Шифрмәнді ұрлау әдісі: Блок шифрінің жұмыс режимі

In cryptography, ciphertext stealing (CTS) is a general method of using a block cipher mode of operation that allows for processing of messages that are not evenly divisible into blocks without resulting in any expansion of the ciphertext, at the cost of slightly increased complexity.

There are several different ways to arrange the ciphertext for transmission. The ciphertext bits are the same in all cases, just transmitted in a different order, so the choice has no security implications; it is purely one of implementation convenience. The numbering here is taken from Dworkin, who describes them all. The third is the most popular, and described by Daemen and Schneier; Meyer describes a related, but incompatible scheme (with respect to bit ordering and key use).

It is often more convenient to swap the final two ciphertext blocks, so the ciphertext ends with the full final block, followed by the truncated penultimate block. This results in naturally aligned ciphertext blocks. In order to maintain compatibility with the non stealing modes, option CS2 performs this swap only if the amount of stolen ciphertext is non zero, i. e. the original message was not a multiple of the block size. This maintains natural alignment, and compatibility with the non stealing modes, but requires treating the cases of aligned and unaligned message size differently.

The most popular alternative swaps the final two ciphertext blocks unconditionally. This is the ordering used in the descriptions below.

Ciphertext stealing in ECB mode introduces an inter block dependency within the last two blocks, resulting in altered error propagation behavior for the last two blocks.

En−1 = Encrypt (K, Pn−1). Encrypt Pn−1 to create En−1. This is equivalent to the behavior of standard ECB mode. Cn = Head (En−1, M). Select the first M bits of En−1 to create Cn. The final ciphertext block, Cn, is composed of the leading M bits of the second to last ciphertext block. In all cases, the last two blocks are sent in a different order than the corresponding plaintext blocks. Dn = Pn || Tail (En−1, B−M). Pad Pn with the low order bits from En−1. Cn−1 = Encrypt (K, Dn). Encrypt Dn to create Cn−1. For the first M bits, this is equivalent to what would happen in ECB mode (other than the ciphertext ordering). For the last B−M bits, this is the second time that these data have been encrypted under this key (It was already encrypted in the production of En−1 in step 2).

Dn = Decrypt (K, Cn−1). Decrypt Cn−1 to create Dn. This undoes step 4 of the encryption process. En−1 = Cn || Tail (Dn, B−M). Pad Cn with the extracted ciphertext in the tail end of Dn (placed there in step 3 of the ECB encryption process). Pn = Head (Dn, M). Select the first M bits of Dn to create Pn. As described in step 3 of the ECB encryption process, the first M bits of Dn contain Pn. We queue this last (possibly partial) block for eventual output. Pn−1 = Decrypt (K, En−1). Decrypt En−1 to create Pn−1. This reverses encryption step 1.

A bit error in the transmission of Cn−1 would result in the block wide corruption of both Pn−1 and Pn. A bit error in the transmission of Cn would result in the block wide corruption of Pn−1. This is a significant change from ECB's error propagation behavior.

In CBC, there is already interaction between processing of different adjacent blocks, so CTS has less conceptual impact in this mode. Error propagation is affected.

Xn−1 = Pn−1 XOR Cn−2. Exclusive OR Pn−1 with the previous ciphertext block, Cn−2, to create Xn−1. This is equivalent to the behavior of standard CBC mode. En−1 = Encrypt (K, Xn−1). Encrypt Xn−1 to create En−1. This is equivalent to the behavior of standard CBC mode. Cn = Head (En−1, M). Select the first M bits of En−1 to create Cn. The final ciphertext block, Cn, is composed of the leading M bits of the second to last ciphertext block. In all cases, the last two blocks are sent in a different order than the corresponding plaintext blocks. P = Pn || 0B−M. Pad Pn with zeros at the end to create P of length B. The zero padding in this step is important for step 5. Dn = En−1 XOR P. Exclusive OR En−1 with P to create Dn. For the first M bits of the block, this is equivalent to CBC mode; the first M bits of the previous block's ciphertext, En−1, are XORed with the M bits of plaintext of the last plaintext block. The zero padding of P in step 4 was important, because it makes the XOR operation's effect on the last B−M bits equivalent to copying the last B−M bits of En−1 to the end of Dn. These are the same bits that were stripped off of En−1 in step 3 when Cn was created. Cn−1 = Encrypt (K, Dn). Encrypt Dn to create Cn−1. For the first M bits, this is equivalent to what would happen in CBC mode (other than the ciphertext ordering). For the last B−M bits, this is the second time that these data have been encrypted under this key (It was already encrypted in the production of En−1 in step 2).

Dn = Decrypt (K, Cn−1). Decrypt Cn−1 to create Dn. This undoes step 6 of the encryption process. C = Cn || 0B−M. Pad Cn with zeros at the end to create a block C of length B. We are padding Cn with zeros to help in step 3. Xn = Dn XOR C. Exclusive OR Dn with C to create Xn. Looking at the first M bits, this step has the result of XORing Cn (the first M bits of the encryption process' En−1) with the (now decrypted) Pn XOR Head (En−1, M) (see steps 4 5 of the encryption process). In other words, we have CBC decrypted the first M bits of Pn. Looking at the last B−M bits, this recovers the last B−M bits of En−1. Pn = Head (Xn, M). Select the first M bits of Xn to create Pn. As described in step 3, the first M bits of Xn contain Pn. We queue this last (possibly partial) block for eventual output. En−1 = Cn || Tail (Xn, B−M). Append the tail (B−M) bits of Xn to Cn to create En−1. As described in step 3, En−1 is composed of all of Cn (which is M bits long) appended with the last B−M bits of Xn. We reassemble En−1 (which is the same En−1 seen in the encryption process) for processing in step 6. Xn−1 = Decrypt (K, En−1). Decrypt En−1 to create Xn−1. This reverses encryption step 2. Xn−1 is the same as in the encryption process. Pn−1 = Xn−1 XOR Cn−2. Exclusive OR Xn−1 with the previous ciphertext block, Cn−2, to create Pn−1. Finally, we reverse the XOR step from step 1 of the encryption process.

For CBC ciphertext stealing, there is a clever (but opaque) method of implementing the described ciphertext stealing process using a standard CBC interface. Using this method imposes a performance penalty in the decryption stage of one extra block decryption operation over what would be necessary using a dedicated implementation.

Pad the last partial plaintext block with 0. Encrypt the whole padded plaintext using the standard CBC mode. Swap the last two ciphertext blocks. Truncate the ciphertext to the length of the original plaintext.

Dn = Decrypt (K, Cn−1). Decrypt the second to last ciphertext block using ECB mode. Cn = Cn || Tail (Dn, B−M). Pad the ciphertext to the nearest multiple of the block size using the last B−M bits of block cipher decryption of the second to last ciphertext block. Swap the last two ciphertext blocks. Decrypt the (modified) ciphertext using the standard CBC mode. Truncate the plaintext to the length of the original ciphertext.

A bit error in the transmission of Cn−1 would result in the block wide corruption of both Pn−1 and Pn. A bit error in the transmission of Cn would result in a corresponding bit error in Pn, and in the block wide corruption of Pn−1.