AESDECLAST

AESDECLAST performs the final round of AES decryption on the 16-byte state in its first operand: InvShiftRows and InvSubBytes, then an XOR with the round key from the second operand. It is AESDEC without InvMixColumns, and every block decrypted with AESDEC ends with exactly one AESDECLAST. AESDEC’s page gives the whole sequence and the key schedule; AESENCLAST is the mirror image for encryption, and VAESDECLAST the VEX and EVEX forms.

The key it takes#

Of the decryption keys, only the middle ones pass through AESIMC. The key of AESDECLAST is the first round key of the encryption schedule, k0, unchanged, and for AES-128 that is the cipher key itself. Passing AESIMC(k0) instead raises nothing; the plaintext simply comes out wrong.

A round that is only bytes#

Without InvMixColumns, each byte of the result depends on one byte of the state: it goes through the inverse S-box, moves to where InvShiftRows puts it, and is XORed with a key byte. Zen 5’s recorded cases show the inverse S-box directly: a zero state and zero key gave 52H in every byte, the inverse S-box’s value for 0, and a state and key of all ones gave 82H, its value for FFH (7DH) XORed with FFH. With zero keys, AESDECLAST undoes AESENCLAST: the inverse S-box and InvShiftRows reverse SubBytes and ShiftRows.

Folding in the next XOR#

The round key enters only through the final XOR, so it can absorb other data. CBC decryption XORs each decrypted block with the ciphertext before it, and AESDECLAST with k0 XORed with that ciphertext gives the plaintext in one step. The number of XORs stays the same, but the one with the key no longer waits for the rounds: it can run while the block is still being decrypted. Compilers do not make the change themselves: for _mm_xor_si128(_mm_aesdeclast_si128(s, k0), prev), GCC 14 and Clang 23 at -O2 (-maes) emit AESDECLAST followed by PXOR.

The legacy form keeps bits 128 and up of its register and needs a memory operand aligned to 16 bytes; the VEX form clears them and takes any address. AMD’s Zen 5 guide lists AESDECLAST like AESDEC: a latency of four cycles, two started per cycle.

In the optimization guide

What the optimization guide says about AESDECLAST, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Haswell and Broadwell

• Integer execution and bypass: AESENC, AESENCLAST, AESDEC and AESDECLAST become one micro-op each, with a little less latency than before, which helps the modes that run several blocks at once, such as CBC decryption, and code that encrypts several buffers side by side.

Silvermont to Goldmont Plus

• Vectors and cryptography: AES rounds and carry-less multiplication are slow on Silvermont and faster with each Goldmont. sources differ

Tremont

• Vectors and cryptography: Tremont has two AES units, one on each vector port, so two AES rounds can start each cycle.

Forms

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# the last round of the equivalent inverse
# cipher, which leaves out InvMixColumns
s = inv_sub_bytes(xmm1.read())   # xmm1: the state
s = inv_shift_rows(s)
xmm1.write(s ^ src2)             # the cipher's first round key
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to AESDECLAST, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More AES-NI instructions

• AESDEC
• AESENC
• AESENCLAST
• AESIMC
• AESKEYGENASSIST
• VAESDEC
• VAESDECLAST
• VAESENC
• VAESENCLAST
• VAESIMC
• VAESKEYGENASSIST