AES instruction set

AES instruction set
Name	AES instruction set
Designer	Intel, Advanced Micro Devices
Bits	x86, x86-64
Introduced	2010
Type	SIMD

AES instruction set. The AES instruction set is a set of x86 and x86-64 SIMD instructions designed to accelerate Advanced Encryption Standard operations directly in hardware. First introduced by Intel in 2010 with the Westmere microarchitecture and soon after by Advanced Micro Devices, these instructions provide a significant performance boost for cryptographic workloads. They are a critical component in modern processors for securing data in applications ranging from SSL/TLS web traffic to full-disk encryption.

Overview

The development of these instructions was driven by the widespread adoption of the Advanced Encryption Standard, a NIST-approved block cipher selected after the AES competition. Prior to their introduction, AES operations were performed using slower software libraries, which became a bottleneck for secure communications. By moving the core cipher and inverse cipher operations into the processor's execution unit, these instructions reduce latency and improve throughput dramatically. This hardware acceleration is essential for high-performance servers handling TLS connections and for consumer devices utilizing BitLocker or FileVault.

Hardware support

Support for these instructions was first implemented in Intel's Westmere processors, starting with the Clarkdale and Arrandale lines for desktops and laptops, and the Gulftown line for high-end desktops. Advanced Micro Devices introduced support shortly thereafter in its Bulldozer-based processors like the FX series. Subsequent microarchitectures from both companies, including Intel's Sandy Bridge, Haswell, and Skylake, and AMD's Zen and Zen 2, have maintained and enhanced this support. Virtually all modern x86-64 processors from these manufacturers now include these acceleration instructions.

Instructions

The core instructions are designed for the AES encryption and decryption rounds. Key instructions include `AESENC` and `AESENCLAST` for performing a single regular and final encryption round, respectively, and their inverse counterparts `AESDEC` and `AESDECLAST`. For key expansion, the `AESKEYGENASSIST` instruction assists in generating the round keys from the original cipher key. These instructions operate primarily on the XMM registers, which are part of the SSE register set, and can process 128-bit blocks of data, aligning with the standard block size of AES. This integration allows for efficient pipelining within the CPU.

Performance and applications

Performance gains are substantial, with hardware-accelerated AES operations often being orders of magnitude faster than optimized software implementations. This makes the instructions indispensable in data centers running web servers like Apache or Nginx that terminate millions of TLS connections. They are equally critical for real-time encryption in applications such as WhatsApp and Signal for end-to-end encryption, and in storage technologies like Microsoft's BitLocker and Apple's FileVault. The reduced computational overhead also improves battery life in mobile devices by completing cryptographic tasks more efficiently.

Security considerations

While accelerating legitimate cryptographic operations, these instructions also have implications for cryptanalysis and side-channel attacks. Research has explored potential vulnerabilities, such as cache timing attacks, though the hardware implementation is generally more resistant than software to certain types of power analysis. The instructions are designed to execute in constant time, which helps mitigate timing attacks that could target software lookup tables. Their use is recommended in cryptographic libraries like OpenSSL and LibreSSL to ensure both performance and a reduced attack surface compared to pure software cipher implementations.

Implementations

These instructions are utilized by major libraries and within operating system kernels. OpenSSL integrated support early on, significantly boosting the performance of the OpenSSL command-line tool and servers using it. The Linux kernel incorporates them for dm-crypt and other kernel-level encryption modules. In the Microsoft Windows ecosystem, the CNG library leverages these instructions. Intel itself provides the IPP cryptographic library, which offers optimized routines. Compiler support from GCC and Clang allows developers to use intrinsic functions to directly invoke these instructions from code written in C or C++.

Category:Instruction set architecture Category:Cryptography Category:X86 architecture