Accelerating AES with Vector Permute Instructions

We demonstrate new techniques to speed up the Rijndael (AES) block cipher using vector permute instructions. Because these techniques avoid data- and key-dependent branches and memory references, they are immune to known timing attacks. This is the first constant-time software implementation of AES which is efficient for sequential modes of operation. This work can be adapted to several other primitives using the AES S-box such as the stream cipher LEX, the block cipher Camellia and the hash function Fugue. We focus on Intel's SSSE3 and Motorola's Altivec, but our techniques can be adapted to other systems with vector permute instructions, such as the IBM Xenon and Cell processors, the ARM Cortex series and the forthcoming AMD "Bulldozer" core. Key words: AES, AltiVec, SSSE3, vector permute, composite fields, cache-timing attacks, fast implementations

• Type: Conference
• Year: 2009
• Where: CHES
• Authors: Mike Hamburg
• Keywords: AES S-box, Block Cipher Camellia, CHES 2009, Cryptography, Vector Permute Instructions