Cryptography
Key Locker
Key Locker turns AES keys into handles that only the processor can unwrap, so that software encrypts and decrypts without keeping the keys in memory.
- CPUID
- KL + KLENABLED
CPUID.(EAX=07H,ECX=0):ECX[23]CPUID.(EAX=19H,ECX=0):EBX[0] - Instructions
- 11 mnemonics
- Processors
- Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Sierra Forest, Clearwater Forest
Key Locker keeps AES keys out of memory while software uses them. The operating system loads an internal wrapping key into the processor with LOADIWKEY, which no instruction can read back. A program converts each AES key once into a handle with ENCODEKEY128 or ENCODEKEY256 and then discards the key; the handle is the key encrypted and authenticated with the wrapping key.
Encryption and decryption take the handle instead of the key: AESENC128KL and its relatives do all ten or 14 AES rounds on one block, and the WIDE forms, such as AESENCWIDE128KL, on the eight blocks in XMM0 to XMM7. A handle that fails its checks sets ZF. Handles can be restricted, for example to ring 0. CPUID leaf 19H reports what the processor supports.
Instructions
| Mnemonic | Summary | Forms |
|---|---|---|
| AESDEC128KL | Decrypts the block in an XMM register with ten AES rounds, using the 128-bit key of a Key Locker handle in memory; ZF=1 reports a bad handle. | 1 |
| AESDEC256KL | Decrypts the block in an XMM register with 14 AES rounds, using the 256-bit key of a Key Locker handle in memory; ZF=1 reports a bad handle. | 1 |
| AESDECWIDE128KL | Decrypts eight blocks in XMM0 to XMM7 with ten AES rounds, using the 128-bit key of a Key Locker handle in memory; ZF=1 if the handle fails. | 1 |
| AESDECWIDE256KL | Decrypts eight blocks in XMM0 to XMM7 with 14 AES rounds, using the 256-bit key of a Key Locker handle in memory; ZF=1 if the handle fails. | 1 |
| AESENC128KL | Encrypts the block in an XMM register with ten AES rounds, using the 128-bit key of a Key Locker handle in memory; ZF=1 reports a bad handle. | 1 |
| AESENC256KL | Encrypts the block in an XMM register with 14 AES rounds, using the 256-bit key of a Key Locker handle in memory; ZF=1 reports a bad handle. | 1 |
| AESENCWIDE128KL | Encrypts eight blocks in XMM0 to XMM7 with ten AES rounds, using the 128-bit key of a Key Locker handle in memory; ZF=1 if the handle fails. | 1 |
| AESENCWIDE256KL | Encrypts eight blocks in XMM0 to XMM7 with 14 AES rounds, using the 256-bit key of a Key Locker handle in memory; ZF=1 if the handle fails. | 1 |
| ENCODEKEY128 | Wraps the 128-bit AES key in XMM0 into a Key Locker handle in XMM0 to XMM2, so that software can discard the key itself. | 1 |
| ENCODEKEY256 | Wraps the 256-bit AES key in XMM0 and XMM1 into a Key Locker handle in XMM0 to XMM3, so that software can discard the key itself. | 1 |
| LOADIWKEY | Loads the internal wrapping key of Key Locker from XMM registers; the key cannot be read back. Ring 0 only. | 1 |
CPUID and processors
XED splits Key Locker into 2 ISA sets. Software can use a form when the processor reports every CPUID bit of one alternative of the form's ISA set.
| ISA set | CPUID | Processors |
|---|---|---|
KEYLOCKER | KL + KLENABLED | Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Sierra Forest, Clearwater Forest |
KEYLOCKER_WIDE | KL + KLENABLED + KLWIDE | Same as KEYLOCKER |
Sources
- Intel XED v2026.08.23 (commit
0bcb6237345c): forms, encodings, ISA sets, CPUID bits and chip model. - Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 2 (325383-093, September 2026)
The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.