# Do all ciphers have equivalent decryption keys?

Do all ciphers suffer from the problem of multiple equivalent decryption keys? Is the existence of equivalent keys an essential property for the security of a cipher?

If you could prove that a cipher had no equivalent keys, would that lead to a procedure for recovering the key under the known-plaintext attack model?

• Are you talking about symmetric key ciphers? Because most modern block ciphers are designed to have no weak keys, which includes equivalent keys (like the weak and semi-weak keys of DES). What lead you to believe that equivalent keys would be essential for security? – J.D. Jul 2 '16 at 17:55
• A linear system has a unique solution if it is non-singular and requires no guesswork. But it seems guessing is a desirable feature of a cipher solution. – user9070 Jul 2 '16 at 18:07
• A block cipher is ideally very far from a linear system. Large classes of equivalent keys greatly weaken the cipher, because a key-guessing attacker only has to test one key per equivalence class. – J.D. Jul 2 '16 at 18:18
• What is an equivalent decryption key? – Andrew Hoffman Jul 3 '16 at 4:03
• @AndrewHoffman it's two (or more) keys that all work to decrypt a ciphertext correctly. – user9070 Jul 3 '16 at 4:58

Do all ciphers suffer from the problem of multiple equivalent decryption keys?

No. The number of non-equivalent keys is bounded by the number of permutations. Since the number of permutations is very high there is a very big chance that ciphers do not have equivalent keys. This is especially true for ciphers with a high block size (AES with 128 bits). Even if an equivalent key would exist, it would probably be rather tricky to find a set of two equivalent keys. How tricky depends on the cipher of course.

Is the existence of equivalent keys an essential property for the security of a cipher?

Therefore no.

If you could prove that a cipher had no equivalent keys, would that lead to a procedure for recovering the key under the known-plaintext attack model?

No. Finding that a cipher does not have equivalent keys would enhance the security of the cipher, not decrease it.