Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I´m implementing the AES-encrypt algorithm for the SSE2 instruction set.

For the Subbyte function i use movzx, having loaded the S-box in the cache of the CPU for more performance. That cost about 56 OPS wing CPU.

I was wondering if you could calculate the value of the bytes without having to change the vector so seriously? In particular, I would like to ask if you can significantly improve on a round of AES-128-Encryption taking about 108 OPS?

share|improve this question
From what I know, fast software implementations are table-based in which a single table lookup not only performs SubByte but also four field multiplications of the SubByte result with the four factors of MixColumns. So, you'd have one or four tables of 256 32-bit values. –  sellibitze Apr 30 '14 at 11:08
I guess you mean those long vector called TE, not interpret. –  user3127939 May 1 '14 at 1:19

1 Answer 1

Fast software implementations of AES were proposed in a number of research papers. The state-of-the-art approach is to do a bitsliced implementation, where bits of sequential blocks at identical positions are processed at the same time.

The fastest implementation described so far that does not use AES-NI instructions was designed by Kasper and Schwabe. Their paper is online and is highly recommended for those who are interested in fast AES implementations. It would not make sense to copy the entire paper here, but specific questions can be answered.

share|improve this answer
Thanks for the pointer! It took me by surprise that a bitsliced implementation could be so effective. –  fgrieu Apr 30 '14 at 14:39
Yes, I´m implemented bitsliced. My implementation is better in times that the paper. My shiftrows 10 OPS, Mixcolumns 29 OPS, Addroundkey 1 OPS, and the subbytes is what I wanted to improve about 56 OPS. I read the code of openssl of the Kasper and Schwabe, and multiplication to calculate a SubBytes. But these algorithms are only one round, or 8? –  user3127939 May 1 '14 at 1:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.