ciphertext = C1 || C3 || C2