AESIMC

AESIMC applies AES’s InvMixColumns to the 16 bytes of its source and writes the result to an XMM register: each of the four 4-byte columns is multiplied, in the field of 256 elements that AES uses, by the inverse of the matrix that MixColumns multiplies by. No other step of the cipher is involved, no key and no S-box. Its one job is to prepare round keys for AESDEC, whose page explains why the equivalent inverse cipher of FIPS 197 needs its middle round keys transformed this way.

Once per key#

A key schedule for decryption is the encryption schedule in reverse, with every key but the first and the last passed through AESIMC: 9 AESIMCs for AES-128, 11 for AES-192 and 13 for AES-256, done when the key is set up and never per block. For a loop that builds the 11 keys of AES-128 that way from _mm_aesimc_si128 (-maes), GCC 14 at -O2 kept a loop of AESIMC with a memory operand and a store, and Clang 23 unrolled it into nine AESIMCs. Code that only encrypts, or uses a mode such as CTR or GCM that decrypts by encrypting, never needs AESIMC.

What it computes#

InvMixColumns is linear over bits, so AESIMC of an XOR is the XOR of the AESIMCs and a zero key stays zero. The coefficients of each row, 0E, 0B, 0D and 09, add up to 01, so a key of all ones stays all ones too; Zen 5 did both. Given the first round key of FIPS 197’s AES-128 example, d6aa74fd d2af72fa daa678f1 d6ab76fe (bytes in the standard’s order), Zen 5 returned 8c56dff0 825dd3f9 805ad3fc 8659d7fd, through a register and from memory alike.

Legacy and VEX#

The legacy form leaves bits 128 and up of the destination as they were, as Zen 5’s cases show; VAESIMC, its VEX form under AVX, clears them. VAES widened only the four round instructions to 256 and 512 bits, so AESIMC, like AESKEYGENASSIST, works on one 128-bit key at a time.

AMD’s Zen 5 guide lists AESIMC like the rounds: latency four cycles, two per cycle.

Forms

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# a round key of the cipher made one for
# AESDEC, the equivalent inverse cipher's
xmm1.write(inv_mix_columns(src2))
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to AESIMC, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More AES-NI instructions

• AESDEC
• AESDECLAST
• AESENC
• AESENCLAST
• AESKEYGENASSIST
• VAESDEC
• VAESDECLAST
• VAESENC
• VAESENCLAST
• VAESIMC
• VAESKEYGENASSIST