Is it right that repeated AES encryption under the same key will eventually lead back to the original plaintext?

The reasoning is that AES acts like a reversible permutation of the blocks, the composition of several permutations is yet another permutation (closure), and because the number of permutations is finite, it must eventually get back to where it started.

If I write $E \circ E = E^2$ to mean "double AES" and $E^N$ to mean $N$ applications of AES (under the same key), then I can state the hypothesis symbolically as $E^N = I$ for some $N$, where $I$ is the identity permutation.

If this is correct, then it seems that $N-1$ applications of AES behaves identically to the inverse/decryption function, $D$, because

$$E^N = E \circ E^{N-1} = E \circ D = I$$

Is this statement correct?


1 Answer 1


Under a fixed key, $E_K$ is a permutation in the symmetric group of permutations on $2^{128}$ elements. Thus its order divides $(2^{128})!$.

If AES is modelled as a random permutation, for a randomly chosen fixed key, the order $N$ of $E_K$ is likely to be near $2^{127}$ as explained in the comment under the question, and indeed $E_K^{N-1}(x)=E_K^{-1}(x)$ for all $x\{0,1\}^{128}$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.