I am stuck with identifying ciphertext stealing method with the following properties:
- mode of operation is ECB;
- recommended padding scheme for this application is PKCS#7, but apparently it is not used;
- all blocks except the last one are encrypted / decrypted as usual;
- the last block is not padded, but still encrypted / decrypted somehow.
For example, with Blowfish cipher and key
encrypted: A4 3F 83 8D CE D2 54 2E | 4F decrypted: 82 DD 00 00 00 01 03 FF | 1E
I cannot figure out how that last (incomplete) block is encrypted / decrypted, so that if it is ignored and not processed, the penultimate block would be the same, — that does not look similar to ECB ciphertext stealing method described in Wikipedia, as block contents is not exchanged. This may seem obvious to an expert, but I already ran out of ideas.