(I asked in stackoverflow and I should ask my question here not there, sorry about that)

The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,c4 How is the decryption for this graph? I hope that someone can explain it to me with a graph because I checked the explanation in wikipedia and it was confusing to me. enter image description here

  • $\begingroup$ This is not how ciphertext stealing (as I know it, since there is no standard for it) works, since ciphertext stealing allows to have a ciphertext of the same length as the plaintext, avoiding padding altogether. $\endgroup$
    – Lery
    Mar 26 '18 at 16:11
  • $\begingroup$ @Lery: yes, this is one way to do ciphertext stealing. C3' is not transmitted (that's the stolen part). $\endgroup$
    – fgrieu
    Mar 26 '18 at 16:15
  • 1
    $\begingroup$ Okay, then it works, I'm just blind today. BTW, I'm also more used to see the ciphertext transmitted as C1, C2, C4, C3 rather than C1, C2, C3, C4, but it can also work that way, you just have to play around with your parser. It might be useful to once write an RFC about how to do it properly, I should take a look at the RFC creation process, I guess. $\endgroup$
    – Lery
    Mar 26 '18 at 16:21
  • $\begingroup$ It is described in the Coursera crypto course, but I'm not sure if it was the one from Dan Boneh or Jonathan Katz; I remember three variants. But as there are plenty of modes of operation that do not require padding I mostly forgot about them. Still, fine introductory courses, follow them both and you'll know :) $\endgroup$
    – Maarten Bodewes
    Mar 26 '18 at 17:09

Let's say we have a ciphertext of length $(N-1)B < n < NB$, for $B$ the blocksize at hand (typically 128 for AES), where the ciphertext is made with $C_1, C_2, C_3, C_4$, with $C_3$ being shorter that the rest.

In order to decrypt a ciphertext made using ciphertext stealing as you drafted, you have to:

  1. Decrypt the ciphertext just like you would for CBC without ciphertext stealing for the $N-2$ first blocks.
  2. Take the latest two blocks ($C_3, C_4$ in your example), and compute the length of the "stolen" ciphertext by computing $n-(N-1)B=a$ and deducing its length $B-a$.
  3. Decrypt the latest block, e.g. $C_4$ into its unencrypted value $E_4$
  4. Xor $E_4$ with the concatenation of $C_3$ and $B-a$ 0s like $C_3 | \underbrace{0\cdots 0}_{B-a}$, to obtain $M_4 | C'_3$
  5. Take the last $B-a$ bits of it, which is $C'_3$ and concatenate it with $C_3$, which you can finally decrypt just like you would usually.

I've committed a cri diagram, using the same colors as you, hope this helps: CBC decryption with the same ciphertext stealing as in the question

Notice that this is assuming the same construction as you used in your graphic. (There are other ways to do it, too.)

  • $\begingroup$ thank you so much very clear explanation and great graph $\endgroup$ Mar 26 '18 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.