of En−1 in step 2). CBC decryption steps Dn = Decrypt (K, Cn−1). Decrypt Cn−1 to create Dn. This undoes step 6 of the encryption process. C = Cn || 0B−M. Pad Cn with zeros at the end to create a block C of length B. We are padding Cn with zeros to help in step 3. Xn = Dn XOR C. Exclusive-OR Dn with C to create Xn. Looking at the first M bits, this step has the result of XORing Cn (the first M bits of the encryption process' En−1) with the (now decrypted) Pn XOR Head (En−1, M) (see steps 4-5 of the encryption process). In other words, we have CBC decrypted the first M bits of Pn. Looking at the last B−M bits, this recovers the last B−M bits of En−1. Pn = Head (Xn, M). Select the first M bits of Xn to create Pn. As described in step 3, the first M bits of Xn contain Pn. We queue this last (possibly partial) block for eventual output. En−1 = Cn || Tail (Xn, B−M). Append the tail (B−M) bits of Xn to Cn to create En−1. As described in step 3, En−1 is composed of all of Cn (which is M bits long) appended with the last B−M bits of Xn. We reassemble En−1 (which is the same En−1 seen in the encryption process) for processing in step 6. Xn−1 = Decrypt (K, En−1). Decrypt En−1 to create Xn−1. This reverses encryption step 2. Xn−1 is the same as in the encryption process. Pn−1 = Xn−1 XOR Cn−2. Exclusive-OR Xn−1 with the previous ciphertext block, Cn−2, to create Pn−1. Finally, we reverse the XOR step from step 1 of the encryption process. CBC implementation notes For CBC ciphertext stealing, there is a clever (but opaque) method of implementing the described ciphertext stealing process using a standard CBC interface. Using this method imposes a performance penalty in the decryption stage of one extra block decryption operation over what would be necessary using a dedicated implementation. CBC ciphertext stealing encryption using a standard CBC interface Pad the last partial plaintext block with 0. Encrypt the whole padded plaintext using the standard CBC mode. Swap the last two ciphertext blocks. Truncate the ciphertext to the length of the original plaintext. CBC ciphertext stealing decryption using a standard CBC interface Dn = Decrypt (K, Cn−1). Decrypt the second-to-last