# CBC - Cipher-text stealing decryption

The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,c4 How is the decryption for this graph? I hope that someone can explain it to me with a graph because I checked the explanation in wikipedia and it was confusing to me.

• This is not how ciphertext stealing (as I know it, since there is no standard for it) works, since ciphertext stealing allows to have a ciphertext of the same length as the plaintext, avoiding padding altogether.
– Lery
Mar 26 '18 at 16:11
• @Lery: yes, this is one way to do ciphertext stealing. C3' is not transmitted (that's the stolen part).
– fgrieu
Mar 26 '18 at 16:15
• Okay, then it works, I'm just blind today. BTW, I'm also more used to see the ciphertext transmitted as C1, C2, C4, C3 rather than C1, C2, C3, C4, but it can also work that way, you just have to play around with your parser. It might be useful to once write an RFC about how to do it properly, I should take a look at the RFC creation process, I guess.
– Lery
Mar 26 '18 at 16:21
• It is described in the Coursera crypto course, but I'm not sure if it was the one from Dan Boneh or Jonathan Katz; I remember three variants. But as there are plenty of modes of operation that do not require padding I mostly forgot about them. Still, fine introductory courses, follow them both and you'll know :) Mar 26 '18 at 17:09

Let's say we have a ciphertext of length $(N-1)B < n < NB$, for $B$ the blocksize at hand (typically 128 for AES), where the ciphertext is made with $C_1, C_2, C_3, C_4$, with $C_3$ being shorter that the rest.

In order to decrypt a ciphertext made using ciphertext stealing as you drafted, you have to:

1. Decrypt the ciphertext just like you would for CBC without ciphertext stealing for the $N-2$ first blocks.
2. Take the latest two blocks ($C_3, C_4$ in your example), and compute the length of the "stolen" ciphertext by computing $n-(N-1)B=a$ and deducing its length $B-a$.
3. Decrypt the latest block, e.g. $C_4$ into its unencrypted value $E_4$
4. Xor $E_4$ with the concatenation of $C_3$ and $B-a$ 0s like $C_3 | \underbrace{0\cdots 0}_{B-a}$, to obtain $M_4 | C'_3$
5. Take the last $B-a$ bits of it, which is $C'_3$ and concatenate it with $C_3$, which you can finally decrypt just like you would usually.

I've committed a cri diagram, using the same colors as you, hope this helps:

Notice that this is assuming the same construction as you used in your graphic. (There are other ways to do it, too.)

• thank you so much very clear explanation and great graph Mar 26 '18 at 19:23