VAESDEC

VAESDEC runs one middle round of AES decryption on every 128-bit lane of its second operand and XORs in the round key from the same lane of the third. The round is AESDEC’s, whose page covers the equivalent inverse cipher and why its keys must first pass through AESIMC; the forms are those of VAESENC: VEX.128 for AES and AVX, VEX.256 for VAES, and EVEX for VAES with AVX512F (AVX512VL below 512 bits) or AVX10.1, on up to four blocks, with no masking and no broadcast. Each form writes a separate destination, clears it above the vector length and takes memory at any alignment.

Recorded on Zen 5#

The 22 recorded cases cover every form. In {evex} vaesdec zmm1, zmm2, zmm3 each lane got its own data: in lane 0, a state and key of all ones gave 82h in every byte, since InvMixColumns leaves a column of equal bytes alone; lane 1 ran the first AESDEC of the AES-128 example in FIPS-197, turning 7AD5FDA789EF4E272BCA100B3D9FF59F with 13AA29BE9C8FAFF6F770F58000F7BF03, the ninth round key after AESIMC, into 54D990A16BA09AB596BBF40EA111702F, the state the standard lists after that round.

Decrypting four blocks#

CBC decryption, unlike CBC encryption, can work on several blocks at once. In our builds at -O2 with -march=znver5, a function that decrypts four blocks in one ZMM register with _mm512_aesdec_epi128 loads each round key with VBROADCASTI32X4, since VAESDEC itself cannot broadcast: GCC 14 inside a loop over the keys, Clang 23 unrolled into nine VAESDECs. The decryption schedule is still made one key at a time with the 128-bit VAESIMC, which has no wider form.

AMD’s latency spreadsheet for Zen 5 gives the VEX and the EVEX rows alike a latency of 4 cycles, two per cycle on pipes FP0 and FP1, as for AESDEC: a ZMM VAESDEC does four blocks’ work for the cost of one.

Forms

Latency and throughput

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# a middle round of the equivalent inverse
# cipher, in each 128-bit lane
for i in range(VL // 128):
    s = inv_sub_bytes(zmm2.dq[i])  # zmm2: the state
    s = inv_shift_rows(s)
    s = inv_mix_columns(s)
    zmm1.dq[i] = s ^ src3.dq[i]    # the round key last: one
                                   # made by AESIMC
# zmm1 is zeroed from bit VL up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

VEX forms

avx-type-4

EVEX forms

AVX512-E4

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VAESDEC, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More AES-NI instructions

• AESDEC
• AESDECLAST
• AESENC
• AESENCLAST
• AESIMC
• AESKEYGENASSIST
• VAESDECLAST
• VAESENC
• VAESENCLAST
• VAESIMC
• VAESKEYGENASSIST

More VAES instructions

• VAESDECLAST
• VAESENC
• VAESENCLAST

More AVX10.1 instructions

• KTESTD
• KTESTQ
• KTESTW
• KUNPCKBW
• KUNPCKDQ
• KUNPCKWD
• KXNORB
• KXNORD
• KXNORQ
• KXNORW
• KXORB
• KXORD
• KXORQ
• KXORW
• VADDPD
• VADDPH
• VADDPS
• VADDSD
• VADDSH
• VADDSS
• VAESDECLAST
• VAESENC
• VAESENCLAST
• VALIGND
• VALIGNQ
• VANDNPD
• VANDNPS
• VANDPD
• VANDPS
• VBLENDMPD
• VBLENDMPS
• VBROADCASTF32X2
• VBROADCASTF32X4
• VBROADCASTF32X8
• VBROADCASTF64X2
• VBROADCASTF64X4
• VBROADCASTI32X2
• VBROADCASTI32X4
• VBROADCASTI32X8
• VBROADCASTI64X2

All 686 AVX10.1 instructions