AES instruction set
Processor instructions accelerating AES encryption and decryption.
AES instruction sets are processor-level commands built to handle AES encryption and decryption with high efficiency. Found in many modern CPUs, they significantly outperform software-based AES by handling key expansion, encryption, and decryption for 128-bit, 192-bit, and 256-bit keys. Typically, these instructions execute a single AES round, with a separate version for the final round that uses a slightly different procedure. Using dedicated instructions instead of software also improves security by reducing exposure to side-channel attacks.
The first major implementation was AES-NI (Intel Advanced Encryption Standard New Instructions), an extension to the x86 architecture proposed by Intel in March 2008 and used by both Intel and AMD processors. A wider variant, VAES (AVX-512 Vector AES instructions), is part of the AVX-512 extension.
Intel processors supporting AES-NI include Westmere-based models (Westmere-EP, Clarkdale except Core i3/Pentium/Celeron, Arrandale except Celeron/Pentium/Core i3/Core i5-4XXM), Sandy Bridge (desktop except Pentium/Celeron/Core i3; mobile Core i7 and i5, though some BIOS versions disabled it), Ivy Bridge (only i5, i7, Xeon, and i3-2115C), Haswell (except i3-4000m, Pentium, Celeron), Broadwell (except Pentium, Celeron), Silvermont/Airmont (except Bay Trail-D and Bay Trail-M), Goldmont and later, and Skylake and later.
AMD processors with AES support include those from the Bulldozer, Piledriver, Steamroller, Excavator, Jaguar, Puma, and Zen families, as well as "Heavy Equipment" processors.
Other architectures also offer AES acceleration via unprivileged instructions. SPARC T3, T4, T5, M5, and later models include user-level AES round instructions, introduced with the T4 in 2011. ARMv8-A processors (Cortex-A53, A57, and later) also have user-level AES round instructions, unlike earlier ARMv7 chips. The ARMv8-A cryptographic extension is optional on Cortex-A30/50/70 cores.
Some x86 CPUs use driver-based AES acceleration instead of AES-NI, such as VIA x86 CPUs (using PadLock) and AMD Geode LX processors. VIA C3 Nehemiah (Eden-N) and C7 Esther chips also lack AES-NI. The Marvell Kirkwood SoC uses a driver-based approach (mv_cesa in Linux).
- First major implementation
- AES-NI (Intel Advanced Encryption Standard New Instructions)
- Proposed by
- Intel
- Proposal date
- March 2008
- Performance improvement
- from approximately 28.0 cycles per byte to 3.5 cycles per byte with AES/GCM versus a Pentium 4 with no acceleration
- Key sizes supported
- 128-bit, 192-bit, 256-bit
Lore & Background
The AES instruction set was first majorly implemented as AES-NI, an extension to the x86 instruction set architecture for microprocessors from Intel and AMD, proposed by Intel in March 2008. A wider version, AVX-512 Vector AES instructions (VAES), is found in AVX-512. Intel processors supporting AES-NI include Westmere-based processors (such as Westmere-EP and Clarkdale), Sandy Bridge processors (desktop all except Pentium, Celeron, Core i3; mobile all Core i7 and Core i5), Ivy Bridge processors (all i5, i7, Xeon and i3-2115C only), Haswell processors (all except i3-4000m, Pentium and Celeron), Broadwell processors (all except Pentium and Celeron), Silvermont/Airmont processors (all except Bay Trail-D and Bay Trail-M), Goldmont (and later) processors, and Skylake (and later) processors. AMD processors supporting AES instructions include Bulldozer, Piledriver, Steamroller, Excavator and newer, Jaguar and newer, Puma and newer, and Zen (and later) based processors.
Reader's Guide
The AES instruction set is significant because it provides hardware acceleration for AES encryption and decryption, greatly improving performance over software implementations. A performance analysis using the Crypto++ security library showed an increase in throughput from approximately 28.0 cycles per byte to 3.5 cycles per byte with AES/GCM versus a Pentium 4 with no acceleration. Beyond x86, AES support with unprivileged processor instructions is available in SPARC processors (T3, T4, T5, M5, and forward) and ARMv8-A processors (including ARM Cortex-A53 and A57). The RISC-V architecture ratified scalar and vector cryptographic instruction set extensions in 2022 and 2023, allowing hardware acceleration for AES. The Power ISA v.2.07 includes instructions vcipher and vcipherlast for one round of AES. IBM z9 or later mainframe processors support AES as single-opcode instructions. Most modern compilers can emit AES instructions, and many security and cryptography software packages support the instruction set, including Apple's FileVault 2, Linux's Crypto API, Java 7 HotSpot, OpenSSL 1.0.1 and above, and VeraCrypt. A fringe use involves accelerating block ciphers with similarly-structured S-boxes, such as SM4, Camellia, and ARIA.
Did You Know?
- AES-NI was proposed by Intel in March 2008.
- ARMv8-A processors like Cortex-A53 and A57 have user-level instructions implementing AES rounds, but previous v7 processors do not.
- The RISC-V scalar and vector cryptographic instruction set extensions were ratified in 2022 and 2023.
More in PC Hardware, Part 2 1-24
Spotted an error? Know more?
Reader corrections go straight into our review queue. Suggest an edit · How this site is sourced