NIST SP 800-38A Addendum 日本語訳

• The block size of the underlying block cipher is denoted \(b\).

• For a bit string \(X\), the bit length of \(X\) is denoted \(\operatorname{len}(X)\).

• For a bit string \(X\) and a positive integer \(r\) that does not exceed \(\operatorname{len}(X)\), the string consisting of the leftmost \(r\) bits of \(X\) is denoted \(\mathrm{MSB}_r(X)\), and the string consisting of the rightmost \(r\) bits of \(X\) is denoted \(\mathrm{LSB}_r(X)\).

• For an input block \(B\) and key \(K\), the output block of the cipher function (“encryption”) is denoted \(\mathrm{CIPH}_K(B)\), and the output block of the inverse cipher function (“decryption”) is denoted \(\mathrm{CIPH}^{-1}_K(B)\).

Input: plaintext \(P\), such that \(\operatorname{len}(P)\) is valid;
initialization vector \(\mathit{IV}\);
key \(K\).

Output: ciphertext \(C\), such that \(\operatorname{len}(C)=\operatorname{len}(P)\).

1. Let \(n\) be the smallest integer such that \(n\cdot b\ge \operatorname{len}(P)\), let \(d=\operatorname{len}(P)-(n-1)\cdot b\), and let \(P_1, P_2, \ldots, P_{n-1}, P_n^{*}\) be the unique sequence of bit strings such that:
a) \(P=P_1\parallel P_2\parallel\ldots\parallel P_{n-1}\parallel P_n^{*}\); and
b) \(P_1, P_2, \ldots\) and \(P_{n-1}\) are complete blocks.
Consequently, \(\operatorname{len}(P_n^{*})=d\), and \(1\le d\le b\), so that \(P_n^{*}\) is either a complete block or a nonempty partial block.

2. Let \(\mathit{PAD}\) be the bit string consisting of \(b-d\) ‘0’ bits, and let \(P_n=P_n^{*}\parallel\mathit{PAD}\). Note that if \(P_n^{*}\) is a complete block, then \(\mathit{PAD}\) is the empty string, and \(P_n=P_n^{*}\).

3. Apply CBC encryption to the plaintext \((P_1, P_2, \ldots P_{n-1}, P_n)\) with initialization vector \(\mathit{IV}\) and key \(K\) to produce \((C_1, C_2, \ldots C_{n-1}, C_n)\).

4. Let \(C_{n-1}^{*}=\mathrm{MSB}_d(C_{n-1})\).

5. Return \(C_1\parallel C_2\parallel\ldots\parallel C_{n-2}\parallel C_{n-1}^{*}\parallel C_n\).

When \(P_n^{*}\) is a complete block, CBC-CS1-Encrypt is equivalent to CBC encryption.

Diagram: Figure 1 below illustrates the CBC-CS1-Encrypt algorithm for the case that \(P_n^{*}\) is a partial block, i.e., \(d<b\). The bolded rectangles contain the inputs and outputs. The dotted rectangles provide alternate representations of two blocks in order to illustrate the role of the “stolen” ciphertext.

In particular, the string of the \(b-d\) rightmost bits of \(C_{n-1}\), denoted \(C_{n-1}^{**}\), becomes the padding for the input block to the final invocation of the block cipher within the execution of CBC mode. The ciphertext that is returned in Step 5 above omits \(C_{n-1}^{**}\), because it can be recovered from \(C_n\) during decryption.

Input: ciphertext \(C\), such that \(\operatorname{len}(C)\) is valid;
initialization vector \(\mathit{IV}\);
key \(K\).

Output: plaintext \(P\), such that \(\operatorname{len}(P)=\operatorname{len}(C)\).

1. Let \(n\) be the smallest integer such that \(n\cdot b\ge\operatorname{len}(C)\), let \(d=\operatorname{len}(C)-(n-1)\cdot b\), and let \(C_1, C_2, \ldots, C_{n-2}, C_{n-1}^{*}, C_n\) be the unique sequence of bit strings such that a) \(C=C_1\parallel C_2\parallel\ldots\parallel C_{n-2}\parallel C_{n-1}^{*}\parallel C_n\); b) \(C_n\) is a complete block; and c) if \(n>2\), then \(C_1,\ldots,C_{n-2}\), are complete blocks. Consequently, \(\operatorname{len}(C_{n-1}^{*})=d\), and \(1\le d\le b\), so that \(C_{n-1}^{*}\) is either a complete block or a nonempty partial block.

2. Let \(Z^{*}=\mathrm{MSB}_d(\mathrm{CIPH}_K^{-1}(C_n))\), and \(Z^{**}=\mathrm{LSB}_{b-d}(\mathrm{CIPH}_K^{-1}(C_n))\).

3. Let \(C_{n-1}=C_{n-1}^{*}\parallel Z^{**}\). Note that if \(C_{n-1}^{*}\) is a complete block, then \(Z^{**}\) is the empty string, and \(C_{n-1}=C_{n-1}^{*}\).

4. Apply CBC decryption to \((C_1, C_2, \ldots, C_{n-1})\) with initialization vector \(\mathit{IV}\) and key \(K\) to produce \((P_1, P_2, \ldots P_{n-1})\).

5. Let \(P_n^{*}=\mathrm{C}_{n-1}^{*}\oplus Z^{*}\).

6. Return \(P_1\parallel P_2\parallel\ldots\parallel P_{n-1}\parallel P_n^{*}\).

When \(C_{n-1}^{*}\) is a complete block, CBC-CS1-Decrypt is equivalent to CBC decryption.

Diagram: Figure 2 below illustrates the CBC-CS1-Decrypt algorithm for the case that \(C_{n-1}^{*}\) is a partial block, i.e., \(d<b\). As in the previous diagram, the bolded rectangles contain the inputs and outputs.

Input: plaintext \(P\), such that \(\operatorname{len}(P)\) is valid;
initialization vector \(\mathit{IV}\);
key \(K\).

Output: ciphertext \(C\), such that \(\operatorname{len}(C)=\operatorname{len}(P)\).

1. Let \(n\) be the smallest integer such that \(n\cdot b\ge \operatorname{len}(P)\), let \(d=\operatorname{len}(P)-(n-1)\cdot b\), and let \(P_1, P_2, \ldots, P_{n-1}, P_n^{*}\) be the unique sequence of bit strings such that:
a) \(P=P_1\parallel P_2\parallel\ldots\parallel P_{n-1}\parallel P_n^{*}\); and
b) \(P_1, P_2, \ldots\) and \(P_{n-1}\) are complete blocks.
Consequently, \(\operatorname{len}(P_n^{*})=d\), and \(1\le d\le b\), so that \(P_n^{*}\) is either a complete block or a nonempty partial block.

2. Apply CBC-CS1-Encrypt to the plaintext \(P\) with initialization vector \(\mathit{IV}\) and key \(K\) to produce \(C_1\parallel C_2\parallel\ldots\parallel C_{n-2}\parallel C_{n-1}^{*}\parallel C_n\).

3. If \(d=b\), return \(C_1\parallel C_2\parallel\ldots\parallel C_{n-2}\parallel C_{n-1}^{*}\parallel C_n\); if \(d<b\), return \(C_1\parallel C_2\parallel\ldots\parallel C_{n-2}\parallel C_n\parallel C_{n-1}^{*}\).

When \(P_n^{*}\) is a complete block, then CBC-CS2-Encrypt, like CBC-CS1-Encrypt, is equivalent to CBC encryption. When \(P_n^{*}\) is a partial block, then CBC-CS2-Encrypt and CBC-CS1-Encrypt differ only in the ordering of \(C_{n-1}^{*}\) and \(C_n\).

Input: ciphertext \(C\), such that \(\operatorname{len}(C)\) is valid;
initialization vector \(\mathit{IV}\);
key \(K\).

Output: plaintext \(P\), such that \(\operatorname{len}(P)=\operatorname{len}(C)\).

1. Let \(n\) be the smallest integer such that \(n\cdot b\ge \operatorname{len}(C)\), let \(d=\operatorname{len}(C)-(n-1)\cdot b\), and let \(C_1, C_2, \ldots, C_{n-2}, C_{n-1}, \mathrm{C}_n^{*}\) be the unique sequence of bit strings such that
a) \(C=C_1\parallel C_2\parallel\ldots\parallel C_{n-2}\parallel C_{n-1}\parallel C_n^{*}\);
b) \(C_{n-1}\) is a complete block; and
c) If \(n>2\), then \(C_1,\ldots,C_{n-2}\), are complete blocks.
Consequently, \(\operatorname{len}(C_n^{*})=d\), and \(1\le d\le b\), so that \(C_n^{*}\) is either a complete block or a nonempty partial block.

2. If \(d=b\), i.e., \(C_n^{*}\) is a complete block, then apply CBC-CS1-Decrypt to \(C\) with initialization vector \(\mathit{IV}\) and key \(K\), and return the result, \(P\). STOP.

3. If \(d<b\), i.e., \(C_n^{*}\) is a partial block, then let \(\mathrm{C}'=C_1\parallel C_2\parallel\ldots\parallel C_{n-2}\parallel C_n^{*}\parallel C_{n-1}\).

4. Apply CBC-CS1-Decrypt to \(\mathrm{C}'\), and return the result, \(P\).

Note that in Step 3, \(C_n^{*}\) precedes \(C_{n-1}\) in order to undo the corresponding swap within the ciphertext in Step 3 of CBC-CS2-Encrypt.

Input: plaintext \(P\), such that \(\operatorname{len}(P)\) is valid; initialization vector \(\mathit{IV}\); key \(K\).

Output: ciphertext \(C\), such that \(\operatorname{len}(C)=\operatorname{len}(P)\).

1. Apply CBC-CS1-Encrypt to the plaintext \(P\) with initialization vector \(\mathit{IV}\) and key \(K\) to produce \(C_1 \parallel C_2 \parallel \ldots \parallel C_{n-2} \parallel C_{n-1}^{*} \parallel C_n\).

2. Return \(C_1 \parallel C_2 \parallel \ldots \parallel C_{n-2} \parallel C_n \parallel C_{n-1}^{*}\).

Note that in Step 2, \(C_{n-1}^{*}\) and \(C_n\) are unconditionally swapped, i.e., even when \(C_{n-1}^{*}\) is a complete block; therefore, CBC-CS3 is not strictly an extension of CBC mode. In the other case, i.e., when \(C_{n-1}^{*}\) is a nonempty partial block, CBC-CS3-Encrypt is equivalent to CBC-CS2-Encrypt.

Input: ciphertext \(C\), such that \(\operatorname{len}(C)\) is valid; initialization vector \(\mathit{IV}\); key \(K\).

Output: plaintext \(P\), such that \(\operatorname{len}(P)=\operatorname{len}(C)\).

1. Let \(n\) be the smallest integer such that \(n\cdot b\ge\operatorname{len}(C)\), let \(d=\operatorname{len}(C)-(n-1)\cdot b\), and let \(C_1, C_2, \ldots, C_{n-2}, C_{n-1}, C_n^{*}\) be the unique sequence of bit strings such that a) \(C=C_1\parallel C_2\parallel\ldots\parallel C_{n-2}\parallel C_{n-1}\parallel C_n^{*}\); b) \(C_{n-1}\) is a complete block; and c) If \(n>2\), then \(C_1,\ldots,C_{n-2}\), are complete blocks. Consequently, \(\operatorname{len}(C_n^{*})=d\), and \(1\le d\le b\), so that \(C_n^{*}\) is either a complete block or a nonempty partial block.

2. Apply the CBC-CS1-Decrypt algorithm with initialization vector \(\mathit{IV}\) and key \(K\) to \(C_1\parallel C_2\parallel\ldots\parallel C_{n-2}\parallel C_n^{*}\parallel C_{n-1}\), and return the result, \(P\).

Note that in Step 2, \(C_n^{*}\) precedes \(C_{n-1}\) in order to undo the corresponding swap that was performed within Step 2 of CBC-CS3-Encrypt.