AES instruction set

An Advanced Encryption Standard instruction set is now integrated into many processors. The purpose of the instruction set is to improve the speed and security of applications performing encryption and decryption using the Advanced Encryption Standard (AES).

They are often implemented as instructions implementing a single round of AES along with a special version for the last round which has a slightly different method.

The side channel attack surface of AES is reduced when implemented in an instruction set, compared to when AES is implemented in software only.

x86 architecture processors

AES-NI (or the Intel Advanced Encryption Standard New Instructions; AES-NI) was the first major implementation. AES-NI is an extension to the x86 instruction set architecture for microprocessors from Intel and AMD proposed by Intel in March 2008.[1]

A wider version of AES-NI, AVX-512 Vector AES instructions (VAES), is found in AVX-512.[2]

Instructions
Instruction Description[3]
AESENC Perform one round of an AES encryption flow
AESENCLAST Perform the last round of an AES encryption flow
AESDEC Perform one round of an AES decryption flow
AESDECLAST Perform the last round of an AES decryption flow
AESKEYGENASSIST Assist in AES round key generation[note 1]
AESIMC Assist in AES decryption round key generation. Applies Inverse Mix Columns to round keys.

Intel

The following Intel processors support the AES-NI instruction set:[4]

  • Westmere based processors, specifically:
    • Westmere-EP (a.k.a. Gulftown Xeon 5600-series DP server model) processors
    • Clarkdale processors (except Core i3, Pentium and Celeron)
    • Arrandale processors (except Celeron, Pentium, Core i3, Core i5-4XXM)
  • Sandy Bridge processors:
    • Desktop: all except Pentium, Celeron, Core i3[5][6]
    • Mobile: all Core i7 and Core i5. Several vendors have shipped BIOS configurations with the extension disabled;[7] a BIOS update is required to enable them.[8]
  • Ivy Bridge processors
    • All i5, i7, Xeon and i3-2115C[9] only
  • Haswell processors (all except i3-4000m,[10] Pentium and Celeron)
  • Broadwell processors (all except Pentium and Celeron)
  • Silvermont/Airmont processors (all except Bay Trail-D and Bay Trail-M)
  • Goldmont (and later) processors
  • Skylake (and later) processors

AMD

Several AMD processors support AES instructions:

Hardware acceleration in other architectures

AES support with unprivileged processor instructions is also available in the latest SPARC processors (T3, T4, T5, M5, and forward) and in latest ARM processors. The SPARC T4 processor, introduced in 2011, has user-level instructions implementing AES rounds.[12] These instructions are in addition to higher level encryption commands. The ARMv8-A processor architecture, announced in 2011, including the ARM Cortex-A53 and A57 (but not previous v7 processors like the Cortex A5, 7, 8, 9, 11, 15 ) also have user-level instructions which implement AES rounds.[13]

Supporting x86 CPUs

VIA x86 CPUs, AMD Geode, and Marvell Kirkwood (ARM, mv_cesa in Linux) use driver-based accelerated AES handling instead. (See Crypto API (Linux).)

The following chips, while supporting AES hardware acceleration, do not support AES-NI:

ARM architecture

Programming information is available in ARM Architecture Reference Manual ARMv8, for ARMv8-A architecture profile (Section A2.3 "The Armv8 Cryptographic Extension").[19]

  • ARMv8-A architecture
    • ARM cryptographic extensions optionally supported on ARM Cortex-A30/50/70 cores
  • Cryptographic hardware accelerators/engines

RISC-V architecture

Whilst the RISC-V architecture does not include AES-specific instructions, a number of RISC-V chips include integrated AES co-processors. Examples include:

  • Dual-core RISC-V 64 bits Sipeed-M1 support AES and SHA256.[25]
  • RISC-V architecture based ESP32-C (as well as Xtensa-based ESP32[26]), support AES, SHA, RSA, RNG, HMAC, digital signature and XTS 128 for flash.[27]
  • Bouffalo Labs BL602/604 32-bit RISC-V supports various AES and SHA variants.[28]

POWER architecture

Since the Power ISA v.2.07, the instructions vcipher and vcipyherlast implement one round of AES directly.[29]

IBM z/Architecture

IBM z9 or later mainframe processors support AES as single-opcode (KM, KMC) AES ECB/CBC instructions via IBM's CryptoExpress hardware.[30] These single-instruction AES versions are therefore easier to use than Intel NI ones, but may not be extended to implement other algorithms based on AES round functions (such as the Whirlpool and Grøstl hash functions).

Other architectures
  • Atmel XMEGA[31] (on-chip accelerator with parallel execution, not an instruction)
  • SPARC T3 and later processors have hardware support for several cryptographic algorithms, including AES.
  • Cavium Octeon MIPS[32] All Cavium Octeon MIPS-based processors have hardware support for several cryptographic algorithms, including AES using special coprocessor 3 instructions.

Performance

In AES-NI Performance Analyzed, Patrick Schmid and Achim Roos found "impressive results from a handful of applications already optimized to take advantage of Intel's AES-NI capability".[33] A performance analysis using the Crypto++ security library showed an increase in throughput from approximately 28.0 cycles per byte to 3.5 cycles per byte with AES/GCM versus a Pentium 4 with no acceleration.[34][35]

Supporting software

Most modern compilers can emit AES instructions.

Much security and cryptography software supports the AES instruction set, including the following notable core infrastructure:

A fringe use of the AES instruction set involves using it on block ciphers with a similarly-structured S-box, using affine isomorphism to convert between the two. SM4 and Camellia have been accelerated using AES-NI.[51][52] The AVX-512 Galois Field New Instructions (GFNI) allows implementing these S-boxes in a more direct way.[53]

See also

Notes
  1. The instruction computes 4 parallel subexpressions of AES key expansion on 4 32-bit words in a double quadword (aka SSE register) on bits X[127:96] for and X[63:32] for only. Two parallel AES S-box substitutions and are used in AES-256 and 2 subexpressions and are used in AES-128, AES-192, AES-256.

References
  1. "Intel Software Network". Intel. Archived from the original on 7 April 2008. Retrieved 2008-04-05.
  2. "Intel® Architecture Instruction Set Extensions and Future Features Programming Reference". Intel. Retrieved October 16, 2017.
  3. Shay Gueron (2010). "Intel Advanced Encryption Standard (AES) Instruction Set White Paper" (PDF). Intel. Retrieved 2012-09-20.
  4. "Intel Product Specification Advanced Search". Intel ARK.
  5. Shimpi, Anand Lal. "The Sandy Bridge Review: Intel Core i7-2600K, i5-2500K and Core i3-2100 Tested".
  6. "Intel Product Specification Comparison".
  7. "AES-NI support in TrueCrypt (Sandy Bridge problem)". 27 January 2022.
  8. "Some products can support AES New Instructions with a Processor Configuration update, in particular, i7-2630QM/i7-2635QM, i7-2670QM/i7-2675QM, i5-2430M/i5-2435M, i5-2410M/i5-2415M. Please contact OEM for the BIOS that includes the latest Processor configuration update".
  9. "Intel Core i3-2115C Processor (3M Cache, 2.00 GHz) Product Specifications".
  10. "Intel Core i3-4000M Processor (3M Cache, 2.40 GHz) Product Specifications".
  11. "Following Instructions". AMD. November 22, 2010. Archived from the original on November 26, 2010. Retrieved 2011-01-04.
  12. Dan Anderson (2011). "SPARC T4 OpenSSL Engine". Oracle. Retrieved 2012-09-20.
  13. Richard Grisenthwaite (2011). "ARMv8-A Technology Preview" (PDF). ARM. Archived from the original (PDF) on 2018-06-10. Retrieved 2012-09-20.
  14. "AMD Geode LX Processor Family Technical Specifications". AMD.
  15. "VIA Padlock Security Engine". VIA. Archived from the original on 2011-05-15. Retrieved 2011-11-14.
  16. Cryptographic Hardware Accelerators on OpenWRT.org
  17. "VIA Eden-N Processors". VIA. Archived from the original on 2011-11-11. Retrieved 2011-11-14.
  18. "VIA C7 Processors". VIA. Archived from the original on 2007-04-19. Retrieved 2011-11-14.
  19. "Arm Architecture Reference Manual Armv8, for Armv8-A architecture profile". ARM. 22 January 2021.
  20. "Security System/Crypto Engine driver status". sunxi.montjoie.ovh.
  21. "Linux Cryptographic Acceleration on an i.MX6" (PDF). Linux Foundation. February 2017. Archived from the original (PDF) on 2019-08-26. Retrieved 2018-05-02.
  22. "Cryptographic module in Snapdragon 805 is FIPS 140-2 certified". Qualcomm.
  23. "RK3128 - Rockchip Wiki". Rockchip wiki. Archived from the original on 2019-01-28. Retrieved 2018-05-02.
  24. "The Samsung Exynos 7420 Deep Dive - Inside A Modern 14nm SoC". AnandTech.
  25. "Sipeed M1 Datasheet v1.1" (PDF). kamami.pl. 2019-03-06. Retrieved 2021-05-03.
  26. "ESP32 Series Datasheet" (PDF). www.espressif.com. 2021-03-19. Retrieved 2021-05-03.
  27. "ESP32-C3 WiFi & BLE RISC-V processor is pin-to-pin compatible with ESP8266". CNX-Software. Retrieved 2020-11-22.
  28. "BL602-Bouffalo Lab (Nanjing) Co., Ltd". www.bouffalolab.com. Retrieved 2021-05-03.
  29. "Power ISA™ Version 2.07 B". Retrieved 2022-01-07.
  30. "IBM System z10 cryptography". IBM. Retrieved 2014-01-27.
  31. "Using the XMEGA built-in AES accelerator" (PDF). Retrieved 2014-12-03.
  32. "Cavium Networks Launches Industry's Broadest Line of Single and Dual Core MIPS64-based OCTEON Processors Targeting Intelligent Next Generation Networks". Archived from the original on 2017-12-07. Retrieved 2016-09-17.
  33. P. Schmid and A. Roos (2010). "AES-NI Performance Analyzed". Tom's Hardware. Retrieved 2010-08-10.
  34. T. Krovetz, W. Dai (2010). "How to get fast AES calls?". Crypto++ user group. Retrieved 2010-08-11.
  35. "Crypto++ 5.6.0 Pentium 4 Benchmarks". Crypto++ Website. 2009. Archived from the original on 19 September 2010. Retrieved 2010-08-10.
  36. "NonStop SSH Reference Manual". Retrieved 2020-04-09.
  37. "NonStop cF SSL Library Reference Manual". Retrieved 2020-04-09.
  38. "BackBox H4.08Tape Encryption Option". Retrieved 2020-04-09.
  39. "Intel Advanced Encryption Standard Instructions (AES-NI)". Intel. March 2, 2010. Archived from the original on 7 July 2010. Retrieved 2010-07-11.
  40. "AES-NI enhancements to NSS on Sandy Bridge systems". 2012-05-02. Retrieved 2012-11-25.
  41. "System Administration Guide: Security Services, Chapter 13 Solaris Cryptographic Framework (Overview)". Oracle. September 2010. Retrieved 2012-11-27.
  42. "FreeBSD 8.2 Release Notes". FreeBSD.org. 2011-02-24. Archived from the original on 2011-04-12. Retrieved 2011-12-18.
  43. OpenSSL: CVS Web Interface
  44. "Cryptographic Backend (GnuTLS 3.6.14)". gnutls.org. Retrieved 2020-06-26.
  45. "AES-GCM in libsodium". libsodium.org.
  46. "Hardware Acceleration". www.veracrypt.fr.
  47. "aes - The Go Programming Language". golang.org. Retrieved 2020-06-26.
  48. Shimpi, Anand Lal. "The Clarkdale Review: Intel's Core i5 661, i3 540 & i3 530". www.anandtech.com. Retrieved 2020-06-26.
  49. "Bloombase StoreSafe Intelligent Storage Firewall".
  50. "Vormetric Encryption Adds Support for Intel AES-NI Acceleration Technology". 15 May 2012.
  51. Saarinen, Markku-Juhani O. (17 April 2020). "mjosaarinen/sm4ni: Demonstration that AES-NI instructions can be used to implement the Chinese Encryption Standard SM4". GitHub.
  52. Kivilinna, Jussi (2013). Block Ciphers: Fast Implementations on x86-64 Architecture (PDF) (M.Sc.). University of Oulu. pp. 33, 42. Retrieved 2017-06-22.
  53. Kivilinna, Jussi (19 April 2023). "camellia-simd-aesni". GitHub. Newer x86-64 processors also support Galois Field New Instructions (GFNI) which allow implementing Camellia s-box more straightforward manner and yield even better performance.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.