# Probability of same input as output in AES 256

Note: I am assuming that, when entering in the key and plaintext, they are formatted in the same manner as the output of an AES-256 encrypted text.

What is the probability, if any, that you could enter in a key that ends up being the exact same as the output after AES-256 encryption?

and alternatively:

What is the probability, if any, that you could enter in a plaintext (pre-encryption message) that ends up being the exact same as the output after AES-256 encryption?

• For AES-256, the key is 256-bit, and the output is 128-bit; thus one can not "enter in a key that ends up being the exact same as the output". Also, it is unclear if "probability that you could enter in a key that ends up X" refers to probability that one random key ends up X, or probability that one key exists that ends up X (which can only be higher). Similarly it is unclear if you consider the AES input fixed or variable, and in the later case how that is accounted for in the desired probability.
– fgrieu
Aug 4, 2016 at 3:59
• Related: Does AES have any fixed-points? Aug 5, 2016 at 8:14

## 1 Answer

Normally you don't enter keys at all. Maybe you enter passwords which then get transformed into keys. The only time anyone normally enters keys is during testing and possibly during key management (e.g. backing up a key in multiple parts, printing it on paper).

Even if AES does output the same bytes as the key, it doesn't matter as long as the bytes are random; the attacker would never know about it. So the only reason to even worry about this is when you want to use AES to derive keys. The output of AES is a pseudo random permutation where each result is as likely as the other. AES has no "weak keys" where the output has special properties, so you cannot enter a weak key by mistake.

As already indicated, AES has an output of 128 bits, so it will never output 256 bits by itself. You'd need a mode of operation such as ECB, CBC or CTR to do so. The output of AES with a mode of operation depends on the protocol and mode of operation itself.

To derive keys you'd better use a Key Derivation Function (KDF) though. Password Based KDF's are used to turn passwords into keys. Well known ones are scrypt, bcrypt, PBKDF2. If you want to derive other keys from a master key, you can use a Key Based KDF such as HKDF. If you must use AES, use a counter mode KDF specified in NIST SP-800 108.

One of the good things about KDF's is that you can specify the output size to be 256 bits. There are other properties such as having a label, performing key stretching and optionally using a salt that make them much better than a plain hash or block cipher to derive keys.

Beware to never mix up text and binary. All modern cryptographic primitives operate on bytes. You need character-encoding (e.g. UTF-8) and possibly encoding (e.g. base 64) operations to convert between text and binary.