AESENC

AESENC performs one middle round of AES encryption on the 16-byte state in its first operand: SubBytes, ShiftRows and MixColumns, then an XOR with the round key from the second operand. A whole block is an XOR with round key 0, AESENC with keys 1 to n - 1, and AESENCLAST, which leaves out MixColumns, with key n, where n is 10, 12 or 14 for keys of 128, 192 or 256 bits. The program supplies the expanded keys, usually computed once with AESKEYGENASSIST; decryption uses AESDEC and AESDECLAST, with the middle keys passed through AESIMC.

Byte order#

The state is the block as it lies in memory, byte 0 at bits 7:0, so a block is loaded and stored with plain 16-byte moves. Intel’s manual warns only that FIPS 197 writes its test vectors with the first byte on the left, the reverse of how a register is usually written (Section 12.13.1). The page’s pseudocode is checked against FIPS 197’s examples, and Zen 5’s recorded rounds agree with it.

Speed comes from independent blocks#

AMD’s Zen 5 guide lists AESENC with a latency of four cycles and two started per cycle, so eight blocks can be in flight at once. Modes whose blocks do not depend on each other, such as CTR, GCM and ECB, and CBC decryption, run one round for several blocks before the next; Intel’s optimization manual shows the same eight-block interleave (Example 19-1). CBC encryption cannot: each block needs the previous ciphertext, so it waits the full latency of every round.

From C and the wider forms#

_mm_aesenc_si128(state, key) needs -maes or an -march that has it: skylake, goldmont and znver1 do, while GCC 14’s and Clang 23’s westmere, sandybridge and haswell do not, nor do x86-64-v3 and v4. Both compilers emit one AESENC per call and keep the round keys as memory operands; Clang unrolls a ten-round loop completely.

The legacy form keeps bits 128 and up of the register. VAESENC with VEX.128 needs AES and AVX and clears them. Its 256-bit and EVEX forms, which need the VAES bit (CPUID leaf 7, ECX bit 9), run a round on every 128-bit lane with that lane’s key; Intel’s optimization manual reports up to 3.3 times the speed of AESENC (Section 19.1). AESENC itself needs CPUID leaf 1, ECX bit 25.

In the optimization guide

What the optimization guide says about AESENC, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Haswell and Broadwell

• Integer execution and bypass: AESENC, AESENCLAST, AESDEC and AESDECLAST become one micro-op each, with a little less latency than before, which helps the modes that run several blocks at once, such as CBC decryption, and code that encrypts several buffers side by side.

Ice Lake to Rocket Lake

• Vectors and AVX-512: AES rounds run on ports 0 and 1, so existing AES-NI code can reach twice its old peak rate. sources differ

Silvermont to Goldmont Plus

• Vectors and cryptography: AES rounds and carry-less multiplication are slow on Silvermont and faster with each Goldmont. sources differ

Tremont

• Vectors and cryptography: Tremont has two AES units, one on each vector port, so two AES rounds can start each cycle.

Forms

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# a middle round of the cipher
s = sub_bytes(xmm1.read())       # xmm1: the state
s = shift_rows(s)
s = mix_columns(s)
xmm1.write(s ^ src2)             # AddRoundKey, src2 the round key
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to AESENC, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More AES-NI instructions

• AESDEC
• AESDECLAST
• AESENCLAST
• AESIMC
• AESKEYGENASSIST
• VAESDEC
• VAESDECLAST
• VAESENC
• VAESENCLAST
• VAESIMC
• VAESKEYGENASSIST