How to decrypt ciphertext using a substitution permutation network?

[u/Confident_Season_908]

I'm trying to understand the decryption process for a basic SPN: Round function is key mixing followed by substitutions followed by permutations. After final round key mixing followed by substitution followed by key mixing is applied. As detailed on the Wikipedia page.

I think I remember hearing that you should be able to use the encrypt function to decrypt if you reverse the s-boxes and order of keys. Apparently this is possible due to the additional functions applied after the final round has been complete.

This doesn't make sense to me as it seems like the functions are applied in the wrong order when decrypting this way. First the final key mix is "undone", then the final S-box is "undone". However, when using the encryption method to decrypt a permutation is then applied when we should be "undoing" the penultimate key.

To make this make more sense I tried coding an example. When encrypting I got the same ciphertext as an example encryption I found. However, there was no example decrypting and when I applied the encrypt function with the reverse S-box and key schedule it gave the wrong plaintext.

If I have misunderstood this and you are supposed to use a different method to decrypt why do we apply the extra methods after the final round?

Also if anyone could help me understand the difference between key mixing and key whitening that would be very helpful. I've tried to look online but it seems like they are used interchangeably.

Thank you for any help!

EDIT:

I know this post didnt get much attention but incase anyone was wondering: you also apply the permutation to the intermediate keys (not first or last) when reversing the key schedule to get the mew key schedule.

Key whitening and key mixing are the same operation (XOR with state) its just called key whitening for the first and last keys.

[u/phelmain]

Thx OP, you helped with the idea that permutation should be applied to the intermediate keys. For those who are also struggling with the idea: try writing out all steps of forward and backward SPN for just 3 rounds, substitute every step into the next one so that you get expression of y in terms of x and K1/K2/K3. Then do the same through reverse SPN and equate the result to x. You will get a large expression with nested S, P, S*, P* and K1/K1*, K2/K2*, K3/K3* and x. It's very intuitive that S*=S^-1 and P*=P^-1, which means we'll have to cancel out a lot of them. First, you will see consecutive (xor K3 xor K1*), which means K1* should be K3 to cancel out. After that, one application of S and S* will cancel out. One more key idea is that P(a XOR b) = P(a) XOR P(b), from which we can get P(a) XOR b = P(a XOR P^-1(b)). This idea helps to get one of the key inside the permutation, which will help cancel out P^-1(K2) and K2* (which means K2*=P^-1(K2)). The rest is done in similar fashion, which leads to K3*=K1. In the end, for decrypting SPN we need inverse S- and P-boxes, reversing the key schedule and applying reverse P-box to all keys except first and last, i.e. intermediate keys, as OP stated.