# Help with AES decryption with AES-NI Instructions

I am in process of implementing a AES 128 encryption in AVX2 assembly (using AES NI), and am having some problems with decryption logic. I have implemented the encryption sequence without any trouble. However, decryption has been giving many problems.So, my questions regarding the decryption are :

1. Are the keys identical for the encryption sequence and decryption sequence? If not, then, am I required to execute a VAESIMC instruction on the keys as generated for encryption to make those functional for decryption ? If yes, then must I skip this instruction for the Key 0 [the original Key] and for the Key 10 [the last in sequence to get generated] ? Please clarify...

2. Once the keys have been generated, the sequence of operation is to take the ciphertext, XOR with the Key 10 value, and apply VAESDECLAST to the result using Key 9, and VAESDEC for all other rounds? Or, alternatively, I must apply VAESDEC to result of the XOR from Key 10 step, and apply the VAESDECLAST to the last round (Key 1 ) ?

All help and advice is welcome. Remain grateful..

This answer is based on Intel® Advanced Encryption Standard (AES) New Instructions Set whitepaper (Revision 3.01, September 2012) by Shay Gueron.

1. No, the keys are not identical (within order) for encryption and decryption. The first and last key used in decryption are indeed the last and first one used in encryption; but the other decryption keys are the encryption keys with an additional InvMixColumns applied (usually by way of the AESIMC instruction in a preparatory step), in reverse order.

2. No, the sequence of operations is not as described in the question; it shall be, for AES-128:

• XOR with $K_{10}$ (the last and 11th key used in encryption);
• for $j$ from $9$ downto $1$:
• apply VAESDEC to the result using $K^\prime_j$ (the image by InvMixColumns of the $(j+1)$th key used in encryption);
• apply VAESDECLAST to the result using $K_0$ (the first key used in encryption).

Rationale: having InvMixColumns pre-applied to (the bulk of) the round keys allows to combine them in the decryption flow after InvMixColumns, rather than before in a realisation of decryption that inverts encryption step by step. Presumably, that's easing pipelining constraints. It works because InvMixColumns is linear, that is $\operatorname{InvMixColumns}(X\oplus K_j)=\operatorname{InvMixColumns}(X)\oplus \operatorname{InvMixColumns}(K_j)$.

• Thanks ! It works perfectly after following your advice... Feb 1, 2016 at 23:21