ECB encryption process, the first M bits of Dn contain Pn. We queue this last (possibly partial) block for eventual output. Pn−1 = Decrypt (K, En−1). Decrypt En−1 to create Pn−1. This reverses encryption step 1. ECB ciphertext stealing error propagation A bit error in the transmission of Cn−1 would result in the block-wide corruption of both Pn−1 and Pn. A bit error in the transmission of Cn would result in the block-wide corruption of Pn−1. This is a significant change from ECB's error propagation behavior. CBC ciphertext stealing In CBC, there is already interaction between processing of different adjacent blocks, so CTS has less conceptual impact in this mode. Error propagation is affected. CBC encryption steps Xn−1 = Pn−1 XOR Cn−2. Exclusive-OR Pn−1 with the previous ciphertext block, Cn−2, to create Xn−1. This is equivalent to the behavior of standard CBC mode. En−1 = Encrypt (K, Xn−1). Encrypt Xn−1 to create En−1. This is equivalent to the behavior of standard CBC mode. Cn = Head (En−1, M). Select the first M bits of En−1 to create Cn. The final ciphertext block, Cn, is composed of the leading M bits of the second-to-last ciphertext block. In all cases, the last two blocks are sent in a different order than the corresponding plaintext blocks. P = Pn || 0B−M. Pad Pn with zeros at the end to create P of length B. The zero padding in this step is important for step 5. Dn = En−1 XOR P. Exclusive-OR En−1 with P to create Dn. For the first M bits of the block, this is equivalent to CBC mode; the first M bits of the previous block's ciphertext, En−1,are XORed with the M bits of plaintext of the last plaintext block. The zero padding of P in step 4 was important, because it makes the XOR operation's effect on the last B−M bits equivalent to copying the last B−M bits of En−1 to the end of Dn. These are the same bits that were stripped off of En−1 in step 3 when Cn was created. Cn−1 = Encrypt (K, Dn). Encrypt Dn to create Cn−1. For the first M bits, this is equivalent to what would happen in CBC mode (other than the ciphertext ordering). For the last B−M bits, this is the second time that these data have been encrypted under this key (It was already encrypted in the production