# AES Encryption vs Decryption

We recently learned about AES in class and it was heavily emphasized that encryption and decryption in AES are not the same because the functions are not reversible.

Why then, when we got to block ciphers, do certain cipher modes use the encryption function for both encryption and decryption?

The reasoning given was that XOR is reversible, but doesn't this contradict the first statement?

• Where did you learn that? Get away from there. Start reading a good book, not a random internet article. AES is an SPN cipher and everything must be reversible! Oct 28, 2020 at 22:32
• CTR mode uses only the encryption since it is designed for PRF, not PRP. So one can use an hash as in ChaCha20... Oct 28, 2020 at 22:33

## 1 Answer

More than likely the wrong words were used in class, 'not reversible' was probably supposed to be tied to the understanding of Feistel type ciphers, where simply reversing the order of operations of the block cipher leads to decryption. We are talking about the block cipher here, not modes.

In AES, reversing the order does NOT lead to decryption, since not all the operations are their own 'self inverse' like they are in say, DES.

In AES, which uses a combination of MDS matrix multiplication, s-box lookups, and XOR, needs the inverse MDS matrix and s-box to decrypt when reversing the order of operations, in this case the subkey XOR does not change.

AES also offers something called Equivalent Inverse Decryption, which still needs using the decrypt matrix and s-box, but allows the order of operations to be the same as encryption. This works by changing some of the subkeys using the decryption operations. If you look at this from the start without a good understanding of the regular encryption and decryption functions and their component operations, it looks like witchcraft.

I recommend reading the original submission paper, which explains everything pretty well.