Home > Ciphertext stealing

1 Encryption procedure

• If the plaintext length is not a multiple of the block size, pad it with enough zero bits until it is.
• Encrypt the plaintext using the Cipher Block Chaining mode.
• Swap the last two ciphertext blocks.
• Truncate the ciphertext to the length of the original plaintext.

2 Decryption procedure

• If the ciphertext length is not a multiple of the block size, say it is n bits short, then pad it with the last n bits of the block cipher decryption of the last full ciphertext block.
• Swap the last two ciphertext blocks.
• Decrypt the ciphertext using the Cipher Block Chaining mode.
• Truncate the plaintext to the length of the original ciphertext.

Proof that this decryption procedure really is the inverse of the encryption procedure is left as an exercise for the reader.

While it is an interesting mechanism to avoid padding, ciphertext stealing does not appear to be widely used. This is probably because much simpler solutions are available, such as using the block cipher in counter mode (CTR), or using a stream cipher.

Ciphertext stealing also requires the plaintext to be longer than one block. A workaround is to use a different mode of encryption when the plaintext length is one block or less, such as XORing the plaintext with block cipher encryption of the IV.