AES instruction set explained

An AES (Advanced Encryption Standard) instruction set is a set of instructions that are specifically designed to perform AES encryption and decryption operations efficiently. These instructions are typically found in modern processors and can greatly accelerate AES operations compared to software implementations. An AES instruction set includes instructions for key expansion, encryption, and decryption using various key sizes (128-bit, 192-bit, and 256-bit).

The instruction set is often implemented as a set of instructions that can perform a single round of AES along with a special version for the last round which has a slightly different method.

When AES is implemented as an instruction set instead of as software, it can have improved security, as its side channel attack surface is reduced.[1]

x86 architecture processors

AES-NI (or the Intel Advanced Encryption Standard New Instructions; AES-NI) was the first major implementation. AES-NI is an extension to the x86 instruction set architecture for microprocessors from Intel and AMD proposed by Intel in March 2008.[2]

A wider version of AES-NI, AVX-512 Vector AES instructions (VAES), is found in AVX-512.[3]

Instructions

InstructionDescription[4]
AESENCPerform one round of an AES encryption flow
AESENCLASTPerform the last round of an AES encryption flow
AESDECPerform one round of an AES decryption flow
AESDECLASTPerform the last round of an AES decryption flow
AESKEYGENASSISTAssist in AES round key generation
AESIMCAssist in AES decryption round key generation. Applies Inverse Mix Columns to round keys.

Intel

The following Intel processors support the AES-NI instruction set:[5]

AMD

Several AMD processors support AES instructions:

Hardware acceleration in other architectures

AES support with unprivileged processor instructions is also available in the latest SPARC processors (T3, T4, T5, M5, and forward) and in latest ARM processors. The SPARC T4 processor, introduced in 2011, has user-level instructions implementing AES rounds.[13] These instructions are in addition to higher level encryption commands. The ARMv8-A processor architecture, announced in 2011, including the ARM Cortex-A53 and A57 (but not previous v7 processors like the Cortex A5, 7, 8, 9, 11, 15) also have user-level instructions which implement AES rounds.[14]

x86 CPUs offering non-AES-NI acceleration interfaces

VIA x86 CPUs and AMD Geode use driver-based accelerated AES handling instead. (See Crypto API (Linux).)

The following chips, while supporting AES hardware acceleration, do not support AES-NI:

ARM architecture

Programming information is available in ARM Architecture Reference Manual ARMv8, for ARMv8-A architecture profile (Section A2.3 "The Armv8 Cryptographic Extension").[20]

The Marvell Kirkwood was the embedded core of a range of SoC from Marvell Technology, these SoC CPUs (ARM, mv_cesa in Linux) use driver-based accelerated AES handling. (See Crypto API (Linux).)

RISC-V architecture

The scalar and vector cryptographic instruction set extensions for the RISC-V architecture were ratified respectively on 2022 and 2023, which allowed RISC-V processors to implement hardware acceleration for AES, GHASH, SHA-256, SHA-512, SM3, and SM4.

Before the AES-specific instructions were available on RISC-V, a number of RISC-V chips included integrated AES co-processors. Examples include:

POWER architecture

Since the Power ISA v.2.07, the instructions vcipher and vcipherlast implement one round of AES directly.[30]

IBM z/Architecture

IBM z9 or later mainframe processors support AES as single-opcode (KM, KMC) AES ECB/CBC instructions via IBM's CryptoExpress hardware.[31] These single-instruction AES versions are therefore easier to use than Intel NI ones, but may not be extended to implement other algorithms based on AES round functions (such as the Whirlpool and Grøstl hash functions).

Other architectures

Performance

In AES-NI Performance Analyzed, Patrick Schmid and Achim Roos found "impressive results from a handful of applications already optimized to take advantage of Intel's AES-NI capability".[34] A performance analysis using the Crypto++ security library showed an increase in throughput from approximately 28.0 cycles per byte to 3.5 cycles per byte with AES/GCM versus a Pentium 4 with no acceleration.[35] [36]

Supporting software

Most modern compilers can emit AES instructions.

A lot of security and cryptography software supports the AES instruction set, including the following notable core infrastructure:

Application beyond AES

A fringe use of the AES instruction set involves using it on block ciphers with a similarly-structured S-box, using affine isomorphism to convert between the two. SM4, Camellia and ARIA have been accelerated using AES-NI.[52] [53] [54] The AVX-512 Galois Field New Instructions (GFNI) allows implementing these S-boxes in a more direct way.[55]

New cryptographic algorithms have been constructed to specifically use parts of the AES algorithm, so that the AES instruction set can be used for speedups. The AEGIS family, which offers authenticated encryption, runs with at least twice the speed of AES.[56] AEGIS is an "additional finalist for high-performance applications" in the CAESAR Competition.[57]

See also

External links

Notes and References

  1. Web site: Securing the Enterprise with Intel AES-NI . 2017-07-26 . live . https://web.archive.org/web/20130331041411/http://www.intel.in/content/dam/doc/white-paper/enterprise-security-aes-ni-white-paper.pdf . 2013-03-31 . Intel Corporation.
  2. Web site: Intel Software Network . Intel . 2008-04-05 . https://web.archive.org/web/20080407095317/http://softwareprojects.intel.com/avx/ . 7 April 2008 . dead .
  3. Web site: Intel Architecture Instruction Set Extensions and Future Features Programming Reference. October 16, 2017. Intel.
  4. Web site: Intel Advanced Encryption Standard (AES) Instruction Set White Paper. Intel. 2010. Shay Gueron. 2012-09-20.
  5. Web site: Intel Product Specification Advanced Search. Intel ARK.
  6. Web site: The Sandy Bridge Review: Intel Core i7-2600K, i5-2500K and Core i3-2100 Tested. Anand Lal. Shimpi.
  7. Web site: Intel Product Specification Comparison.
  8. Web site: AES-NI support in TrueCrypt (Sandy Bridge problem). 27 January 2022 .
  9. Web site: Some products can support AES New Instructions with a Processor Configuration update, in particular, i7-2630QM/i7-2635QM, i7-2670QM/i7-2675QM, i5-2430M/i5-2435M, i5-2410M/i5-2415M. Please contact OEM for the BIOS that includes the latest Processor configuration update..
  10. Web site: Intel Core i3-2115C Processor (3M Cache, 2.00 GHz) Product Specifications.
  11. Web site: Intel Core i3-4000M Processor (3M Cache, 2.40 GHz) Product Specifications.
  12. Web site: Following Instructions . AMD . November 22, 2010 . 2011-01-04 . dead . https://web.archive.org/web/20101126155830/http://blogs.amd.com/work/2010/11/22/following-instructions/ . November 26, 2010 .
  13. Web site: SPARC T4 OpenSSL Engine. Oracle. 2011. Dan Anderson. 2012-09-20.
  14. Web site: ARMv8-A Technology Preview. ARM. 2011. Richard Grisenthwaite. 2012-09-20. https://web.archive.org/web/20180610181021/https://www.arm.com/files/downloads/ARMv8_Architecture.pdf. 2018-06-10. dead.
  15. Web site: AMD Geode LX Processor Family Technical Specifications . AMD.
  16. Web site: VIA Padlock Security Engine . VIA . 2011-11-14 . 2011-05-15 . https://web.archive.org/web/20110515073323/http://www.via.com.tw/en/initiatives/padlock/hardware.jsp#aes . dead .
  17. http://wiki.openwrt.org/doc/hardware/cryptographic.hardware.accelerators Cryptographic Hardware Accelerators
  18. Web site: VIA Eden-N Processors . VIA . 2011-11-14 . dead . https://web.archive.org/web/20111111212545/http://www.via.com.tw/en/products/processors/eden-n/ . 2011-11-11 .
  19. Web site: VIA C7 Processors . VIA . 2011-11-14 . 2007-04-19 . https://web.archive.org/web/20070419142654/http://www.via.com.tw/en/products/processors/c7-m/ . dead .
  20. Web site: Arm Architecture Reference Manual Armv8, for Armv8-A architecture profile. ARM. 22 January 2021.
  21. Web site: Security System/Crypto Engine driver status. sunxi.montjoie.ovh.
  22. Web site: Linux Cryptographic Acceleration on an i.MX6. Linux Foundation. February 2017. 2018-05-02. https://web.archive.org/web/20190826043222/http://events17.linuxfoundation.org/sites/events/files/slides/2017-02%20-%20ELC%20-%20Hudson%20-%20Linux%20Cryptographic%20Acceleration%20on%20an%20MX6.pdf. 2019-08-26. dead.
  23. Web site: Cryptographic module in Snapdragon 805 is FIPS 140-2 certified . Qualcomm.
  24. Web site: RK3128 - Rockchip Wiki. Rockchip wiki. 2018-05-02. https://web.archive.org/web/20190128135332/http://rockchip.wikidot.com/rk3128. 2019-01-28. dead.
  25. Web site: The Samsung Exynos 7420 Deep Dive - Inside A Modern 14nm SoC . AnandTech.
  26. Web site: Sipeed M1 Datasheet v1.1. 2019-03-06. 2021-05-03. kamami.pl.
  27. Web site: ESP32 Series Datasheet. 2021-03-19. 2021-05-03. www.espressif.com.
  28. Web site: ESP32-C3 WiFi & BLE RISC-V processor is pin-to-pin compatible with ESP8266. 2020-11-22. CNX-Software.
  29. Web site: BL602-Bouffalo Lab (Nanjing) Co., Ltd.. 2021-05-03. www.bouffalolab.com. 2021-06-18. https://web.archive.org/web/20210618105735/https://www.bouffalolab.com/bl602. dead.
  30. Web site: Power ISA Version 2.07 B. 2022-01-07.
  31. Web site: IBM System z10 cryptography. IBM. 2014-01-27.
  32. Web site: Using the XMEGA built-in AES accelerator. 2014-12-03.
  33. Web site: Cavium Networks Launches Industry's Broadest Line of Single and Dual Core MIPS64-based OCTEON Processors Targeting Intelligent Next Generation Networks . 2016-09-17 . https://web.archive.org/web/20171207224755/http://cavium.com/newsevents_OCTEONMIPS64.html . 2017-12-07 . dead .
  34. Web site: AES-NI Performance Analyzed. Tom's Hardware. 2010. P. Schmid and A. Roos . 2010-08-10.
  35. Web site: How to get fast AES calls?. T. Krovetz, W. Dai. Crypto++ user group . 2010. 2010-08-11.
  36. Web site: Crypto++ 5.6.0 Pentium 4 Benchmarks. Crypto++ Website. 2009. 2010-08-10. https://web.archive.org/web/20100919121759/http://cryptopp.com/benchmarks-p4.html. 19 September 2010 . live.
  37. Web site: NonStop SSH Reference Manual . 2020-04-09.
  38. Web site: NonStop cF SSL Library Reference Manual . 2020-04-09.
  39. Web site: BackBox H4.08Tape Encryption Option . 2020-04-09.
  40. Web site: Intel Advanced Encryption Standard Instructions (AES-NI) . March 2, 2010 . Intel . 2010-07-11. https://web.archive.org/web/20100707065952/https://software.intel.com/en-us/articles/intel-advanced-encryption-standard-instructions-aes-ni/. 7 July 2010. live.
  41. Web site: AES-NI enhancements to NSS on Sandy Bridge systems . 2012-05-02 . 2012-11-25 .
  42. Web site: System Administration Guide: Security Services, Chapter 13 Solaris Cryptographic Framework (Overview). September 2010. Oracle. 2012-11-27.
  43. Web site: FreeBSD 8.2 Release Notes . FreeBSD.org . 2011-02-24 . 2011-12-18 . 2011-04-12 . https://web.archive.org/web/20110412153215/http://www.freebsd.org/releases/8.2R/relnotes.html . dead .
  44. https://archive.today/20120707203035/http://cvs.openssl.org/fileview?f=openssl/CHANGES&v=1.1686 OpenSSL: CVS Web Interface
  45. Web site: Cryptographic Backend (GnuTLS 3.6.14). 2020-06-26. gnutls.org.
  46. Web site: AES-GCM in libsodium. libsodium.org.
  47. Web site: Hardware Acceleration. www.veracrypt.fr.
  48. Web site: aes - The Go Programming Language. 2020-06-26. golang.org.
  49. Web site: Shimpi. Anand Lal. The Clarkdale Review: Intel's Core i5 661, i3 540 & i3 530. 2020-06-26. www.anandtech.com.
  50. Web site: Bloombase StoreSafe Intelligent Storage Firewall.
  51. Web site: Vormetric Encryption Adds Support for Intel AES-NI Acceleration Technology. 15 May 2012 .
  52. Web site: Saarinen . Markku-Juhani O. . mjosaarinen/sm4ni: Demonstration that AES-NI instructions can be used to implement the Chinese Encryption Standard SM4 . GitHub . 17 April 2020.
  53. M.Sc. . Kivilinna . Jussi . 2013 . Block Ciphers: Fast Implementations on x86-64 Architecture . 33,42 . . 2017-06-22.
  54. Yoo . Tae-Hee . Kivilinna . Jussi . Cho . Choong-Hee . 2023 . AVX-Based Acceleration of ARIA Block Cipher Algorithm . IEEE Access . 11 . 77403–77415 . 10.1109/ACCESS.2023.3298026 . free . 2023IEEEA..1177403Y .
  55. Web site: Kivilinna . Jussi . camellia-simd-aesni . . 19 April 2023 . Newer x86-64 processors also support Galois Field New Instructions (GFNI) which allow implementing Camellia s-box more straightforward manner and yield even better performance..
  56. Web site: Wu . Hongjun . Preneel . Bart . AEGIS: A Fast Authenticated Encryption Algorithm (v1.1) .
  57. Web site: Denis . Frank . The AEGIS Family of Authenticated Encryption Algorithms . cfrg.github.io . en.

This article is licensed under the GNU Free Documentation License. It uses material from the Wikipedia article "AES instruction set".

Except where otherwise indicated, Everything.Explained.Today is © Copyright 2009-2024, A B Cryer, All Rights Reserved. Cookie policy.