ciphertext = C1 || C3 || C2 ...