# Which ECB ciphertext stealing scheme is this?

I am stuck with identifying ciphertext stealing method with the following properties:

• mode of operation is ECB;
• recommended padding scheme for this application is PKCS#7, but apparently it is not used;
• all blocks except the last one are encrypted / decrypted as usual;
• the last block is not padded, but still encrypted / decrypted somehow.

For example, with Blowfish cipher and key 72E9DD9D29:

encrypted: A4 3F 83 8D CE D2 54 2E | 4F
decrypted: 82 DD 00 00 00 01 03 FF | 1E


I cannot figure out how that last (incomplete) block is encrypted / decrypted, so that if it is ignored and not processed, the penultimate block would be the same, — that does not look similar to ECB ciphertext stealing method described in Wikipedia, as block contents is not exchanged. This may seem obvious to an expert, but I already ran out of ideas.

• Perhaps something CFB or OFB like. – CodesInChaos Sep 30 '15 at 19:15
• @CodesInChaos Strangely enough, I could not find any description of “CFB ciphertext stealing” or “OFB ciphertext stealing” — not even any references to such methods. Could you please provide a link to some source? – Anton Samsonov Oct 1 '15 at 16:38
• I meant that it might use one of those stream cipher modes for the last block, instead of ciphertext stealing. OCB mode uses a similar technique to handle its last block. – CodesInChaos Oct 1 '15 at 16:43