AESENCLAST

AESENCLAST performs the final round of AES encryption on the 16-byte state in its first operand: SubBytes and ShiftRows, then an XOR with the round key from the second operand. It is AESENC without MixColumns, which FIPS 197 leaves out of the last round, and every block ends with exactly one of it, with round key 10, 12 or 14. AESENC’s page covers the byte order, the number of rounds and the VEX and EVEX forms, VAESENCLAST included; AESDECLAST is the mirror image for decryption.

A round that is only bytes#

Without MixColumns, no byte of the result depends on more than one byte of the state: each goes through the AES S-box, moves to the place ShiftRows gives it, and is XORed with a key byte. That makes AESENCLAST useful beyond the end of a block.

• The S-box, 16 bytes at a time. With a key of zero the result is SubBytes in ShiftRows order, and a PSHUFB with the inverse permutation puts the bytes back in place. Zen 5’s recorded case of a zero state and a zero key returned 63H, the S-box’s value for 0, in every byte; a state and key of all ones gave E9H, which is 16H, the S-box’s value for FFH, XORed with FFH.
• Key expansion. Intel’s optimization manual builds the AES-128 key schedule with AESENCLAST instead of AESKEYGENASSIST, whose page explains the trick (Section 6.10.2).
• Folding in the last XOR. The round key enters only through an XOR, so it can be combined with other data first. In CTR mode, where the ciphertext is the encrypted counter XORed with the plaintext, AESENCLAST with the last round key XORed with the plaintext gives the ciphertext in one step; Intel’s CTR example (Example 6-44) uses a separate PXOR instead.

From C#

_mm_aesenclast_si128(state, key) needs -maes; GCC 14 and Clang 23 at -O2 emit one AESENCLAST. The legacy form keeps bits 128 and up of the register and needs a memory operand aligned to 16 bytes; the VEX form clears them and takes any address. AMD’s Zen 5 guide lists AESENCLAST like AESENC: a latency of four cycles, two started per cycle. Zen 5’s five recorded cases, one with the same register as state and key, agree with the Operation section.

In the optimization guide

What the optimization guide says about AESENCLAST, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Haswell and Broadwell

• Integer execution and bypass: AESENC, AESENCLAST, AESDEC and AESDECLAST become one micro-op each, with a little less latency than before, which helps the modes that run several blocks at once, such as CBC decryption, and code that encrypts several buffers side by side.

Silvermont to Goldmont Plus

• Vectors and cryptography: AES rounds and carry-less multiplication are slow on Silvermont and faster with each Goldmont. sources differ

Tremont

• Vectors and cryptography: Tremont has two AES units, one on each vector port, so two AES rounds can start each cycle.

Forms

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# the last round of the cipher, which
# leaves out MixColumns
s = sub_bytes(xmm1.read())       # xmm1: the state
s = shift_rows(s)
xmm1.write(s ^ src2)             # AddRoundKey, src2 the round key
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to AESENCLAST, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More AES-NI instructions

• AESDEC
• AESDECLAST
• AESENC
• AESIMC
• AESKEYGENASSIST
• VAESDEC
• VAESDECLAST
• VAESENC
• VAESENCLAST
• VAESIMC
• VAESKEYGENASSIST