ciphertext=C1||C3||C2...