AES instruction set

An Advanced Encryption Standard instruction set is now integrated in to many processors. The purpose of the instruction set is to improve the speed, as well as the resistance to side-channel attacks, of applications performing encryption and decryption using Advanced Encryption Standard (AES). They are often implemented as instructions implementing a single round of AES along with a special version for the last round which has a slightly different method.

x86 architecture processors

AES-NI (or the Intel Advanced Encryption Standard New Instructions; AES-NI) was the first major implementation. AES-NI is an extension to the x86 instruction set architecture for microprocessors from Intel and AMD proposed by Intel in March 2008.^[1]

Instructions

Instruction	Description^[2]
`AESENC`	Perform one round of an AES encryption flow
`AESENCLAST`	Perform the last round of an AES encryption flow
`AESDEC`	Perform one round of an AES decryption flow
`AESDECLAST`	Perform the last round of an AES decryption flow
`AESKEYGENASSIST`	Assist in AES round key generation
`AESIMC`	Assist in AES Inverse Mix Columns
`PCLMULQDQ`	Carryless multiply (CLMUL)^[3]

Intel

The following Intel processors support the AES-NI instruction set:^[4]

Westmere based processors, specifically:
- Westmere-EP (Xeon 56xx) (a.k.a. Gulftown Xeon 5600-series DP server model) processors.
- Clarkdale processors (except Core i3, Pentium and Celeron).
- Arrandale processors (except Celeron, Pentium, Core i3, Core i5-4XXM).
Sandy Bridge processors:
- Desktop: all except Pentium, Celeron, Core i3.^[5]^[6]
- Mobile: all Core i7 and Core i5. Several vendors have shipped BIOS configurations with the extension disabled;^[7] a BIOS update is required to enable them.^[8]
Ivy Bridge processors.
- All i5, i7, Xeon and i3-2115C^[9] only.
Haswell processors (all except i3-4000m,^[10] Pentium and Celeron).
Broadwell processors (all except Pentium and Celeron).
Silvermont/Airmont processors (all except Bay Trail-D and Bay Trail-M).
Goldmont processors.
Skylake processors.
Kaby Lake processors.
Coffee Lake processors.

AMD

Several AMD processors support AES instructions:

Jaguar-based processors and newer

Puma-based processors and newer
"Heavy Equipment" processors
- Bulldozer-based processors ^[11]
- Piledriver-based processors
- Steamroller-based processors
- Excavator-based processors and newer
Zen based processors
Zen+ based processors

Hardware acceleration in other architectures

AES support with unprivileged processor instructions is also available in the latest SPARC processors (T3, T4, T5, M5, and forward) and in latest ARM processors. The SPARC T4 processor, introduced in 2011, has user-level instructions implementing AES rounds.^[12] These instructions are in addition to higher level encryption commands. The ARMv8-A processor architecture, announced in 2011, including the ARM Cortex-A53 and A57 (but not previous v7 processors like the Cortex A5, 7, 8, 9, 11, 15 Template:Citation needed) also have user-level instructions which implement AES rounds.^[13] In August 2012, IBM announced^[14] that the then-forthcoming Power7+ architecture would have AES support. The commands in these architectures are not directly compatible with the AES-NI commands, but implement similar functionality.

IBM z9 or later mainframe processors support AES as single-opcode (KM, KMC) AES ECB/CBC instructions via IBM's CryptoExpress hardware^[15] These single-instruction AES versions are therefore easier to use than Intel NI ones, but may not be extended to implement other algorithms based on AES round functions (such as the Whirlpool hash function).

Supporting x86 CPUs

VIA x86 CPUs, AMD Geode, and Marvell Kirkwood (ARM, mv_cesa in Linux) use driver-based accelerated AES handling instead. (See Crypto API (Linux).)

The following chips, while supporting AES hardware acceleration, do not support an AES instruction set:

AMD Geode LX processors^[16]
VIA
- VIA PadLock^[17]^[18]
  - VIA C3 Nehemiah C5P (Eden-N) processors^[19]
  - VIA C7 Esther C5J processors^[20]

ARM architecture

Programming information is available in ARM Architecture Reference Manual ARMv8, for ARMv8-A architecture profile.^[21]

ARMv8-A architecture
- ARM cryptographic extensions optionally supported on ARM Cortex-A30/50/70 cores

Cryptographic hardware accelerators/engines
- Allwinner
  - A10, A20, A30, A31, A80, A83T, H3 and A64 using Security System^[22]
- Broadcom
  - BCM5801/BCM5805/BCM5820 using Security Processor^[18]
- NXP Semiconductors
  - i.MX6 onwards^[23]
- Qualcomm
  - Snapdragon 805 onwards^[24]
- Rockchip
  - RK30xx series onwards^[25]
- Samsung
  - Exynos 3 series onwards^[26]

Other architectures

Atmel XMEGA^[27] (on-chip accelerator with parallel execution, not an instruction)
SPARC T3 and later processors have hardware support for several crypto algorithms, including AES.
Cavium Octeon MIPS^[28] All Cavium Octeon MIPS-based processors have hardware support for several crypto algorithms, including AES using special coprocessor 3 instructions.

Performance

In AES-NI Performance Analyzed, Patrick Schmid and Achim Roos found "impressive results from a handful of applications already optimized to take advantage of Intel's AES-NI capability".^[29] A performance analysis using the Crypto++ security library showed an increase in throughput from approximately 28.0 cycles per byte to 3.5 cycles per byte with AES/GCM versus a Pentium 4 with no acceleration.^[30]^[31]Template:Not in source Template:Better source needed

Supporting software

Most modern compilers can emit AES instructions.

Much security and cryptography software supports the AES instruction set, including the following core infrastructure:

Cryptography API: Next Generation (CNG) (requires Windows)^[32]
Linux's Crypto API
Java 7 HotSpot
Network Security Services (NSS) version 3.13 and above^[33] (used by Firefox and Google Chrome)
Solaris Cryptographic Framework^[34] on Solaris 10 onwards
FreeBSD's OpenCrypto API (aesni(4) driver)^[35]
OpenSSL 1.0.1 and above^[36]
FLAM/FLUC 5.1.08 (released 2015-08-24) and above^[37]

References

1 }}

     | references-column-width 
     | references-column-count references-column-count-{{#if:1|{{{1}}}}} }}
   | {{#if: 
     | references-column-width }} }}" style="{{#if: 
   | {{#iferror: {{#ifexpr: 1 > 1 }}
     | Template:Column-width
     | Template:Column-count }}
   | {{#if: 
     | Template:Column-width }} }} list-style-type: {{#switch: 
   | upper-alpha
   | upper-roman
   | lower-alpha
   | lower-greek
   | lower-roman = {{{group}}}
   | #default = decimal}};">

External links

Intel Advanced Encryption Standard Instructions (AES-NI)
AES instruction set whitepaper (4.4 MB, PDF) from Intel

Template:AMD technology Template:Intel technology Template:Multimedia extensions Template:Cryptography block

[1] Template:Cite web

[2] Template:Cite web

[3] Template:Cite web

[4] Template:Cite web

[5] Template:Cite web

[6] Template:Cite web

[7] Template:Cite web

[8] Template:Cite web

[9] Template:Cite web

[10] Template:Cite web

[11] Template:Cite web

[12] Template:Cite web

[13] Template:Cite web

[14] Template:Cite web

[15] Template:Cite web

[16] Template:Cite web

[17] Template:Cite web

[openwrt-18] 18.0 ^18.1 Cryptographic Hardware Accelerators on OpenWRT.org

[19] Template:Cite web

[20] Template:Cite web

[21] Template:Cite web

[22] Template:Cite web

[23] Template:Cite web

[24] Template:Cite web

[25] Template:Cite web

[26] Template:Cite web

[27] Template:Cite web

[28] Template:Cite web

[29] Template:Cite web

[30] Template:Cite web

[31] Template:Cite web

[32] Template:Cite web

[33] Template:Cite web

[34] Template:Cite web

[35] Template:Cite web

[36] OpenSSL: CVS Web Interface Template:Dead link

[37] Template:Cite web

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]

[18]

[19]

[20]

[21]

[22]

[23]

[24]

[25]

[26]

[27]

[28]

[29]

[30]

[31]

[32]

[33]

[34]

[35]

[36]

[37]