Subject: [saag] A question about AES properties...

From: John Border <[email-masked]>
Date: Thu, 15 Oct 2009 15:56:54 -0400

I have what I thought was a simple question about the properties of AES.  But, I have not been able to find an answer.  Possibly that means the question itself is flawed (but I haven't been able to figure that out either)...

   With AES, does the order of the functions matter, i.e. does EK(DK(P)) = DK(EK(P))?

John Border

---

From: Ken Raeburn <[email-masked]>
Date: Mon, 19 Oct 2009 12:51:49 -0400

On Oct 15, 2009, at 15:56, John Border wrote:
>     I have what I thought was a simple question about the properties  
> of AES.  But, I have not been able to find an answer.  Possibly that  
> means the question itself is flawed (but I haven’t been able to  
> figure that out either)…
>

AES block encryption with a specific key is a permutation of 2^128  
values -- a bijection from the set to itself.  Decryption with the  
same key is just the inverse of that permutation.  Both E(D(P)) and  
D(E(P)) perform some permutation and then reverse it, giving you back  
the starting value.

The same argument applies to block cipher modes of encryption that  
operate on multiple blocks, in cases that don't do any message  
expansion.  They're still reversible permutations, just over larger  
sets.  But, for example, if your encryption mode is "CBC encryption  
with padding", and P isn't a multiple of the block size, then D(E(P))  
= P' where P' has padding added, and E(D(P)) just doesn't work because  
D requires its input to be a multiple of the block size.

Ken

---

From: [email-masked]
Date: Mon, 19 Oct 2009 13:49:37 -0700

> >    With AES, does the order of the functions matter, i.e. does  

As Ken responded, if the plaintext is a multiple of the block size, because EK
and DK are inverses, the result is the identity function, so the answer to the
above is that the order does not make a difference.

BUT, I expect what you might have been trying to ask is whether EK1(DK2(P)) =
DK2(EK1(P)), i.e. your question above, but using two different keys.  In this
case, the analyses is not as simple, and I would guess that the answer is that
no they are not the same.  But I could be wrong.  You should be able to verify
the "NO" answer with a simple experiment.

Clifford Neuman