Key whitening: a block is encrypted as $C = E(M \oplus K_1, K_2) \oplus K_3$, with AES as the block cipher $E$. Which key sizes are forced, how do you decrypt, and what is the construction for?

Question

Accepted Answer

$K_1$ and $K_3$ must be 128 bits (the AES block size), $K_2$ is a normal AES key of 128, 192 or 256 bits. Decryption reverses the steps: $M = D(C \oplus K_3, K_2) \oplus K_1$.
Key sizes: $K_1$ is XORed onto the plaintext block and $K_3$ onto the ciphertext block, so both must match the block size, which for AES is always 128 bits. Only $K_2$ is a cipher key in the usual sense. The construction encrypts exactly one 128-bit block; longer messages still need a mode of operation.
Decryption: undo the operations in reverse order. XOR is its own inverse, so
$$M = D(C \oplus K_3, K_2) \oplus K_1$$
The same pattern written in textbook notation for DES (DESX): $y = \mathrm{DES}_k(x \oplus k_1) \oplus k_2$, decrypted as $x = \mathrm{DES}_k^{-1}(y \oplus k_2) \oplus k_1$.
Purpose: the whitening keys hide the cipher's actual input and output from the attacker, which makes exhaustive key search far more expensive at almost no computational cost (two XORs). It was introduced to stretch the short 56-bit DES key. It does not repair analytical weaknesses of the underlying cipher.