document_title: Block cipher

question_text: what is the primary weakness of the des block cipher

question_tokens: what is the primary weakness of the des block cipher

text: Block cipher

text: Definition[edit]

text: A block cipher consists of two paired algorithms, one for encryption, E, and the other for decryption, D.[4] Both algorithms accept two inputs: an input block of size n bits and a key of size k bits; and both yield an n-bit output block. The decryption algorithm D is defined to be the inverse function of encryption, i.e., D = E−1. More formally,[5][6] a block cipher is specified by an encryption function

text: which takes as input a key K of bit length k, called the key size, and a bit string P of length n, called the block size, and returns a string C of n bits. P is called the plaintext, and C is termed the ciphertext. For each K, the function EK(P) is required to be an invertible mapping on {0,1}n. The inverse for E is defined as a function

text: taking a key K and a ciphertext C to return a plaintext value P, such that

text: For example, a block cipher encryption algorithm might take a 128-bit block of plaintext as input, and output a corresponding 128-bit block of ciphertext. The exact transformation is controlled using a second input – the secret key. Decryption is similar: the decryption algorithm takes, in this example, a 128-bit block of ciphertext together with the secret key, and yields the original 128-bit block of plain text.[7]

text:
For each key K, EK is a permutation (a bijective mapping) over the set of input blocks. Each key selects one permutation from the set of

(

2

n

)
!

{\displaystyle (2^{n})!}

 possible permutations.[8]

text: Design[edit]

text: Iterated block ciphers[edit]

text: Most block cipher algorithms are classified as iterated block ciphers which means that they transform fixed-size blocks of plaintext into identical size blocks of ciphertext, via the repeated application of an invertible transformation known as the round function, with each iteration referred to as a round.[9]

text: Usually, the round function R takes different round keys Ki as second input, which are derived from the original key:[citation needed]

text:
where

M

0

{\displaystyle M_{0}}

 is the plaintext and

M

r

{\displaystyle M_{r}}

 the ciphertext, with r being the number of rounds.

text: Frequently, key whitening is used in addition to this. At the beginning and the end, the data is modified with key material (often with XOR, but simple arithmetic operations like adding and subtracting are also used):[citation needed]

text: Given one of the standard iterated block cipher design schemes, it is fairly easy to construct a block cipher that is cryptographically secure, simply by using a large number of rounds. However, this will make the cipher inefficient. Thus, efficiency is the most important additional design criterion for professional ciphers. Further, a good block cipher is designed to avoid side-channel attacks, such as input-dependent memory accesses that might leak secret data via the cache state or the execution time. In addition, the cipher should be concise, for small hardware and software implementations. Finally, the cipher should be easily cryptanalyzable, such that it can be shown how many rounds the cipher needs to be reduced to, so that the existing cryptographic attacks would work – and, conversely, that it can be shown that the number of actual rounds is large enough to protect against them.[citation needed]

text: Substitution–permutation networks[edit]

text: One important type of iterated block cipher known as a substitution–permutation network (SPN) takes a block of the plaintext and the key as inputs, and applies several alternating rounds consisting of a substitution stage followed by a permutation stage—to produce each block of ciphertext output.[10] The non-linear substitution stage mixes the key bits with those of the plaintext, creating Shannon's confusion. The linear permutation stage then dissipates redundancies, creating diffusion.[11][12]

text: A substitution box (S-box) substitutes a small block of input bits with another block of output bits. This substitution must be one-to-one, to ensure invertibility (hence decryption). A secure S-box will have the property that changing one input bit will change about half of the output bits on average, exhibiting what is known as the avalanche effect—i.e. it has the property that each output bit will depend on every input bit.[13]

text: A permutation box (P-box) is a permutation of all the bits: it takes the outputs of all the S-boxes of one round, permutes the bits, and feeds them into the S-boxes of the next round. A good P-box has the property that the output bits of any S-box are distributed to as many S-box inputs as possible.[citation needed]

text: At each round, the round key (obtained from the key with some simple operations, for instance, using S-boxes and P-boxes) is combined using some group operation, typically XOR.[citation needed]

text: Decryption is done by simply reversing the process (using the inverses of the S-boxes and P-boxes and applying the round keys in reversed order).[citation needed]

text: Feistel ciphers[edit]

text: In a Feistel cipher, the block of plain text to be encrypted is split into two equal-sized halves. The round function is applied to one half, using a subkey, and then the output is XORed with the other half. The two halves are then swapped.[14]

text:
Let

F

{\displaystyle {\rm {F}}}

 be the round function and let

K

0

,

K

1

,
…
,

K

n

{\displaystyle K_{0},K_{1},\ldots ,K_{n}}

 be the sub-keys for the rounds

0
,
1
,
…
,
n

{\displaystyle 0,1,\ldots ,n}

 respectively.

text: Then the basic operation is as follows:[14]

text:
Split the plaintext block into two equal pieces, (

L

0

{\displaystyle L_{0}}

,

R

0

{\displaystyle R_{0}}

)

text:
For each round

i
=
0
,
1
,
…
,
n

{\displaystyle i=0,1,\dots ,n}

, compute

text:
Then the ciphertext is

(

R

n
+
1

,

L

n
+
1

)

{\displaystyle (R_{n+1},L_{n+1})}

.

text:
Decryption of a ciphertext

(

R

n
+
1

,

L

n
+
1

)

{\displaystyle (R_{n+1},L_{n+1})}

 is accomplished by computing for

i
=
n
,
n
−
1
,
…
,
0

{\displaystyle i=n,n-1,\ldots ,0}

text:
Then

(

L

0

,

R

0

)

{\displaystyle (L_{0},R_{0})}

 is the plaintext again.

text:
One advantage of the Feistel model compared to a substitution–permutation network is that the round function

F

{\displaystyle {\rm {F}}}

 does not have to be invertible.[15]

text: Lai–Massey ciphers[edit]

text:
The Lai–Massey scheme offers security properties similar to those of the Feistel structure. It also shares its advantage that the round function

F

{\displaystyle \mathrm {F} }

 does not have to be invertible. Another similarity is that is also splits the input block into two equal pieces. However, the round function is applied to the difference between the two, and the result is then added to both half blocks.

text:
Let

F

{\displaystyle \mathrm {F} }

 be the round function and

H

{\displaystyle \mathrm {H} }

 a half-round function and let

K

0

,

K

1

,
…
,

K

n

{\displaystyle K_{0},K_{1},\ldots ,K_{n}}

 be the sub-keys for the rounds

0
,
1
,
…
,
n

{\displaystyle 0,1,\ldots ,n}

 respectively.

text: Then the basic operation is as follows:

text:
where

T

i

=

F

(

L

i

′

−

R

i

′

,

K

i

)

{\displaystyle T_{i}=\mathrm {F} (L_{i}'-R_{i}',K_{i})}

 and

(

L

0

′

,

R

0

′

)
=

H

(

L

0

,

R

0

)

{\displaystyle (L_{0}',R_{0}')=\mathrm {H} (L_{0},R_{0})}

text:
Then the ciphertext is

(

L

n
+
1

,

R

n
+
1

)
=
(

L

n
+
1

′

,

R

n
+
1

′

)

{\displaystyle (L_{n+1},R_{n+1})=(L_{n+1}',R_{n+1}')}

.

text:
Decryption of a ciphertext

(

L

n
+
1

,

R

n
+
1

)

{\displaystyle (L_{n+1},R_{n+1})}

 is accomplished by computing for

i
=
n
,
n
−
1
,
…
,
0

{\displaystyle i=n,n-1,\ldots ,0}

text:
where

T

i

=

F

(

L

i
+
1

′

−

R

i
+
1

′

,

K

i

)

{\displaystyle T_{i}=\mathrm {F} (L_{i+1}'-R_{i+1}',K_{i})}

 and

(

L

n
+
1

′

,

R

n
+
1

′

)
=

H

−
1

(

L

n
+
1

,

R

n
+
1

)

{\displaystyle (L_{n+1}',R_{n+1}')=\mathrm {H} ^{-1}(L_{n+1},R_{n+1})}

text:
Then

(

L

0

,

R

0

)
=
(

L

0

′

,

R

0

′

)

{\displaystyle (L_{0},R_{0})=(L_{0}',R_{0}')}

 is the plaintext again.

text: Operations[edit]

text: ARX (add–rotate–xor)[edit]

text: Many modern block ciphers and hashes are ARX algorithms—their round function involves only three operations: modular addition, rotation with fixed rotation amounts, and XOR (ARX). Examples include Salsa20, Speck, XXTEA, and BLAKE. Many authors draw an ARX network, a kind of data flow diagram, to illustrate such a round function.[16]

text: These ARX operations are popular because they are relatively fast and cheap in hardware and software, and also because they run in constant time, and are therefore immune to timing attacks. The rotational cryptanalysis technique attempts to attack such round functions.

text: Other operations[edit]

text: Other operations often used in block ciphers include data-dependent rotations as in RC5 and RC6, a substitution box implemented as a lookup table as in Data Encryption Standard and Advanced Encryption Standard, a permutation box, and multiplication as in IDEA.

text: Modes of operation[edit]

text: A block cipher by itself allows encryption only of a single data block of the cipher's block length. For a variable-length message, the data must first be partitioned into separate cipher blocks. In the simplest case, known as the Electronic Codebook (ECB) mode, a message is first split into separate blocks of the cipher's block size (possibly extending the last block with padding bits), and then each block is encrypted and decrypted independently. However, such a naive method is generally insecure because equal plaintext blocks will always generate equal ciphertext blocks (for the same key), so patterns in the plaintext message become evident in the ciphertext output.[17]

text: To overcome this limitation, several so-called block cipher modes of operation have been designed[18][19] and specified in national recommendations such as NIST 800-38A[20] and BSI TR-02102[21] and international standards such as ISO/IEC 10116.[22] The general concept is to use randomization of the plaintext data based on an additional input value, frequently called an initialization vector, to create what is termed probabilistic encryption.[23] In the popular cipher block chaining (CBC) mode, for encryption to be secure the initialization vector passed along with the plaintext message must be a random or pseudo-random value, which is added in an exclusive-or manner to the first plaintext block before it is being encrypted. The resultant ciphertext block is then used as the new initialization vector for the next plaintext block. In the cipher feedback (CFB) mode, which emulates a self-synchronizing stream cipher, the initialization vector is first encrypted and then added to the plaintext block. The output feedback (OFB) mode repeatedly encrypts the initialization vector to create a key stream for the emulation of a synchronous stream cipher. The newer counter (CTR) mode similarly creates a key stream, but has the advantage of only needing unique and not (pseudo-)random values as initialization vectors; the needed randomness is derived internally by using the initialization vector as a block counter and encrypting this counter for each block.[20]

text: From a security-theoretic point of view, modes of operation must provide what is known as semantic security.[24] Informally, it means that given some ciphertext under an unknown key one cannot practically derive any information from the ciphertext (other than the length of the message) over what one would have known without seeing the ciphertext. It has been shown that all of the modes discussed above, with the exception of the ECB mode, provide this property under so-called chosen plaintext attacks.

text: Padding[edit]

text: Some modes such as the CBC mode only operate on complete plaintext blocks. Simply extending the last block of a message with zero-bits is insufficient since it does not allow a receiver to easily distinguish messages that differ only in the amount of padding bits. More importantly, such a simple solution gives rise to very efficient padding oracle attacks.[25] A suitable padding scheme is therefore needed to extend the last plaintext block to the cipher's block size. While many popular schemes described in standards and in the literature have been shown to be vulnerable to padding oracle attacks,[25][26] a solution which adds a one-bit and then extends the last block with zero-bits, standardized as "padding method 2" in ISO/IEC 9797-1,[27] has been proven secure against these attacks.[26]

text: Cryptanalysis[edit]

text: This section needs expansion with: Introduction of attack models may be needed for the cryptanalysis techniques: ciphertext only, known plaintext, chosen plaintext, chosen ciphertext, etc.. You can help by adding to it. (April 2012)

text: Brute-force attacks[edit]

text: This section needs expansion with: Impact of key size and block size, discuss time–memory–data trade-offs.. You can help by adding to it. (April 2012)

text: Due to a block cipher's characteristic as an invertible function, its output becomes distinguishable from a truly random output string over time due to the birthday attack. This property results in the cipher's security degrading quadratically, and needs to be taken into account when selecting a block size. There is a trade-off though as large block sizes can result in the algorithm becoming inefficient to operate.[28] Earlier block ciphers such as the DES have typically selected a 64-bit block size, while newer designs such as the AES support block sizes of 128 bits or more, with some ciphers supporting a range of different block sizes.[29]

text: Differential cryptanalysis[edit]

text: This section needs expansion. You can help by adding to it. (April 2012)

text: Linear cryptanalysis[edit]

text: Linear cryptanalysis is a form of cryptanalysis based on finding affine approximations to the action of a cipher. Linear cryptanalysis is one of the two most widely used attacks on block ciphers; the other being differential cryptanalysis.[30]

text: The discovery is attributed to Mitsuru Matsui, who first applied the technique to the FEAL cipher (Matsui and Yamagishi, 1992).[31]

text: Integral cryptanalysis[edit]

text: Integral cryptanalysis is a cryptanalytic attack that is particularly applicable to block ciphers based on substitution–permutation networks. Unlike differential cryptanalysis, which uses pairs of chosen plaintexts with a fixed XOR difference, integral cryptanalysis uses sets or even multisets of chosen plaintexts of which part is held constant and another part varies through all possibilities. For example, an attack might use 256 chosen plaintexts that have all but 8 of their bits the same, but all differ in those 8 bits. Such a set necessarily has an XOR sum of 0, and the XOR sums of the corresponding sets of ciphertexts provide information about the cipher's operation. This contrast between the differences of pairs of texts and the sums of larger sets of texts inspired the name "integral cryptanalysis", borrowing the terminology of calculus.[citation needed]

text: Other techniques[edit]

text: In addition to linear and differential cryptanalysis, there is a growing catalog of attacks: truncated differential cryptanalysis, partial differential cryptanalysis, integral cryptanalysis, which encompasses square and integral attacks, slide attacks, boomerang attacks, the XSL attack, impossible differential cryptanalysis and algebraic attacks. For a new block cipher design to have any credibility, it must demonstrate evidence of security against known attacks.[citation needed]

text: Provable security[edit]

text: When a block cipher is used in a given mode of operation, the resulting algorithm should ideally be about as secure as the block cipher itself. ECB (discussed above) emphatically lacks this property: regardless of how secure the underlying block cipher is, ECB mode can easily be attacked. On the other hand, CBC mode can be proven to be secure under the assumption that the underlying block cipher is likewise secure. Note, however, that making statements like this requires formal mathematical definitions for what it means for an encryption algorithm or a block cipher to "be secure". This section describes two common notions for what properties a block cipher should have. Each corresponds to a mathematical model that can be used to prove properties of higher level algorithms, such as CBC.

text: This general approach to cryptography – proving higher-level algorithms (such as CBC) are secure under explicitly stated assumptions regarding their components (such as a block cipher) – is known as provable security.

text: Standard model[edit]

text: Informally, a block cipher is secure in the standard model if an attacker cannot tell the difference between the block cipher (equipped with a random key) and a random permutation.

text: To be a bit more precise, let E be an n-bit block cipher. We imagine the following game:

text:
The person running the game flips a coin.

If the coin lands on heads, he chooses a random key K and defines the function f = EK.
If the coin lands on tails, he chooses a random permutation π on the set of n-bit strings, and defines the function f = π.

The attacker chooses an n-bit string X, and the person running the game tells him the value of f(X).
Step 2 is repeated a total of q times. (Each of these q interactions is a query.)
The attacker guesses how the coin landed. He wins if his guess is correct.

text: The attacker, which we can model as an algorithm, is called an adversary. The function f (which the adversary was able to query) is called an oracle.

text: Note that an adversary can trivially ensure a 50% chance of winning simply by guessing at random (or even by, for example, always guessing "heads"). Therefore, let PE(A) denote the probability that the adversary A wins this game against E, and define the advantage of A as 2(PE(A) − 1/2). It follows that if A guesses randomly, its advantage will be 0; on the other hand, if A always wins, then its advantage is 1. The block cipher E is a pseudo-random permutation (PRP) if no adversary has an advantage significantly greater than 0, given specified restrictions on q and the adversary's running time. If in Step 2 above adversaries have the option of learning f−1(X) instead of f(X) (but still have only small advantages) then E is a strong PRP (SPRP). An adversary is non-adaptive if it chooses all q values for X before the game begins (that is, it does not use any information gleaned from previous queries to choose each X as it goes).

text: These definitions have proven useful for analyzing various modes of operation. For example, one can define a similar game for measuring the security of a block cipher-based encryption algorithm, and then try to show (through a reduction argument) that the probability of an adversary winning this new game is not much more than PE(A) for some A. (The reduction typically provides limits on q and the running time of A.) Equivalently, if PE(A) is small for all relevant A, then no attacker has a significant probability of winning the new game. This formalizes the idea that the higher-level algorithm inherits the block cipher's security.

text: Ideal cipher model[edit]

text: Practical evaluation[edit]

text: Block ciphers may be evaluated according to multiple criteria in practice. Common factors include:[32][33]

text:
Key parameters, such as its key size and block size, both of which provide an upper bound on the security of the cipher.
The estimated security level, which is based on the confidence gained in the block cipher design after it has largely withstood major efforts in cryptanalysis over time, the design's mathematical soundness, and the existence of practical or certificational[34] attacks.
The cipher's complexity and its suitability for implementation in hardware or software. Hardware implementations may measure the complexity in terms of gate count or energy consumption, which are important parameters for resource-constrained devices.
The cipher's performance in terms of processing throughput on various platforms, including its memory requirements.
The cost of the cipher, which refers to licensing requirements that may apply due to intellectual property rights.
The flexibility of the cipher, which includes its ability to support multiple key sizes and block lengths.

tag: ul

text: Notable block ciphers[edit]

text: Lucifer / DES[edit]

text: Lucifer is generally considered to be the first civilian block cipher, developed at IBM in the 1970s based on work done by Horst Feistel. A revised version of the algorithm was adopted as a U.S. government Federal Information Processing Standard: FIPS PUB 46 Data Encryption Standard (DES).[35] It was chosen by the U.S. National Bureau of Standards (NBS) after a public invitation for submissions and some internal changes by NBS (and, potentially, the NSA). DES was publicly released in 1976 and has been widely used.[citation needed]

text: DES was designed to, among other things, resist a certain cryptanalytic attack known to the NSA and rediscovered by IBM, though unknown publicly until rediscovered again and published by Eli Biham and Adi Shamir in the late 1980s. The technique is called differential cryptanalysis and remains one of the few general attacks against block ciphers; linear cryptanalysis is another, but may have been unknown even to the NSA, prior to its publication by Mitsuru Matsui. DES prompted a large amount of other work and publications in cryptography and cryptanalysis in the open community and it inspired many new cipher designs.[citation needed]

text: DES has a block size of 64 bits and a key size of 56 bits. 64-bit blocks became common in block cipher designs after DES. Key length depended on several factors, including government regulation. Many observers[who?] in the 1970s commented that the 56-bit key length used for DES was too short. As time went on, its inadequacy became apparent, especially after a special purpose machine designed to break DES was demonstrated in 1998 by the Electronic Frontier Foundation. An extension to DES, Triple DES, triple-encrypts each block with either two independent keys (112-bit key and 80-bit security) or three independent keys (168-bit key and 112-bit security). It was widely adopted as a replacement. As of 2011, the three-key version is still considered secure, though the National Institute of Standards and Technology (NIST) standards no longer permit the use of the two-key version in new applications, due to its 80-bit security level.[36]

text: IDEA[edit]

text: The International Data Encryption Algorithm (IDEA) is a block cipher designed by James Massey of ETH Zurich and Xuejia Lai; it was first described in 1991, as an intended replacement for DES.

text: IDEA operates on 64-bit blocks using a 128-bit key, and consists of a series of eight identical transformations (a round) and an output transformation (the half-round). The processes for encryption and decryption are similar. IDEA derives much of its security by interleaving operations from different groups – modular addition and multiplication, and bitwise exclusive or (XOR) – which are algebraically "incompatible" in some sense.

text: The designers analysed IDEA to measure its strength against differential cryptanalysis and concluded that it is immune under certain assumptions. No successful linear or algebraic weaknesses have been reported. As of 2012[update], the best attack which applies to all keys can break full 8.5-round IDEA using a narrow-bicliques attack about four times faster than brute force.

text: RC5 is a block cipher designed by Ronald Rivest in 1994 which, unlike many other ciphers, has a variable block size (32, 64 or 128 bits), key size (0 to 2040 bits) and number of rounds (0 to 255). The original suggested choice of parameters were a block size of 64 bits, a 128-bit key and 12 rounds.

text: A key feature of RC5 is the use of data-dependent rotations; one of the goals of RC5 was to prompt the study and evaluation of such operations as a cryptographic primitive. RC5 also consists of a number of modular additions and XORs. The general structure of the algorithm is a Feistel-like network. The encryption and decryption routines can be specified in a few lines of code. The key schedule, however, is more complex, expanding the key using an essentially one-way function with the binary expansions of both e and the golden ratio as sources of "nothing up my sleeve numbers". The tantalising simplicity of the algorithm together with the novelty of the data-dependent rotations has made RC5 an attractive object of study for cryptanalysts.

text: 12-round RC5 (with 64-bit blocks) is susceptible to a differential attack using 244 chosen plaintexts.[37] 18–20 rounds are suggested as sufficient protection.

text: Rijndael / AES[edit]

text: DES has been superseded as a United States Federal Standard by the AES, adopted by NIST in 2001 after a 5-year public competition. The cipher was developed by two Belgian cryptographers, Joan Daemen and Vincent Rijmen, and submitted under the name Rijndael.

text: AES has a fixed block size of 128 bits and a key size of 128, 192, or 256 bits, whereas Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the keysize has no theoretical maximum. AES operates on a 4×4 column-major order matrix of bytes, termed the state (versions of Rijndael with a larger block size have additional columns in the state).

text: Blowfish[edit]

text: Blowfish is a block cipher, designed in 1993 by Bruce Schneier and included in a large number of cipher suites and encryption products. Blowfish has a 64-bit block size and a variable key length from 1 bit up to 448 bits.[38] It is a 16-round Feistel cipher and uses large key-dependent S-boxes. Notable features of the design include the key-dependent S-boxes and a highly complex key schedule.

text: Schneier designed Blowfish as a general-purpose algorithm, intended as an alternative to the ageing DES and free of the problems and constraints associated with other algorithms. At the time Blowfish was released, many other designs were proprietary, encumbered by patents or were commercial/government secrets. Schneier has stated that, "Blowfish is unpatented, and will remain so in all countries. The algorithm is hereby placed in the public domain, and can be freely used by anyone." Blowfish provides a good encryption rate in software and no effective cryptanalysis of the full-round version has been found to date.[citation needed]

text: Generalizations[edit]

text: Tweakable block ciphers[edit]

text: This section needs expansion. You can help by adding to it. (June 2008)

text: M. Liskov, R. Rivest, and D. Wagner have described a generalized version of block ciphers called "tweakable" block ciphers.[39] A tweakable block cipher accepts a second input called the tweak along with its usual plaintext or ciphertext input. The tweak, along with the key, selects the permutation computed by the cipher. If changing tweaks is sufficiently lightweight (compared with a usually fairly expensive key setup operation), then some interesting new operation modes become possible. The disk encryption theory article describes some of these modes.

text: Format-preserving encryption[edit]

text: Block ciphers traditionally work over a binary alphabet. That is, both the input and the output are binary strings, consisting of n zeroes and ones. In some situations, however, one may wish to have a block cipher that works over some other alphabet; for example, encrypting 16-digit credit card numbers in such a way that the ciphertext is also a 16-digit number might facilitate adding an encryption layer to legacy software. This is an example of format-preserving encryption. More generally, format-preserving encryption requires a keyed permutation on some finite language. This makes format-preserving encryption schemes a natural generalization of (tweakable) block ciphers. In contrast, traditional encryption schemes, such as CBC, are not permutations because the same plaintext can encrypt to multiple different ciphertexts, even when using a fixed key.

text: Relation to other cryptographic primitives[edit]

text: Block ciphers can be used to build other cryptographic primitives, such as those below. For these other primitives to be cryptographically secure, care has to be taken to build them the right way.

text:
Stream ciphers can be built using block ciphers. OFB-mode and CTR mode are block modes that turn a block cipher into a stream cipher.
Cryptographic hash functions can be built using block ciphers.[40][41] See one-way compression function for descriptions of several such methods. The methods resemble the block cipher modes of operation usually used for encryption.
Cryptographically secure pseudorandom number generators (CSPRNGs) can be built using block ciphers.[42][43]
Secure pseudorandom permutations of arbitrarily sized finite sets can be constructed with block ciphers; see Format-Preserving Encryption.
Message authentication codes (MACs) are often built from block ciphers. CBC-MAC, OMAC and PMAC are such MACs.
Authenticated encryption is also built from block ciphers. It means to both encrypt and MAC at the same time. That is to both provide confidentiality and authentication. CCM, EAX, GCM and OCB are such authenticated encryption modes.

text: Just as block ciphers can be used to build hash functions, hash functions can be used to build block ciphers. Examples of such block ciphers are SHACAL, BEAR and LION.


document_title: Bobby Byrd

question_text: who played bobby byrd in get on up

question_tokens: who played bobby byrd in get on up

root

text: Bobby Byrd

text: Early life and career[edit]

text: Byrd was born in Toccoa, Georgia, to a religiously devout family, where they were respected members of the church congregation and active in their neighborhood there.[1] Byrd started being active in his local church choir with the group, the Zioneers, later making a name for himself as member of the Gospel Starlighters, which included his sister Sarah. At a time when church elders disapproved of secular singing, the band members would leave their home state and perform in South Carolina as the R&B group the Avons, eventually they left gospel behind and went on as the Avons. The original group consisted of Byrd, who played piano, organ and sang lead vocals; and Nafloyd Scott, Fred Pulliam and Doyle Oglesby.

tag: p

text: Meeting James Brown and the formation of The Famous Flames[edit]

text: In 1952 Bobby Byrd formed and sang with a gospel group called the Gospel Starlighters. During a friendly baseball match at a juvenile prison, he met a young James Brown who was serving time there on robbery charges. Byrd befriended him and arranged for Byrd's family to oversee Brown's parole.[2] This began a personal and professional association that lasted until 1973.

text: Although Byrd would eventually have over twenty years as a solo performer, it is his association with Brown for which he is chiefly remembered. Contrary to belief, the group had already changed its name to the Flames when Brown asked Byrd for a spot in the group, with Brown first settling as a drummer. Eventually Brown was driven to perform as lead singer, as he felt lead vocalists got more attention from women. Byrd recognized early that Brown was unique and that it would be impossible to control him: "I didn't need him in competition, I needed him with me, that's why I worked so hard to get him over to my group." [3] In 1956, Clint Brantley signed on as the group's manager. With Johnny Terry and Nash Knox on board, the group became "The Famous Flames" and won a deal with Ralph Bass' Federal label, which was a subsidiary of Syd Nathan's King label, in February 1956. Their first record, "Please, Please, Please", which Byrd said he wrote with Johnny Terry, featured a lead vocal by James Brown and was issued with the billing, "James Brown and the Famous Flames", which did not go well with the rest of the group. After three sessions, the original Flames broke up. At the final session Byrd and Brown wrote the rhythm and blues dancer "Can't Be the Same", which was one of many collaborations with Brown for which Byrd failed to gain credit.[citation needed]

text: The Flames without Brown changed their name to Byrd's Drops of Joy. However, they found little success; when Brown approached them to reform the Flames they agreed. At this point, The Famous Flames ceased being a vocal/instrumental group, and became a straight vocal group, since Brown had begun to employ the old J.C. Davis outfit as his road band. Original Flames members Bobby Byrd and Johnny Terry returned, and new Flames members Bobby Bennett and Baby Lloyd Stallworth were added. Along with Brown, these four men comprised the longest-lasting lineup of The Famous Flames. Original Flames guitarist Nafloyd Scott also returned and was added to the band.The rest of the original Flames faded into obscurity.

text: With this lineup the group would have a series of hits between 1959 and 1964 and participated on many of the albums that helped to bring R&B to a crossover audience, including the landmark million-selling 1963 live album, Live at the Apollo. Byrd and the Famous Flames also performed together on a few episodes of The Ed Sullivan Show, made a brief appearance in the film, Ski Party and upstaged headliners The Rolling Stones on the landmark 1964 rock concert/motion picture, The T.A.M.I. Show. Byrd (and fellow Famous Flame Lloyd Stallworth) were credited as songwriters on the Flames hit, "Lost Someone," though Brown was the only member who sang on the recording. Its success led Brown to record more songs on his own but the majority of his early hits were as a member of the Famous Flames including songs such as "Try Me", "I'll Go Crazy", "Bewildered", "Think", "Baby, You're Right", "I Don't Mind", "Shout and Shimmy", and "Oh Baby, Don't You Weep". As was the case with some recordings, the Famous Flames were often not credited on album covers though ironically enough on recordings in which Brown appeared by himself, the group was credited, leaving fans to erroneously believe the Famous Flames were actually Brown's backing band, instead of the singing group that they actually were. The group continued performing together until 1968 when they left over monetary issues. The last Flames-associated recording to be released was the pre-funk soul hit, "Licking Stick - Licking Stick", to which Byrd contributed vocals without the other members, who had departed before Byrd did that summer.

text: Solo career and continual work with Brown[edit]

text: After two years away, Byrd reunited with Brown in 1970. He hired, on the spot and without rehearsal, Bootsy Collins, Bootsy's brother Catfish, and their band to fill in for Brown's former band after they left him before a gig. After that performance, Byrd and Brown brought the band to a studio session where they recorded the seminal funk hit, "Get Up (I Feel Like Being a) Sex Machine", which Brown and Byrd co-wrote and shared lead vocals on, though the recording was issued as a James Brown solo recording.[citation needed]

text: When The Famous Flames were still together, Byrd and Brown co-formed the production company, Fair Deal, to distribute The Famous Flames' recordings – and Brown's own solo recordings – to mainstream markets after years solely on the rhythm and blues circuit. This led to both Byrd and Brown's signing solo deals with Smash Records. In 1964, Byrd recorded his first solo hit, "Baby, Baby, Baby" with Anna King. A year later he had a bigger R&B hit with "We Are in Love", which reached #14. Later in the late 1960s, as Byrd and Brown together began working under the yet-to-be-named genre of funk, Byrd had a hit with "I Need Help (I Can't Do It Alone)", a refrain later repeated in some of Brown's later hits.[citation needed]

text: In 1971, when Brown signed with Polydor Records, he and Byrd formed the label People Records, and issued several records by other artists, including Byrd himself, who recorded the funk hit, "I Know You Got Soul". Byrd appeared onstage with Brown from 1970 until leaving his band again in 1973 due to a combination of issues, including uncredited compositions on some Brown hits, Brown's issues with singer Vicki Anderson, whom Byrd eventually married and remained with until his death, and wanting to start a family with Anderson. Though he remained in contact with Brown following this final split, this departure ended Byrd's 21-year professional association with Brown, who now went by the nickname "Godfather of Soul", after composing the soundtrack to the film, Black Caesar. Without Byrd's help, however, Brown began struggling with production of the music on People and soon began experiencing financial troubles; Brown's recording success started dwindling as Brown's other band mates left for better opportunities.[citation needed]

text: In 1993, Byrd recorded a solo album, On the Move, on the German record Label, Soulciety Records. After a few more live performances, Byrd decided to retire in 1996, though he occasionally re-emerged sometimes with the assistance of Brown: following Brown's parole from drug and weapons charges in 1991, he hired Byrd to join him on stage for his pay-per-view 1992 concert. Byrd would occasionally perform with Brown in some venues. They would also collaborate on the song "Killing Is Out, School Is In" from Brown's final studio album, 2002's The Next Step. At his funeral in December 2006, Byrd sung "Sex Machine" with Brown's other band mates paying homage to his late estranged friend and former performing partner.

text: In 2003, a few years before his death, Bobby, his wife Vicki, and Famous Flames Bobby Bennett and Lloyd Stallworth, sued lead singer James Brown and Universal Music for non-payment of royalties, stating that monies that rightfully belong to them for numerous Famous Flames hits, and Byrd's hit "I Know You Got Soul", which was sampled by numerous rappers, including Eric B. & Rakim, were sent by Universal to James Brown instead, who allegedly kept them.[4][5] The suit was dismissed due to the statute of limitations having run out. However, rapper Jay-Z, who sampled Byrd's song "I'm Not to Blame" for his recording, "U Don't Know", on his 2001 multi million-selling The Blueprint, paid Byrd 65% of the royalties for the song, allowing Byrd and his family to secure a mortgage for their home, which was worth about $250,000.

text: Personal life[edit]

text: After splitting from Brown in 1973, Byrd and Vicki Anderson, who left Brown's band at the same time as Byrd, got married.[6][7] Byrd had three children with his first wife Gail, in Toccoa, Georgia; two sons, Walda and Orrin Byrd, and one daughter, Ruthie Byrd. Lolita Freeman, and Dhevin Shellshear, were from another relationship. Byrd raised Anderson's daughter Carleen, sons Bartlett Anderson, James Byrd and Anthony Byrd, and shared a daughter, Keisha Byrd. The couple remained married throughout Byrd's lifetime. Though he had moved to Cincinnati after the Famous Flames signed with Federal/King, Byrd retained residences in Georgia and after leaving Brown, settled at Loganville for the remainder of his life.

text: Death[edit]

text: Bobby Byrd died on September 12, 2007, of cancer; he was 73 years old.[8][9][10]

text: Legacy[edit]

text: Numerous songs in hip hop music have sampled Byrd-associated songs such as "I Know You Got Soul", "Think (About It)", "Get Up (I Feel Like Being a) Sex Machine", "Soul Power", "Make It Funky" and "I'm Not to Blame". Byrd's music has had a lasting influence on numerous soul, R&B, and hip hop artists.

text: For years following his departure from Brown, several history revisionists[who?] have sometimes neglected to mention Byrd's impact in Brown's career even suggesting that Brown had started out as a solo artist when the record, "Please, Please, Please" was released in 1956. In truth, however, it was actually a recording by the Famous Flames. It was, in fact, Bobby Byrd and The Famous Flames who launched Brown's career, not the other way around. Indeed, the majority of Brown's early recordings between 1956 and 1962 were not solo recordings, but as a member of the Famous Flames, which made his 1986 solo induction to the Rock & Roll Hall of Fame controversial, as his first official solo recording was the cover of the instrumental R&B standard, "Night Train". Though the late 1961 recording, "Lost Someone", was sung by Brown alone, the song was credited as a Famous Flames recording and featured Byrd and fellow Flames member Lloyd Stallworth as co-writers, and Byrd also played organ on the recording.[citation needed]

text: In addition, claims made by uninformed individuals such as pop music writers and critics that the Famous Flames were a "band" or were backup musicians are also incorrect. The Famous Flames were a vocal group. Brown's backing band was a separate group known as the James Brown Orchestra (later known as The J.B.s).[11]

text: The early songs, most of which Byrd participated with the exception of "Try Me", featured Byrd and contributed a great deal to establishing Brown's career before he finally became a full-fledged solo artist with the release of "Papa's Got a Brand New Bag" in 1965. Though Brown asserted himself as the full-fledged leader, he was still just a member of the Flames until that group left him in 1968. In addition, it was Byrd who later saved Brown's career numerous times, starting with him returning to the Famous Flames at Brown's request after the group's initial breakup in 1957, helping him to coach the re-formed group, re-joining them at that point, and later hiring Bootsy and Phelps Collins to back Brown up in 1970 and who co-produced the hit recording, "Sex Machine", later helping with other artists[who?] on People Records. In the Famous Flames' Rock & Roll Hall of Fame page, Byrd is regarded as "one of the more important auxiliary figures in the career of a major artist in music history."[12]

text: In October 2004 Bobby Byrd's songs "I Know You Got Soul" and "Hot Pants" were featured on the Grand Theft Auto: San Andreas soundtrack, playing on fictional radio station Master Sounds 98.3. In September 2005 his song "Try It Again" appeared on the soundtrack of Indigo Prophecy.'

text: Byrd was portrayed by actor Nelsan Ellis in the 2014 James Brown bio film Get on Up.[13]

text: Induction to the Rock and Roll Hall of Fame and initial controversy[edit]

text: In 1986 Rock & Roll Hall of Fame officials announced that James Brown would be included in a list of the first nine musicians to be inducted by the organization. Due to his contributions to the industry and his influence on the R&B, Soul, and Funk Music genres, it was only fitting that Brown would be part of this initial group. However, James Brown did not meet the Hall of Fame's criteria for induction at that time which required an artist to have released their first single as a solo artist at least 25 years prior to induction. Brown's first solo release in 1965 was only 21 years before, although Brown had been active in the industry and released songs as part of The Famous Flames prior to 1965. For Brown to be inducted by the organization in 1986, inclusion of the other members of The Famous Flames was required. It's unknown as to why this oversight occurred but it's been surmised that the organization felt Brown's solo work warranted his induction at the Hall of Fame's initial ceremonies.

text: Brown's inclusion as a solo artist without the other Flames members was met with criticism but was not amended until recently.[14] In late 2011, the Rock & Roll Hall of Fame formed a special committee to discuss several pioneering groups they felt deserved to be inducted, but were initially excluded in error, due to the impact of their lead singers, who were incorrectly inducted as solo artists. This committee's decision led to the induction of The Famous Flames and its members. This was an amending gesture which did not require nomination or voting, under the premise that they should have been inducted with Brown back in 1986, since, according to Rock Hall CEO Terry Stewart, Brown's first solo recording missed the 25-year criterion for performing musicians. Byrd, Stallworth (c. 2001), and Terry had long been deceased by this point, and Bobby Bennett, the Flames' only surviving member, accepted the honor on behalf of the group in Cleveland, on April 14, 2012.[15][16][17] Less than one year after the induction, Bennett himself died on January 18, 2013.[18]

text: In 2015, Bobby Byrd was nominated for a second induction into the Rock & Roll Hall of Fame as a member of The J.B.'s, a group which he actually discovered in 1970 to replace the Original James Brown Band, who left Brown in 1970 (as the Famous Flames left him in 1968) due to salary disputes.[19]

text: Bobby Byrd has been recognized as one of the most important, yet unsung, founders of Funk music.