Counter mode with $\operatorname{AES}_k(m)$ vs $\operatorname{AES}_m(k)$ In theory, for an ideal cipher $E_k: \{0,1\}^{128} \to \{0,1\}^{128}$, it would be completely fine to use the key and the input interchangeably, but obviously AES is not perfect. For AES128, the key size and the block size are the same. What would the security implications of using the key in place of the input block and vise versa be? I understand that it would be quite inefficient as the key schedule would need to be re-calculated for every block, but would it make cryptanalysis easier?

Encryption and decryption would be possible by putting the cipher in a modified counter mode. Where $n$ is the nonce, $i$ is the counter/position of the block, $C$ is ciphertext, and $P$ is plaintext:

\begin{align*}
C_i &amp;= E_{n \mathbin\| i}(k) \oplus P_i\\
P_i &amp;= E_{n \mathbin\| i}(k) \oplus C_i
\end{align*}

Actual counter mode is:

\begin{align*}
C_i &amp;= E_k(n \mathbin\| i) \oplus P_i\\
P_i &amp;= E_k(n \mathbin\| i) \oplus C_i
\end{align*}

This is a purely hypothetical question and I have no intention of doing something so silly.
I understand that it would be quite inefficient as the key schedule would need to be re-calculated for every block, but would it make cryptanalysis easier?


It would make cryptanalysis trivial.

If the attacker knows that

$$P_i \oplus C_i = E_{n \mathbin\| i}(k)$$

and he knows $n, i, C_i$ and has a guess for $P_i$, he can recover $k$, and use that to decrypt everything else.

This works because, with AES, $E_k$ has an inverse $E^{-1}_k$ that's efficiently computable, assuming you know $k$.  There's no corresponding "inverse" corresponding to the message block, and so the "message block" and the "key" inputs to AES are not interchangable from a security standpoint.