I'm wondering if implementing only the AES decryption can reduce the hardware cost? And does anybody have some examples of the cost (speed, size) of hardware AES implementation?


2 Answers 2


In practice, AES encryption mostly use CTR mode or some authenticated encryption, and in these the block cipher itself is only used for encryption. There is thus often no need to implement AES decryption in hardware.

We can always remove features from hardware circuitry. Implementing only the AES encryption sizably reduce the hardware cost (compared to also implementing decryption), but implementing only decryption saves much less (especially for cost-optimized rather than speed-optimized designs), because:

  • Decryption requires (as does encryption) forward-computing the round keys, and (specific to decryption) either storing them or walking backward. Therefore the relatively large saving possible for round keys computation by omitting said storage or capability to walk backward has no equivalent when omitting encryption.
  • The S-box used for encryption and the (inverse) one used for decryption are different, and there's sizable saving possible by omitting the decryption one. However the two are not needed simultaneously; it is feasible to share some gates between the two; and even in speed-optimized implementations where that's not done, it might still be possible to reduce to almost nothing the power consumption (and associated costs) of the inactive S-Box.
  • The MixColumns step for decryption is significantly more complex than the one for encryption, and it is feasible to share a lot of gates between the two, so that omitting encryption capability won't necessarily save much there.
  • $\begingroup$ Addendum: The MixColumns step multiplies each column, which is a 4-element vector, by a fixed 4×4 matrix. But the matrix has different coefficients for encryption versus decryption. $\endgroup$
    – Nayuki
    Sep 7, 2018 at 16:27
  • $\begingroup$ Note: as far as I have seen the S-box in HW is generally done with an inverseAffine->Inversion->Affine datapath. Thus most gates are shared and you'll spare only the inverseAffine part. $\endgroup$
    – Ruggero
    Sep 27, 2018 at 7:09

If you are talking about FPGA's here two articles;

  1. An Efficient Hardware Design and Implementation of Advanced Encryption Standard (AES) Algorithm
  2. FPGA based hardware implementation of AES Rijndael algorithm for Encryption and Decryption

As noted in 1 or the original documentation, there are some differences in the decrypter and encrypter. But you don't exactly need two separate algorithms.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.