VAESENCLAST

VAESENCLAST runs the last round of AES encryption, SubBytes, ShiftRows and the XOR with a round key, on every 128-bit lane of its second operand, with the key from the same lane of the third. AESENCLAST’s page covers the round and its uses as a 16-byte S-box and for folding the plaintext into the last key; the forms are those of VAESENC: VEX.128 for AES and AVX, VEX.256 for VAES, and EVEX for VAES with AVX512F (AVX512VL below 512 bits) or AVX10.1, without masking or broadcast. Each form writes a separate destination, cleared above the vector length, and takes memory at any alignment.

Both uses widen with the lanes. With a zero key, a ZMM VAESENCLAST looks up 64 bytes in the S-box, in ShiftRows order within each lane, which VPSHUFB, also confined to lanes, can undo. In CTR mode each lane holds its own counter and plaintext block, so the last key XORed with four plaintext blocks gives four different keys, which VAESENCLAST takes as they are.

Recorded on Zen 5#

The 22 recorded cases cover every form. In {evex} vaesenclast zmm1, zmm2, zmm3, lane 0, zero state and key, gave 63h in every byte; lane 1 finished the AES-128 example of FIPS-197, turning BD6E7C3DF2B5779E0B61216E8B10B689 with the last round key 13111D7FE3944A17F307A78B4D2B30C5 into the example’s ciphertext, 69C4E0D86A7B0430D8CDB78070B4C55A; lane 2, all ones, gave E9h.

In compiled code#

In our builds at -O2 with -march=znver5, a CTR step on four counters in a ZMM register, _mm512_aesenclast_epi128 after nine _mm512_aesenc_epi128, ends with VAESENCLAST and a VPXORD (GCC 14) or VPXORQ (Clang 23) of the plaintext from memory: neither compiler folds the plaintext into the key. Each round key is loaded with VBROADCASTI32X4.

AMD’s latency spreadsheet for Zen 5 gives the VEX and the EVEX rows alike a latency of 4 cycles, two per cycle on pipes FP0 and FP1, as for AESENCLAST.

Forms

Latency and throughput

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# the last round of the cipher, which leaves
# out MixColumns, in each 128-bit lane
for i in range(VL // 128):
    s = sub_bytes(zmm2.dq[i])    # zmm2: the state
    s = shift_rows(s)
    zmm1.dq[i] = s ^ src3.dq[i]  # AddRoundKey, the lane's key
# zmm1 is zeroed from bit VL up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

VEX forms

avx-type-4

EVEX forms

AVX512-E4

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VAESENCLAST, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More AES-NI instructions

• AESDEC
• AESDECLAST
• AESENC
• AESENCLAST
• AESIMC
• AESKEYGENASSIST
• VAESDEC
• VAESDECLAST
• VAESENC
• VAESIMC
• VAESKEYGENASSIST

More VAES instructions

• VAESDEC
• VAESDECLAST
• VAESENC

More AVX10.1 instructions

• KUNPCKBW
• KUNPCKDQ
• KUNPCKWD
• KXNORB
• KXNORD
• KXNORQ
• KXNORW
• KXORB
• KXORD
• KXORQ
• KXORW
• VADDPD
• VADDPH
• VADDPS
• VADDSD
• VADDSH
• VADDSS
• VAESDEC
• VAESDECLAST
• VAESENC
• VALIGND
• VALIGNQ
• VANDNPD
• VANDNPS
• VANDPD
• VANDPS
• VBLENDMPD
• VBLENDMPS
• VBROADCASTF32X2
• VBROADCASTF32X4
• VBROADCASTF32X8
• VBROADCASTF64X2
• VBROADCASTF64X4
• VBROADCASTI32X2
• VBROADCASTI32X4
• VBROADCASTI32X8
• VBROADCASTI64X2
• VBROADCASTI64X4
• VBROADCASTSD
• VBROADCASTSS

All 686 AVX10.1 instructions