Decrypt AES-encrypted data with another key Here is a plain question, all filled with pseudo-real data :)


We have a string: "hello" and two keys for AES: GoodKey and BadKey.
We encrypt our string with GoodKey, and receive something like "lehho".
What will happen if we try to decrypt "lehho" with BadKey? Will decryption algorithm make no sense at some point (like 1/0 makes no sense) OR will it give us some other result, like "goodbye" (which is not original "hello" because of the wrong key)???
Usually you require a mode of operation for a block cipher such as CBC or CTR to encrypt data. CBC or CTR is then configured with the given block cipher &amp; key. The mode takes an IV or nonce as additional parameter, but I'll leave the IV out of my answer as the IV value is inconsequential if the wrong key is used.

A block cipher such as AES will simply encrypt or decrypt a full block of bytes. For each possible plaintext block there will be precisely one ciphertext block, given a specific key. The result of a bad key will have the same size, but it will be indistinguishable from random otherwise.

A block cipher itself however is not secure and can only encrypt precisely one block - you need the mode of operation too. In that case it depends on the mode. If the mode does not apply padding - e.g. CTR - then the result will be indistinguishable from random, and you won't get an error. If you use CBC (and a padding algorithm instead of ciphertext stealing) then you will probably get a padding error (about 255 in 256 times).

If you always want to receive an error instead of garbled ciphertext or a padding error you need to integrity protect your ciphertext. You can do this by using an authenticated mode of operation such a GCM or by applying a (H)MAC over the ciphertext.