I have an implementation of AES which can cache at most a 256-bit value between encryptions. Currently, the master key is cached and the key schedule is re-computed for each and every block. Is there any intermediate ≤ 256-bit value which can be derived from the master key which I can cache and use to compute each round key faster than re-running the entire key schedule?
The implementation is in x86 assembly in 64-bit mode and uses the AES-NI extensions. This means I have the
AESKEYGENASSIST instruction, which performs the following in 10-12 cycles:
X3[31:0] ← SRC [127: 96]; X2[31:0] ← SRC [95: 64]; X1[31:0] ← SRC [63: 32]; X0[31:0] ← SRC [31: 0]; RCON[31:0] ← ZeroExtend(Imm8[7:0]); DEST[31:0] ← SubWord(X1); DEST[63:32 ] ← RotWord( SubWord(X1) ) XOR RCON; DEST[95:64] ← SubWord(X3); DEST[127:96] ← RotWord( SubWord(X3) ) XOR RCON; DEST[MAXVL-1:128] (Unmodified)