Instruction set extensions accelerating AES operations
AnAdvanced Encryption Standard instruction set (AES instruction set) is a set of instructions that are specifically designed to performAES encryption and decryption operations efficiently. These instructions are typically found in modern processors and can greatly accelerate AES operations compared to software implementations. An AES instruction set includes instructions forkey expansion, encryption, and decryption using various key sizes (128-bit, 192-bit, and 256-bit).
The instruction set is often implemented as a set of instructions that can perform a single round of AES along with a special version for the last round which has a slightly different method.
When AES is implemented as an instruction set instead of as software, it can have improved security, as itsside channel attack surface is reduced.[1]
AES-NI (or the IntelAdvanced Encryption Standard New Instructions;AES-NI) was the first major implementation. AES-NI is an extension to thex86instruction set architecture formicroprocessors fromIntel andAMD proposed by Intel in March 2008.[2]
Desktop: all except Pentium, Celeron, Core i3[6][7]
Mobile: all Core i7 and Core i5. Several vendors have shippedBIOS configurations with the extension disabled;[8] a BIOS update is required to enable them.[9]
AES support with unprivileged processor instructions is also available in the latestSPARC processors (T3,T4,T5, M5, and forward) and in latestARM processors. TheSPARC T4 processor, introduced in 2011, has user-level instructions implementing AES rounds.[13] These instructions are in addition to higher level encryption commands. TheARMv8-A processor architecture, announced in 2011, including the ARM Cortex-A53 and A57 (but not previous v7 processors like the Cortex A5, 7, 8, 9, 11, 15[citation needed]) also have user-level instructions which implement AES rounds.[14]
x86 CPUs offering non-AES-NI acceleration interfaces
Programming information is available inARM Architecture Reference Manual ARMv8, for ARMv8-A architecture profile (Section A2.3 "The Armv8 Cryptographic Extension").[20]
The Marvell Kirkwood was the embedded core of a range of SoC fromMarvell Technology, these SoC CPUs (ARM, mv_cesa in Linux) use driver-based accelerated AES handling. (SeeCrypto API (Linux).)
ARMv8-A architecture
ARM cryptographic extensions are optionally supported on ARM Cortex-A30/50/70 cores
The scalar and vector cryptographic instruction set extensions for the RISC-V architecture were ratified respectively on 2022 and 2023, which allowed RISC-V processors to implement hardware acceleration for AES,GHASH,SHA-256,SHA-512,SM3, andSM4.
Before the AES-specific instructions were available on RISC-V, a number of RISC-V chips included integrated AES co-processors. Examples include:
Dual-coreRISC-V 64 bits Sipeed-M1 support AES and SHA256.[26]
RISC-V architecture basedESP32-C (as well as Xtensa-based ESP32[27]), support AES, SHA, RSA, RNG, HMAC, digital signature and XTS 128 for flash.[28]
Bouffalo Labs BL602/604 32-bit RISC-V supports various AES and SHA variants.[29]
IBM z9 or later mainframe processors support AES as single-opcode (KM, KMC) AES ECB/CBC instructions via IBM's CryptoExpress hardware.[31] These single-instruction AES versions are therefore easier to use than Intel NI ones, but may not be extended to implement other algorithms based on AES round functions (such as theWhirlpool andGrøstl hash functions).
Atmel XMEGA[32] (on-chip accelerator with parallel execution, not an instruction)
SPARC T3 and later processors have hardware support for several cryptographic algorithms, including AES.
Cavium Octeon MIPS[33] All Cavium Octeon MIPS-based processors have hardware support for several cryptographic algorithms, including AES using special coprocessor 3 instructions.
InAES-NI Performance Analyzed, Patrick Schmid and Achim Roos found "impressive results from a handful of applications already optimized to take advantage of Intel's AES-NI capability".[34] A performance analysis using theCrypto++security library showed an increase in throughput from approximately 28.0 cycles per byte to 3.5 cycles per byte withAES/GCM versus aPentium 4 with no acceleration.[35][36][failed verification][better source needed]
New cryptographic algorithms have been constructed to specifically use parts of the AES algorithm, so that the AES instruction set can be used for speedups. The AEGIS family, which offersauthenticated encryption, runs with at least twice the speed of AES.[56] AEGIS is an "additional finalist for high-performance applications" in theCAESAR Competition.[57]
^The instruction computes 4 parallel subexpressions ofAES key expansion on 4 32-bit words in a double quadword (aka SSE register) on bits X[127:96] for and X[63:32] for only. Two parallelAES S-box substitutions and are used in AES-256 and 2 subexpressions and are used in AES-128, AES-192, AES-256.
^Kivilinna, Jussi (19 April 2023)."camellia-simd-aesni".GitHub.Newer x86-64 processors also support Galois Field New Instructions (GFNI) which allow implementing Camellia s-box more straightforward manner and yield even better performance.
