AES instruction set
An Advanced Encryption Standard instruction set is now integrated into many processors. The purpose of the instruction set is to improve the speed and security of applications performing encryption and decryption using Advanced Encryption Standard (AES). They are often implemented as instructions implementing a single round of AES along with a special version for the last round which has a slightly different method. The side channel attack surface of AES is reduced when implemented in an instruction set, compared to when AES is implemented in software only. x86 architecture processors. AES-NI (or the Intel Advanced Encryption  Standard New Instructions; AES-NI) was the first major implementation. AES-NI is an extension to the x86 instruction set architecture for microprocessors from Intel and AMD proposed by Intel in March 2008. Intel. The following Intel processors support the AES-NI instruction set: AMD. Several AMD processors support AES instructions: Hardware acceleration in other architectures. AES support with unprivileged processor instructions is also available in the latest SPARC processors (T3, T4, T5, M5, and forward) and in latest ARM processors. The SPARC T4 processor, introduced in 2011, has user-level instructions implementing AES rounds. These instructions are in addition  to higher level encryption commands. The ARMv8-A processor architecture, announced in 2011, including the ARM Cortex-A53 and A57 (but not previous v7 processors like the Cortex A5, 7, 8, 9, 11, 15 ) also have user-level instructions which implement AES rounds. Supporting x86 CPUs. VIA x86 CPUs, AMD Geode, and Marvell Kirkwood (ARM, mv_cesa in Linux) use driver-based accelerated AES handling instead. (See Crypto API (Linux).) The following chips, while supporting AES hardware acceleration, do not support AES-NI: ARM architecture. Programming information is available in "ARM Architecture Reference Manual ARMv8, for ARMv8-A architecture profile (Section  A2.3 "The Armv8 Cryptographic Extension")". RISC-V architecture. Whilst the RISC-V architecture doesn't include AES-specific instructions, a number of RISC-V chips include integrated AES co-processors. Examples include: POWER architecture. Since the Power_ISA_v.2.07, the instructions codice_1 and codice_2 implement one round of AES directly. IBM z/Architecture. IBM z9 or later mainframe processors support AES as single-opcode (KM, KMC) AES ECB/CBC instructions via IBM's CryptoExpress hardware. These single-instruction AES versions are therefore easier to use than Intel NI ones, but may not be extended to implement other algorithms based on AES round  functions (such as the Whirlpool and Grøstl hash functions). Performance. In "AES-NI Performance Analyzed", Patrick Schmid and Achim Roos found "impressive results from a handful of applications already optimized to take advantage of Intel's AES-NI capability". A performance analysis using the Crypto++ security library showed an increase in throughput from approximately 28.0 cycles per byte to 3.5 cycles per byte with AES/GCM versus a Pentium 4 with no acceleration. Supporting software. Most modern compilers can emit AES instructions. Much security and cryptography software supports the AES instruction set, including the following notable core infrastructure: A fringe  use of the AES instruction set involves using it on block ciphers with a similarly-structured S-box, using affine isomorphism to convert between the two. SM4 and Camellia have been accelerated using AES-NI.