An AES (Advanced Encryption Standard) instruction set is a set of instructions that are specifically designed to perform AES encryption and decryption operations efficiently. These instructions are typically found in modern processors and can greatly accelerate AES operations compared to software implementations. An AES instruction set includes instructions for key expansion , encryption, and decryption using various key sizes (128-bit, 192-bit, and 256-bit).
9-538: The instruction set is often implemented as a set of instructions that can perform a single round of AES along with a special version for the last round which has a slightly different method. When AES is implemented as an instruction set instead of as software, it can have improved security, as its side channel attack surface is reduced. AES-NI (or the Intel Advanced Encryption Standard New Instructions ; AES-NI )
18-591: A Pentium 4 with no acceleration. Most modern compilers can emit AES instructions. A lot of security and cryptography software supports the AES instruction set, including the following notable core infrastructure: A fringe use of the AES instruction set involves using it on block ciphers with a similarly-structured S-box , using affine isomorphism to convert between the two. SM4 , Camellia and ARIA have been accelerated using AES-NI. The AVX-512 Galois Field New Instructions (GFNI) allows implementing these S-boxes in
27-523: A more direct way. New cryptographic algorithms have been constructed to specifically use parts of the AES algorithm, so that the AES instruction set can be used for speedups. The AEGIS family, which offers authenticated encryption , runs with at least twice the speed of AES. AEGIS is an "additional finalist for high-performance applications" in the CAESAR Competition . Side channel attack Too Many Requests If you report this error to
36-485: Is also available in the latest SPARC processors ( T3 , T4 , T5 , M5, and forward) and in latest ARM processors. The SPARC T4 processor, introduced in 2011, has user-level instructions implementing AES rounds. These instructions are in addition to higher level encryption commands. The ARMv8-A processor architecture, announced in 2011, including the ARM Cortex-A53 and A57 (but not previous v7 processors like
45-526: The Whirlpool and Grøstl hash functions). In AES-NI Performance Analyzed , Patrick Schmid and Achim Roos found "impressive results from a handful of applications already optimized to take advantage of Intel's AES-NI capability". A performance analysis using the Crypto++ security library showed an increase in throughput from approximately 28.0 cycles per byte to 3.5 cycles per byte with AES / GCM versus
54-689: The AES-specific instructions were available on RISC-V, a number of RISC-V chips included integrated AES co-processors. Examples include: Since the Power ISA v.2.07 , the instructions vcipher and vcipherlast implement one round of AES directly. IBM z9 or later mainframe processors support AES as single-opcode (KM, KMC) AES ECB/CBC instructions via IBM's CryptoExpress hardware. These single-instruction AES versions are therefore easier to use than Intel NI ones, but may not be extended to implement other algorithms based on AES round functions (such as
63-667: The Cortex A5, 7, 8, 9, 11, 15 ) also have user-level instructions which implement AES rounds. VIA x86 CPUs and AMD Geode use driver-based accelerated AES handling instead. (See Crypto API (Linux) .) The following chips, while supporting AES hardware acceleration, do not support AES-NI: Programming information is available in ARM Architecture Reference Manual ARMv8, for ARMv8-A architecture profile (Section A2.3 "The Armv8 Cryptographic Extension") . The Marvell Kirkwood
72-554: Was the embedded core of a range of SoC from Marvell Technology , these SoC CPUs (ARM, mv_cesa in Linux) use driver-based accelerated AES handling. (See Crypto API (Linux) .) The scalar and vector cryptographic instruction set extensions for the RISC-V architecture were ratified respectively on 2022 and 2023, which allowed RISC-V processors to implement hardware acceleration for AES, GHASH , SHA-256 , SHA-512 , SM3 , and SM4 . Before
81-615: Was the first major implementation. AES-NI is an extension to the x86 instruction set architecture for microprocessors from Intel and AMD proposed by Intel in March 2008. A wider version of AES-NI, AVX-512 Vector AES instructions (VAES) , is found in AVX-512 . The following Intel processors support the AES-NI instruction set: Several AMD processors support AES instructions: AES support with unprivileged processor instructions
#449550