Skip to main content
3 of 3
added pkcs7 tag
SEJPM
  • 46.4k
  • 9
  • 102
  • 210

Strength of CBC with Ciphertext Stealing

Is CBC with Ciphertext Stealing (CTS) considerably weaker than CBC with padding such as PKCS7?

I would imagine the most common situation where CTS is necessary would be due to some size constraint of an existing system, and redesign of the system is inconvenient. So, while it clearly reveals the length of the encrypted data, (in general) is this a significant enough weakness such that CTS should always be avoided?

I've read through the addendum to NIST SP800 38A on CTS variants, and while one could perhaps take this NIST recommendation as tacit approval of CTS's relative safety, there's no real mention of any weakness considerations and I've not been able to find any resources speaking directly to this topic.

Syon
  • 183
  • 1
  • 5