it now possible to get (calculate) the associated cipher-key? I already implemented the normal key-schedule with the rcon to generate the round-keys out of a cipher-key (like on wikipedia: https://en.wikipedia.org/wiki/Rijndael_key_schedule), but it didn't help me much for the other way... Ist the AES Key Schedule easily invertible? I'm a bit baffled now because i thought it would be.

Thanks in advance for your answers.


3 Answers 3


Yes, that is possible: It is quite obvious from the description of the key schedule that all involved operations are invertible. An implementation of that inversion is the function aes128_key_schedule_inv_round found in this C file.

  • $\begingroup$ Wow, it's really that obvious...Big thanks for the helpful answer, altough it was a stupid question in hindsight. $\endgroup$
    – Tom
    Commented Dec 22, 2015 at 19:49
  • 5
    $\begingroup$ @Tom Just because there is an easy answer doesn't mean that the question is stupid. It's actually a fine question. Don't forget to accept a winning answer. $\endgroup$
    – Maarten Bodewes
    Commented Dec 22, 2015 at 22:22
  • $\begingroup$ @yyyyyyy The above link has become broken with the passage of time. Are you able to provide a redirect? $\endgroup$
    – Ken Goss
    Commented Jun 26, 2019 at 20:59
  • 1
    $\begingroup$ @KenGoss Thanks! I've updated the link. $\endgroup$
    – yyyyyyy
    Commented Jun 29, 2019 at 18:54

Yes. See the schema in this answer.

You are given $k_{43}, k_{42}, k_{41}, k_{40}$. So you can compute $k_{39}$ from $k_{43} = k_{42} \oplus k_{39}$ etc. Just follows the recursion backwards. There is only one unknown at every stage.

  • $\begingroup$ I've overlooked that there's really only one unknown at every stage. I was so convinced that there are two unknowns at first, that i couldn't think further. Thanks! $\endgroup$
    – Tom
    Commented Dec 22, 2015 at 19:50

Following the answer of @Henno Brandsma.

For AES-256:

$k_{56} = f(k_{55}) \oplus k_{48} \to k_{48} = f(k_{55}) \oplus k_{56}$

$k_{57} = k_{56} \oplus k_{49} \space\space\space\space\space\to k_{49} = k_{56}\oplus k_{57}$

$k_{58} = k_{57} \oplus k_{50} \space\space\space\space\space\to k_{50} = k_{57}\oplus k_{58}$

$k_{59} = k_{58} \oplus k_{51} \space\space\space\space\space\to k_{51} = k_{58}\oplus k_{59}$

Note that the function $f()$ does not change in the inverse key schedule .


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.