ciphertext block using ECB mode. Cn = Cn || Tail (Dn, B−M). Pad the ciphertext to the nearest multiple of the block size using the last B−M bits of block cipher decryption of the second-to-last ciphertext block. Swap the last two ciphertext blocks. Decrypt the (modified) ciphertext using the standard CBC mode. Truncate the plaintext to the length of the original ciphertext. CBC ciphertext stealing error propagation A bit error in the transmission of Cn−1 would result in the block-wide corruption of both Pn−1 and Pn. A bit error in the transmission of Cn would result in a corresponding bit error in Pn, and in the block-wide corruption of Pn−1. References Cryptographic algorithms