Editing Ciphertext stealing (section)

===ECB ciphertext stealing===
Ciphertext stealing in ECB mode introduces an inter-block dependency within the last two blocks, resulting in altered error propagation behavior for the last two blocks.

====ECB encryption steps (see figure) ====
[[Image:CTS ECB Encryption.png|frame|right|ECB Encryption Steps for CTS]]
# ''E''<sub>''n''−1</sub> = Encrypt (''K'', ''P''<sub>''n''−1</sub>).  Encrypt ''P''<sub>''n''−1</sub> to create ''E''<sub>''n''−1</sub>.   This is equivalent to the behavior of standard ECB mode.
# ''C''<sub>''n''</sub> = Head (''E''<sub>''n''−1</sub>, ''M''). Select the first ''M'' bits of ''E''<sub>''n''−1</sub> to create ''C''<sub>''n''</sub>.  The final ciphertext block, ''C''<sub>''n''</sub>, is composed of the leading ''M'' bits of the second-to-last ciphertext block.  In all cases, the last two blocks are sent in a different order than the corresponding plaintext blocks.
# ''D''<sub>''n''</sub> = ''P''<sub>''n''</sub> || Tail (''E''<sub>''n''−1</sub>, ''B''−''M'').  Pad ''P''<sub>''n''</sub> with the low order bits from ''E''<sub>''n''−1</sub>.
# ''C''<sub>''n''−1</sub> = Encrypt (''K'', ''D''<sub>''n''</sub>).  Encrypt ''D''<sub>''n''</sub> to create ''C''<sub>''n''−1</sub>.  For the first ''M'' bits, this is equivalent to what would happen in ECB mode (other than the ciphertext ordering).  For the last ''B''−''M'' bits, this is the second time that these data have been encrypted under this key (It was already encrypted in the production of ''E''<sub>''n''−1</sub> in step 2).

====ECB decryption steps====
# ''D''<sub>''n''</sub> = Decrypt (''K'', ''C''<sub>''n''−1</sub>).  Decrypt ''C''<sub>''n''−1</sub> to create ''D''<sub>''n''</sub>.  This undoes step 4 of the encryption process.
# ''E''<sub>''n''−1</sub> = ''C''<sub>''n''</sub> || Tail (''D''<sub>''n''</sub>, ''B''−''M'').  Pad ''C''<sub>''n''</sub> with the extracted ciphertext in the tail end of ''D''<sub>''n''</sub> (placed there in step 3 of the ECB encryption process).
# ''P''<sub>''n''</sub> = Head (''D''<sub>''n''</sub>, ''M'').  Select the first ''M'' bits of ''D''<sub>''n''</sub> to create ''P''<sub>''n''</sub>.  As described in step 3 of the ECB encryption process, the first ''M'' bits of ''D''<sub>''n''</sub> contain ''P''<sub>''n''</sub>.  We queue this last (possibly partial) block for eventual output.
# ''P''<sub>''n''−1</sub> = Decrypt (''K'', ''E''<sub>''n''−1</sub>).  Decrypt ''E''<sub>''n''−1</sub> to create ''P''<sub>''n''−1</sub>.  This reverses encryption step 1.

====ECB ciphertext stealing error propagation====
A bit error in the transmission of ''C''<sub>''n''−1</sub> would result in the block-wide corruption of both ''P''<sub>''n''−1</sub> and ''P''<sub>''n''</sub>.
A bit error in the transmission of ''C''<sub>''n''</sub> would result in the block-wide corruption of ''P''<sub>''n''−1</sub>.  This is a significant change from ECB's error propagation behavior.