Is there a feasible way to reconstruct the key from the (Triple-)DES round key?

Question

Assume there is a closed source application which uses Triple-DES with a fixed/hardcoded key to decrypt large amounts of data. Someone managed to extract the round keys from a process memory dump and was able to verify (using a patched version of 3DES that takes round keys as input) that these keys are actually able to decrypt the data successfully.

Is there a known way to use these round keys to reconstruct the original secret key from it? (As it is DESede, two keys are derived using decryption mode and one key using encryption mode). Technically, it is not necessary to be able to do so (a patched 3DES implementation can decrypt the data fine), but it would make the code more readable to just use normal 3DES and plug the original secret keys in. (Plus it would be possible to encrypt instead of decrypt with them).

If there is no such way, is it a design decision that reversing the derivation of round keys to be hard, or is it just coincidence?

Answer 1

DES key schedule takes the 64-bit key and PC-1 (Permuted Choice 1) discards the parity check bits and applies a permutation to the remaining.

Then for the rest they key bits are divided into 28-bit halves and for the each round

• They are rotated left one or two specified for each round. Then
• 48-bit bits are selected by PC-2 (Permuted Choice 2) which is another permutation that discards some bits.

_{\begin{array}{|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|} \hline \text{Number of Round} & 1 & 2 & 3& 4 & 5 & 6 & 7 & 8 & 9 & 10 & 11 & 12 & 13 & 14 & 15 & 16\\ \hline \text{Number of Left rotations} & 1 & 1 & 2 & 2 & 2 & 2 & 2 & 2 & 1 & 2 & 2 & 2 & 2 & 2 & 2 & 1 \\ \hline \end{array}}

Is there a known way to use these round keys to reconstruct the original secret key from it?

Giving a round key of DES, apply reverse PC-2. With this, you will get the 48-bit of the 56 bits key. You can either complete this by using brute-force for the remaining key bits or use another round key to fill the missing 8 key bits.

Is there a feasible way to reconstruct the key from the (Triple-)DES round key?

For the Triple DES, you need round keys for each different DES key if the keys are independently generated.

Though the reversibility of a key schedule is not really required, for older systems non-reversible key schedule makes the decryption require more process time or more memory.

Answer 2

The DES round keys are just certain secret key bits (48 of them for each round). Say $K_1,\ldots,K_{16}$ are the 48 bit round keys with $K_i$ the $i^{th}$ round subkey.

Then, the EDE triple DES uses round keys in the following order

$$K^{(1)}_1,K^{(1)}_2,\ldots,K^{(1)}_{16}$$

which are the subkeys of the first (E) followed by (D) $$K^{(2)}_{16},K^{(2)}_{15},\ldots,K^{(2)}_1$$ and by (E)

$$K^{(3)}_1,K^{(3)}_2,\ldots,K^{(3)}_{16}$$.

The keys $K^{(1)},K^{(2)},K^{(3)}$ are independently generated DES keys.