An Advanced Encryption Standard instruction set is now integrated into many processors. The purpose of the instruction set is to improve the speed and security of applications performing encryption and decryption using

Advanced Encryption Standard The Advanced Encryption Standard (AES), also known by its original name Rijndael (), is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001. AES is a variant ...

(AES). They are often implemented as instructions implementing a single round of AES along with a special version for the last round which has a slightly different method. The

side channel attack In computer security, a side-channel attack is any attack based on extra information that can be gathered because of the fundamental way a computer protocol or algorithm is implemented, rather than flaws in the design of the protocol or algorit ...

surface of AES is reduced when implemented in an instruction set, compared to when AES is implemented in software only.

x86 architecture processors

AES-NI (or the Intel Advanced Encryption Standard New Instructions; AES-NI) was the first major implementation. AES-NI is an extension to the

x86 x86 (also known as 80x86 or the 8086 family) is a family of complex instruction set computer (CISC) instruction set architectures initially developed by Intel based on the Intel 8086 microprocessor and its 8088 variant. The 8086 was introd ...

instruction set architecture In computer science, an instruction set architecture (ISA), also called computer architecture, is an abstract model of a computer. A device that executes instructions described by that ISA, such as a central processing unit (CPU), is called an ' ...

for

microprocessor A microprocessor is a computer processor where the data processing logic and control is included on a single integrated circuit, or a small number of integrated circuits. The microprocessor contains the arithmetic, logic, and control circu ...

s from

Intel Intel Corporation is an American multinational corporation and technology company headquartered in Santa Clara, California. It is the world's largest semiconductor chip manufacturer by revenue, and is one of the developers of the x86 seri ...

and

AMD Advanced Micro Devices, Inc. (AMD) is an American multinational semiconductor company based in Santa Clara, California, that develops computer processors and related technologies for business and consumer markets. While it initially manufactur ...

proposed by Intel in March 2008.

Instructions

Intel

The following

processors support the AES-NI instruction set: * Westmere based processors, specifically: ** Westmere-EP (a.k.a.

Gulftown Gulftown or Westmere-EP is the codename of an up to six-core hyperthreaded Intel processor able to run up to 12 threads in parallel. It is based on Westmere microarchitecture, the 32 nm shrink of Nehalem. Originally rumored to be called the Int ...

Xeon 5600-series DP server model) processors ** Clarkdale processors (except Core i3, Pentium and Celeron) **

Arrandale Arrandale is the code name for a family of mobile Intel processors, sold as mobile Intel Core i3, i5 and i7 as well as Celeron and Pentium. It is closely related to the desktop Clarkdale processor; both use dual-core dies based on the '' Westme ...

processors (except Celeron, Pentium, Core i3, Core i5-4XXM) *

Sandy Bridge Sandy Bridge is the codename for Intel's 32 nm microarchitecture used in the second generation of the Intel Core processors (Core i7, i5, i3). The Sandy Bridge microarchitecture is the successor to Nehalem and Westmere microarchitecture ...

processors: ** Desktop: all except Pentium, Celeron, Core i3 ** Mobile: all Core i7 and Core i5. Several vendors have shipped

BIOS In computing, BIOS (, ; Basic Input/Output System, also known as the System BIOS, ROM BIOS, BIOS ROM or PC BIOS) is firmware used to provide runtime services for operating systems and programs and to perform hardware initialization during the ...

configurations with the extension disabled; a BIOS update is required to enable them. * Ivy Bridge processors ** All i5, i7, Xeon and i3-2115C only * Haswell processors (all except i3-4000m, Pentium and Celeron) * Broadwell processors (all except Pentium and Celeron) * Silvermont/Airmont processors (all except Bay Trail-D and Bay Trail-M) *

Goldmont Goldmont is a microarchitecture for low-power Atom, Celeron and Pentium branded processors used in systems on a chip (SoCs) made by Intel. They allow only one thread per core. The ''Apollo Lake'' platform with 14 nm Goldmont core was un ...

(and later) processors * Skylake (and later) processors

AMD

Several

processors support AES instructions: *

Jaguar The jaguar (''Panthera onca'') is a large cat species and the only living member of the genus '' Panthera'' native to the Americas. With a body length of up to and a weight of up to , it is the largest cat species in the Americas and the th ...

processors and newer * Puma processors and newer * "Heavy Equipment" processors **

Bulldozer A bulldozer or dozer (also called a crawler) is a large, motorized machine equipped with a metal blade to the front for pushing material: soil, sand, snow, rubble, or rock during construction work. It travels most commonly on continuous track ...

processors ** Piledriver processors **

Steamroller A steamroller (or steam roller) is a form of road roller – a type of heavy construction machinery used for leveling surfaces, such as roads or airfields – that is powered by a steam engine. The leveling/flattening action is achieved through ...

processors **

Excavator Excavators are heavy construction equipment consisting of a boom, dipper (or stick), bucket and cab on a rotating platform known as the "house". The house sits atop an undercarriage with tracks or wheels. They are a natural progression fro ...

processors and newer *

Zen Zen ( zh, t=禪, p=Chán; ja, text= 禅, translit=zen; ko, text=선, translit=Seon; vi, text=Thiền) is a school of Mahayana Buddhism that originated in China during the Tang dynasty, known as the Chan School (''Chánzong'' 禪宗), and ...

(and later) based processors

Hardware acceleration in other architectures

AES support with unprivileged processor instructions is also available in the latest

SPARC SPARC (Scalable Processor Architecture) is a reduced instruction set computer (RISC) instruction set architecture originally developed by Sun Microsystems. Its design was strongly influenced by the experimental Berkeley RISC system developed ...

processors ( T3, T4, T5, M5, and forward) and in latest

ARM In human anatomy, the arm refers to the upper limb in common usage, although academically the term specifically means the upper arm between the glenohumeral joint (shoulder joint) and the elbow joint. The distal part of the upper limb between th ...

processors. The

SPARC T4 The SPARC T4 is a SPARC multicore microprocessor introduced in 2011 by Oracle Corporation. The processor is designed to offer high multithreaded performance (8 threads per core, with 8 cores per chip), as well as high single threaded performan ...

processor, introduced in 2011, has user-level instructions implementing AES rounds. These instructions are in addition to higher level encryption commands. The

ARMv8-A ARM (stylised in lowercase as arm, formerly an acronym for Advanced RISC Machines and originally Acorn RISC Machine) is a family of reduced instruction set computer (RISC) instruction set architectures for computer processors, configured ...

processor architecture, announced in 2011, including the ARM Cortex-A53 and A57 (but not previous v7 processors like the Cortex A5, 7, 8, 9, 11, 15 ) also have user-level instructions which implement AES rounds.

Supporting x86 CPUs

VIA x86 CPUs,

AMD Geode Geode was a series of x86-compatible system-on-a-chip microprocessors and I/O companions produced by AMD, targeted at the embedded computing market. The series was originally launched by National Semiconductor as the Geode family in 1999. The or ...

, and Marvell Kirkwood (ARM, mv_cesa in Linux) use driver-based accelerated AES handling instead. (See

Crypto API (Linux) Crypto API is a cryptography framework in the Linux kernel, for various parts of the kernel that deal with cryptography, such as IPsec and dm-crypt. It was introduced in kernel version 2.5.45 and has since expanded to include essentially all popular ...

.) The following chips, while supporting AES hardware acceleration, do not support AES-NI: * AMD Geode LX processors *

VIA Via or VIA may refer to the following: Science and technology * MOS Technology 6522, Versatile Interface Adapter * ''Via'' (moth), a genus of moths in the family Noctuidae * Via (electronics), a through-connection * VIA Technologies, a Taiwan ...

, using

VIA PadLock VIA PadLock is a central processing unit (CPU) instruction set extension to the x86 microprocessor instruction set architecture (ISA) found on processors produced by VIA Technologies and Zhaoxin. Introduced in 2003 with the VIA Centaur CPUs, the ...

Cryptographic Hardware Accelerators
on OpenWRT.org ** VIA C3 Nehemiah C5P (Eden-N) processors ** VIA C7 Esther C5J processors

ARM architecture

Programming information is available in ''ARM Architecture Reference Manual ARMv8, for ARMv8-A architecture profile (Section A2.3 "The Armv8 Cryptographic Extension")''. * ARMv8-A architecture ** ARM cryptographic extensions optionally supported on ARM Cortex-A30/50/70 cores * Cryptographic hardware accelerators/engines **

Allwinner Allwinner Technology Co., Ltd is a fabless semiconductor company that designs mixed-signal systems on a chip (SoC). The company is headquartered in Zhuhai, Guangdong, China. It has a sales and technical support office in Shenzhen, Guangdong, an ...

*** A10, A20, A30, A31, A80, A83T, H3 and A64 using ''Security System'' **

Broadcom Broadcom Inc. is an American designer, developer, manufacturer and global supplier of a wide range of semiconductor and infrastructure software products. Broadcom's product offerings serve the data center, networking, software, broadband, wirel ...

*** BCM5801/BCM5805/BCM5820 using ''Security Processor'' **

NXP Semiconductors NXP Semiconductors N.V. (NXP) is a Dutch semiconductor designer and manufacturer with headquarters in Eindhoven, Netherlands. The company employs approximately 31,000 people in more than 30 countries. NXP reported revenue of $11.06 billion in 2 ...

*** i.MX6 onwards **

Qualcomm Qualcomm () is an American multinational corporation headquartered in San Diego, California, and incorporated in Delaware. It creates semiconductors, software, and services related to wireless technology. It owns patents critical to the 5G, 4 ...

*** Snapdragon 805 onwards **

Rockchip Rockchip (Fuzhou Rockchip Electronics Co., Ltd.) is a Chinese fabless semiconductor company based in Fuzhou, Fujian province. Rockchip has been providing SoC products for tablets & PCs, streaming media TV boxes, AI audio & vision, IoT hardware ...

*** RK30xx series onwards **

Samsung The Samsung Group (or simply Samsung) ( ko, 삼성 ) is a South Korean multinational manufacturing conglomerate headquartered in Samsung Town, Seoul, South Korea. It comprises numerous affiliated businesses, most of them united under the ...

*** Exynos 3 series onwards

RISC-V architecture

Whilst the RISC-V architecture doesn't include AES-specific instructions, a number of RISC-V chips include integrated AES co-processors. Examples include: * Dual-core

RISC-V RISC-V (pronounced "risk-five" where five refers to the number of generations of RISC architecture that were developed at the University of California, Berkeley since 1981) is an open standard instruction set architecture (ISA) based on estab ...

64 bits Sipeed-M1 support AES and SHA256. * RISC-V architecture based

ESP32 ESP32 is a series of low-cost, low-power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. The ESP32 series employs either a Tensilica Xtensa LX6 microprocessor in both dual-core and single-core variations, Xtensa L ...

-C (as well as Xtensa-based ESP32), support AES, SHA, RSA, RNG, HMAC, digital signature and XTS 128 for flash. * Bouffalo Labs BL602/604 32-bit RISC-V supports various AES and SHA variants.

POWER architecture

Since the Power ISA v.2.07, the instructions vcipher and vcipyherlast implement one round of AES directly.

IBM z/Architecture

IBM z9 or later mainframe processors support AES as single-opcode (KM, KMC) AES ECB/CBC instructions via IBM's CryptoExpress hardware. These single-instruction AES versions are therefore easier to use than Intel NI ones, but may not be extended to implement other algorithms based on AES round functions (such as the

Whirlpool A whirlpool is a body of rotating water produced by opposing currents or a current running into an obstacle. Small whirlpools form when a bath or a sink is draining. More powerful ones formed in seas or oceans may be called maelstroms ( ). ''Vo ...

and

Grøstl Grøstl is a cryptographic hash function submitted to the NIST hash function competition by Praveen Gauravaram, Lars Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer, and Søren S. Thomsen. Grøstl was chosen ...

hash functions).

Other architectures

* Atmel XMEGA (on-chip accelerator with parallel execution, not an instruction) *

SPARC T3 The SPARC T3 microprocessor (previously known as UltraSPARC T3, codenamed ''Rainbow Falls'', and also known as UltraSPARC KT or ''Niagara-3'' during development) is a multithreading, multi-core CPU produced by Oracle Corporation (previously Sun Mi ...

and later processors have hardware support for several cryptographic algorithms, including AES. *

Cavium Octeon MIPS Cavium was a fabless semiconductor company based in San Jose, California, specializing in ARM-based and MIPS-based network, video and security processors and SoCs. The company was co-founded in 2000 by Syed B. Ali and M. Raghib Hussain, who we ...

All Cavium Octeon MIPS-based processors have hardware support for several cryptographic algorithms, including AES using special coprocessor 3 instructions.

Performance

In ''AES-NI Performance Analyzed'', Patrick Schmid and Achim Roos found "impressive results from a handful of applications already optimized to take advantage of Intel's AES-NI capability". A performance analysis using the

Crypto++ Crypto++ (also known as CryptoPP, libcrypto++, and libcryptopp) is a free and open-source C++ class library of cryptographic algorithms and schemes written by Wei Dai. Crypto++ has been widely used in academia, student projects, open-source, and no ...

security library showed an increase in throughput from approximately 28.0 cycles per byte to 3.5 cycles per byte with AES/ GCM versus a

Pentium 4 Pentium 4 is a series of single-core CPUs for desktops, laptops and entry-level servers manufactured by Intel. The processors were shipped from November 20, 2000 until August 8, 2008. The production of Netburst processors was active from 2000 ...

with no acceleration.

Supporting software

Most modern compilers can emit AES instructions. Much security and cryptography software supports the AES instruction set, including the following notable core infrastructure: * Apple's FileVault 2 full-disk encryption in

macOS macOS (; previously OS X and originally Mac OS X) is a Unix operating system developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple's Mac computers. Within the market of desktop and lapt ...

10.10+ * NonStop SSH2, NonStop cF SSL Library and BackBox VTC Software in HPE Tandem NonStop OS L-series * Cryptography API: Next Generation (CNG) (requires Windows 7) * Linux's Crypto API *

Java Java (; id, Jawa, ; jv, ꦗꦮ; su, ) is one of the Greater Sunda Islands in Indonesia. It is bordered by the Indian Ocean to the south and the Java Sea to the north. With a population of 151.6 million people, Java is the world's List ...

7 HotSpot *

Network Security Services Network Security Services (NSS) is a collection of cryptographic computer libraries designed to support cross-platform development of security-enabled client and server applications with optional support for hardware TLS/SSL acceleration on the ...

(NSS) version 3.13 and above (used by

Firefox Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation. It uses the Gecko rendering engine to display web pages, which implements current and ...

and

Google Chrome Google Chrome is a cross-platform web browser developed by Google. It was first released in 2008 for Microsoft Windows, built with free software components from Apple WebKit and Mozilla Firefox. Versions were later released for Linux, macOS ...

) * Solaris Cryptographic Framework on

Solaris Solaris may refer to: Arts and entertainment Literature, television and film * ''Solaris'' (novel), a 1961 science fiction novel by Stanisław Lem ** ''Solaris'' (1968 film), directed by Boris Nirenburg ** ''Solaris'' (1972 film), directed by ...

10 onwards *

FreeBSD FreeBSD is a free and open-source Unix-like operating system descended from the Berkeley Software Distribution (BSD), which was based on Research Unix. The first version of FreeBSD was released in 1993. In 2005, FreeBSD was the most popular ...

's OpenCrypto API (aesni(4) driver) *

OpenSSL OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping or need to identify the party at the other end. It is widely used by Internet servers, including the majority of HTT ...

1.0.1 and above *

GnuTLS GnuTLS (, the GNU Transport Layer Security Library) is a free software implementation of the TLS, SSL and DTLS protocols. It offers an application programming interface (API) for applications to enable secure communication over the network trans ...

Libsodium NaCl (pronounced "salt") is an abbreviation for "Networking and Cryptography library", a public domain "...high-speed software library for network communication, encryption, decryption, signatures, etc". NaCl was created by the mathematician and ...

* VeraCrypt * Go programming language *

BitLocker BitLocker is a full volume encryption feature included with Microsoft Windows versions starting with Windows Vista. It is designed to protect data by providing encryption for entire volumes. By default, it uses the AES encryption algorithm in ...

A fringe use of the AES instruction set involves using it on block ciphers with a similarly-structured

S-box In cryptography, an S-box (substitution-box) is a basic component of symmetric key algorithms which performs substitution. In block ciphers, they are typically used to obscure the relationship between the key and the ciphertext, thus ensuring Sha ...

, using affine isomorphism to convert between the two. SM4 and

Camellia ''Camellia'' (pronounced or ) is a genus of flowering plants in the family Theaceae. They are found in eastern and southern Asia, from the Himalayas east to Japan and Indonesia. There are more than 220 described species, with some controversy ...

have been accelerated using AES-NI.

Notes

References

External links

Intel Advanced Encryption Standard Instructions (AES-NI)

AES instruction set whitepaper
(2.93 MiB, PDF) from Intel {{DEFAULTSORT:Aes Instruction Set X86 architecture X86 instructions Advanced Micro Devices technologies Advanced Encryption Standard