4
$\begingroup$

(I asked in stackoverflow and I should ask my question here not there, sorry about that)

The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,c4 How is the decryption for this graph? I hope that someone can explain it to me with a graph because I checked the explanation in wikipedia and it was confusing to me. enter image description here

Improve this question
$\endgroup$
4
  • $\begingroup$ This is not how ciphertext stealing (as I know it, since there is no standard for it) works, since ciphertext stealing allows to have a ciphertext of the same length as the plaintext, avoiding padding altogether. $\endgroup$
    – Lery
    Commented Mar 26, 2018 at 16:11
  • $\begingroup$ @Lery: yes, this is one way to do ciphertext stealing. C3' is not transmitted (that's the stolen part). $\endgroup$
    – fgrieu ♦
    Commented Mar 26, 2018 at 16:15
  • 1
    $\begingroup$ Okay, then it works, I'm just blind today. BTW, I'm also more used to see the ciphertext transmitted as C1, C2, C4, C3 rather than C1, C2, C3, C4, but it can also work that way, you just have to play around with your parser. It might be useful to once write an RFC about how to do it properly, I should take a look at the RFC creation process, I guess. $\endgroup$
    – Lery
    Commented Mar 26, 2018 at 16:21
  • $\begingroup$ It is described in the Coursera crypto course, but I'm not sure if it was the one from Dan Boneh or Jonathan Katz; I remember three variants. But as there are plenty of modes of operation that do not require padding I mostly forgot about them. Still, fine introductory courses, follow them both and you'll know :) $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 26, 2018 at 17:09

1 Answer 1

Reset to default
4
$\begingroup$

Let's say we have a ciphertext of length $(N-1)B < n < NB$, for $B$ the blocksize at hand (typically 128 for AES), where the ciphertext is made with $C_1, C_2, C_3, C_4$, with $C_3$ being shorter that the rest.

In order to decrypt a ciphertext made using ciphertext stealing as you drafted, you have to:

  1. Decrypt the ciphertext just like you would for CBC without ciphertext stealing for the $N-2$ first blocks.
  2. Take the latest two blocks ($C_3, C_4$ in your example), and compute the length of the "stolen" ciphertext by computing $n-(N-1)B=a$ and deducing its length $B-a$.
  3. Decrypt the latest block, e.g. $C_4$ into its unencrypted value $E_4$
  4. Xor $E_4$ with the concatenation of $C_3$ and $B-a$ 0s like $C_3 | \underbrace{0\cdots 0}_{B-a}$, to obtain $M_4 | C'_3$
  5. Take the last $B-a$ bits of it, which is $C'_3$ and concatenate it with $C_3$, which you can finally decrypt just like you would usually.

I've committed a cri diagram, using the same colors as you, hope this helps: CBC decryption with the same ciphertext stealing as in the question

Notice that this is assuming the same construction as you used in your graphic. (There are other ways to do it, too.)

Improve this answer
$\endgroup$
1
  • $\begingroup$ thank you so much very clear explanation and great graph $\endgroup$
    – user8863554
    Commented Mar 26, 2018 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.