Iterated AES encryption under a fixed key

Question

Is it right that repeated AES encryption under the same key will eventually lead back to the original plaintext?

The reasoning is that AES acts like a reversible permutation of the blocks, the composition of several permutations is yet another permutation (closure), and because the number of permutations is finite, it must eventually get back to where it started.

If I write $E \circ E = E^2$ to mean "double AES" and $E^N$ to mean $N$ applications of AES (under the same key), then I can state the hypothesis symbolically as $E^N = I$ for some $N$, where $I$ is the identity permutation.

If this is correct, then it seems that $N-1$ applications of AES behaves identically to the inverse/decryption function, $D$, because

$$E^N = E \circ E^{N-1} = E \circ D = I$$

Is this statement correct?

Answer 1

Under a fixed key, $E_K$ is a permutation in the symmetric group of permutations on $2^{128}$ elements. Thus its order divides $(2^{128})!$.

If AES is modelled as a random permutation, for a randomly chosen fixed key, the order $N$ of $E_K$ is likely to be near $2^{127}$ as explained in the comment under the question, and indeed $E_K^{N-1}(x)=E_K^{-1}(x)$ for all $x\{0,1\}^{128}$.