Editing Ciphertext stealing (section)

====CBC implementation notes====
For CBC ciphertext stealing, there is a clever (but opaque) method of implementing the described ciphertext stealing process using a standard CBC interface.  Using this method imposes a performance penalty in the decryption stage of one extra block decryption operation over what would be necessary using a dedicated implementation.

=====CBC ciphertext stealing encryption using a standard CBC interface=====
# Pad the last partial plaintext block with 0.
# Encrypt the whole padded plaintext using the standard CBC mode.
# Swap the last two ciphertext blocks.
# Truncate the ciphertext to the length of the original plaintext.
[[Image:CipherText Stealing (CTS) on CBC, encryption mode.svg|center|CipherText Stealing (CTS) on CBC, encryption mode]]

=====CBC ciphertext stealing decryption using a standard CBC interface=====
# ''D''<sub>''n''</sub> = Decrypt (''K'', ''C''<sub>''n''−1</sub>).  Decrypt the second-to-last ciphertext block using ECB mode.
# ''C''<sub>''n''</sub> = ''C''<sub>''n''</sub> || Tail (''D''<sub>''n''</sub>, ''B''−''M'').  Pad the ciphertext to the nearest multiple of the block size using the last ''B''−''M'' bits of block cipher decryption of the second-to-last ciphertext block.
# Swap the last two ciphertext blocks.
# Decrypt the (modified) ciphertext using the standard CBC mode.
# Truncate the plaintext to the length of the original ciphertext.
[[Image:CipherText Stealing (CTS) on CBC, decryption mode.svg|center|CipherText Stealing (CTS) on CBC, decryption mode]]