AESDEC

AESDEC performs one middle round of AES decryption on the 16-byte state in its first operand: InvShiftRows, InvSubBytes and InvMixColumns, then an XOR with the round key from the second operand. It mirrors AESENC, whose page covers the byte order, the number of rounds and the VEX and EVEX forms (VAESDEC), which work the same way here.

The keys need AESIMC#

Undoing the rounds of encryption one by one would put each key’s XOR before InvMixColumns. AESDEC instead follows the equivalent inverse cipher of FIPS 197, which keeps the order of an encryption round, and for that every middle round key must first go through InvMixColumns itself, which AESIMC does. With the round keys k0 to kn of the encryption schedule, a block is decrypted by:

1. an XOR with kn;
2. AESDEC with AESIMC(kn-1), then AESIMC(kn-2), down to AESIMC(k1);
3. AESDECLAST with k0, which leaves out InvMixColumns.

The AESIMC steps belong to the key schedule, done once per key, not per block. Leaving them out raises no error; the plaintext simply comes out wrong. The page’s pseudocode is checked against the decryption example of FIPS 197 and against Zen 5’s recorded rounds.

Where decryption is needed#

CTR and GCM decrypt by encrypting a counter, so they never run AESDEC; CBC, ECB and XTS do. CBC decryption, unlike CBC encryption, can work on several blocks at once, since each block needs only the ciphertext before it, which is already known; Intel’s optimization manual names it among the modes that gain from interleaving blocks (Section 6.10). AMD’s Zen 5 guide lists AESDEC, like AESENC, with a latency of four cycles and two started per cycle.

From C#

_mm_aesdec_si128(state, key) needs -maes. For a ten-round loop over an array of keys, GCC 14 at -O2 unrolled three AESDECs per iteration and Clang 23 all nine, followed by AESDECLAST, both with the keys as memory operands. In the legacy form such an operand must be aligned to 16 bytes, as an array of __m128i is; the VEX form takes any address.

In the optimization guide

What the optimization guide says about AESDEC, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Haswell and Broadwell

• Integer execution and bypass: AESENC, AESENCLAST, AESDEC and AESDECLAST become one micro-op each, with a little less latency than before, which helps the modes that run several blocks at once, such as CBC decryption, and code that encrypts several buffers side by side.

Silvermont to Goldmont Plus

• Vectors and cryptography: AES rounds and carry-less multiplication are slow on Silvermont and faster with each Goldmont. sources differ

Tremont

• Vectors and cryptography: Tremont has two AES units, one on each vector port, so two AES rounds can start each cycle.

Forms

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# a middle round of the equivalent
# inverse cipher
s = inv_sub_bytes(xmm1.read())   # xmm1: the state
s = inv_shift_rows(s)
s = inv_mix_columns(s)
xmm1.write(s ^ src2)             # the round key last: one made by
                                 # AESIMC
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to AESDEC, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More AES-NI instructions

• AESDECLAST
• AESENC
• AESENCLAST
• AESIMC
• AESKEYGENASSIST
• VAESDEC
• VAESDECLAST
• VAESENC
• VAESENCLAST
• VAESIMC
• VAESKEYGENASSIST