DESX uses whitening to strengthen against brute force attacks. What is an attack one could use to recover DESX's pre-whitening key with only two known ciphertext/plaintext pairs, given that the attacker can successfully disable the post-whitening step?
So far I have come up with this:
- The attacker could use an active fault injection attack to reduce DESX to return the results after round 1, effectively skipping rounds 2 to 16.
- Starting from the two ciphertexts, the attacker could then find all inputs to the s-boxes to recover all s-box input candidates.
- Starting from the two plaintexts, the attacker can find
E(whiteningKey) xor roundKeycombinations that produce the same s-box input candidates.
My problem now is this: The attacker has no way other than brute force to separate the whitening key from the round key in the equation above. Given the fact that brute force takes on average 2^55 attempts, this would be incredibly slow without special FPGA hardware.