11
$\begingroup$

I am looking in to AES-NI which is now supported by many new CPU's and I have read a few papers which states that AES-CBC works faster with AES-NI, but I am unable to understand how exactly AES-NI works.

As far as I know, AES-CBC encryption is sequential, so how does AES-NI make it so faster?

(Also even after using AES-NI, is AES-CBC performed sequentially?)

Improve this question
$\endgroup$
4
  • $\begingroup$ Also I have found this on intel's website "The performance improvement expected with the use of AES-NI would depend on the applications and how much of the application time is spent in encryption and decryption. At the algorithm level, using AES-NI can provide significant speedup of AES. For non-parallel modes of AES operation such as CBC-encrypt AES-NI can provide a 2-3 fold gain in performance over a completely software approach. For parallelizable modes such as CBC-decrypt and CTR, AES-NI can provide a 10x improvement over software solutions. For details on performance please refer to" $\endgroup$
    – rijndael
    Oct 8, 2014 at 20:18
  • $\begingroup$ Why AES-NI with CTR provide a 10X improvement and with CBC just a 2-3X ? Maybe you assume that CTR encryption implementation is multithreaded while CBC encryption can't ? $\endgroup$
    – Dingo13
    Oct 9, 2014 at 7:39
  • $\begingroup$ @Dingo13, it's about pipelining, not multi-threading. Modern CPUs rely on being able to have multiple instructions in flight at different stages of computation. With e.g. CTR you can start the encryption of following blocks before the previous have finished. $\endgroup$
    – otus
    Oct 10, 2014 at 7:14
  • 1
    $\begingroup$ At least as important is the security provided with AES-NI, AES-NI may well be less vulnerable to side channel attacks than a software implementation. $\endgroup$
    – Maarten Bodewes ♦
    Sep 18, 2015 at 15:23

2 Answers 2

Reset to default
10
$\begingroup$

AES-NI is just a fast way for the processor to execute the calculations of AES. Normally the computer has to calculate every single step of the AES key schedule and the rounds as a single instruction: Substitute it with the S-boxes, shift the rows, mix the columns, XOR the round key. This is called a software implementation. Every instruction has to be done in software from the program.

Using the AES instruction set the program can do a whole round in a single instruction. There are several different instructions to do this: New instructions, Wikipedia. The instructions will be executed on hardware level, in the transistors of the processor. Without the whole other things a processor normally does to execute a program the encryption and decryption are much more efficient. This is called a hardware implementation. As far as I know, every block cipher is more efficient in hardware than in software. Some more, some not so much. "More efficient" means faster, less energy-consuming or both.

Yes, AES-CBC encryption still has to be done sequentially. AES-NI can only help with one encryption or decryption, but it still greatly increases the speed, because the encryption or decryption is the slowest part of CBC mode. (For the sake of completeness: You can use AES-NI for every encryption mode, not only CBC.)

Improve this answer
$\endgroup$
4
  • 2
    $\begingroup$ Actually, ciphers (such as AES) tend to be more power efficient in hardware implementation than software implementation. This often also means faster, but not necessarily (the clocks for main cpu and crypto HW can be different). $\endgroup$
    – user4982
    Oct 8, 2014 at 21:07
  • $\begingroup$ @user4982: Yes, it could also mean "more energy efficient". I incorporated your comment into my answer. $\endgroup$
    – Nova
    Oct 8, 2014 at 21:36
  • $\begingroup$ @otus: Oh, I didn't mention that? My Bad, will fix it. $\endgroup$
    – Nova
    Oct 10, 2014 at 8:06
  • $\begingroup$ Is it possible that they are not executed on the hardware level, but rather by using a bunch of pre-existing uops for a large amount of the functionality? $\endgroup$
    – forest ♦
    Mar 7, 2018 at 7:09
3
$\begingroup$

It's a hardware implementation of something that typically needs to be written in software. Imagine if nobody had hardware multiplication circuits and everybody had to write software implementations of multiplication. Then a new processor came out that had a dedicated circuit to perform multiplication. Obviously a circuit for multiplying numbers would be faster than iterated adding in software, right?

Improve this answer
$\endgroup$
2
  • 8
    $\begingroup$ AES-NI is only about 2 times as fast, but it also frees up a lot of CPU resources that would otherwise be used for encryption of AES. There could also be advantages with regards to side channel analysis and possibly even energy consumption. Speed is not necessarily the only reason - although for AES-NI it's very likely the to be the most important one. $\endgroup$
    – Maarten Bodewes ♦
    Oct 9, 2014 at 12:42
  • $\begingroup$ This isn't even just imaginary. Remember when computers lacked the ability to do much math and you had to buy a dedicated FPU to do floating point operations in hardware? This was back when x87 was a physical chip. $\endgroup$
    – forest ♦
    Mar 7, 2018 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.