# AES Inverse Key Schedule

I have a 128-bit input-block and the corresponding cipher-block given. Additionally I have the last round-key given. Is it now possible to get (calculate) the associated cipher-key? I already implemented the normal key-schedule with the rcon to generate the round-keys out of a cipher-key (like on wikipedia: https://en.wikipedia.org/wiki/Rijndael_key_schedule), but it didn't help me much for the other way... Ist the AES Key Schedule easily invertible? I'm a bit baffled now because i thought it would be.

• Aug 17, 2022 at 14:43

Yes, that is possible: It is quite obvious from the description of the key schedule that all involved operations are invertible. An implementation of that inversion is the function aes128_key_schedule_inv_round found in this C file.

• Wow, it's really that obvious...Big thanks for the helpful answer, altough it was a stupid question in hindsight.
– Tom
Dec 22, 2015 at 19:49
• @Tom Just because there is an easy answer doesn't mean that the question is stupid. It's actually a fine question. Don't forget to accept a winning answer. Dec 22, 2015 at 22:22
• @yyyyyyy The above link has become broken with the passage of time. Are you able to provide a redirect? Jun 26, 2019 at 20:59
• @KenGoss Thanks! I've updated the link. Jun 29, 2019 at 18:54

Yes. See the schema in this answer.

You are given $k_{43}, k_{42}, k_{41}, k_{40}$. So you can compute $k_{39}$ from $k_{43} = k_{42} \oplus k_{39}$ etc. Just follows the recursion backwards. There is only one unknown at every stage.

• I've overlooked that there's really only one unknown at every stage. I was so convinced that there are two unknowns at first, that i couldn't think further. Thanks!
– Tom
Dec 22, 2015 at 19:50

Following the answer of @Henno Brandsma.

For AES-256:

$$k_{56} = f(k_{55}) \oplus k_{48} \to k_{48} = f(k_{55}) \oplus k_{56}$$

$$k_{57} = k_{56} \oplus k_{49} \space\space\space\space\space\to k_{49} = k_{56}\oplus k_{57}$$

$$k_{58} = k_{57} \oplus k_{50} \space\space\space\space\space\to k_{50} = k_{57}\oplus k_{58}$$

$$k_{59} = k_{58} \oplus k_{51} \space\space\space\space\space\to k_{51} = k_{58}\oplus k_{59}$$

Note that the function $$f()$$ does not change in the inverse key schedule .