If I was to use AES-NI as a high performance 128-bit permutation/PRF would AESDEC offer faster/better diffusion than AESENC? The reason I ask is because both instructions have the same cost, but the inverse MixColums step of AES has a more complicated matrix, so it appears to me as if there are more operations being performed for the same cost.

  • $\begingroup$ Does what you're making need to be cryptographically secure? $\endgroup$
    – Myria
    Mar 28 at 18:23
  • $\begingroup$ @Myria No, I am mostly interested in non-cryptographic RNGs at the moment. $\endgroup$
    – Chris_F
    Mar 28 at 18:35
  • $\begingroup$ Yeah, AESDEC is probably better for this purpose; its results will "look" more random. You might want to also consider adding CRC32 for more fun. $\endgroup$
    – Myria
    Mar 28 at 18:43
  • 1
    $\begingroup$ AES with a fixed key is just a permutation ( AES is not PRF it is PRP), so the enc dec is just the reverse of each other. No difference. $\endgroup$
    – kelalaka
    Mar 29 at 0:50
  • $\begingroup$ @kelalaka I am fully aware that the two operations are inverse of each other, but that doesn't convince me that one doesn't scramble bits faster than the other. For instance, I took the MixColums and the inverse MixColums functions, and I put every 32-bit integer which is a power of 2 through them and then summed the hamming weights. The result was that Inverse MixColums produced almost twice as many 1s as the normal MixColums. $\endgroup$
    – Chris_F
    Mar 29 at 3:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.