Overview

The Advanced Encryption Standard (AES) is a symmetric-key block cipher adopted as a Federal Information Processing Standard by the National Institute of Standards and Technology (NIST). AES was selected through an open competition and is based on the Rijndael algorithm. The standard defines operations over fixed-size blocks and supports multiple key sizes.

Polynomial and Algebraic Description

Academic work provides a polynomial description of Rijndael AES, with particular attention to the structure of its S-Box. This algebraic view exposes AES as computations over finite-field polynomials rather than as opaque lookup operations.

Source: A Polynomial Description of the Rijndael Advanced Encryption Standard (arXiv:cs/0205002).

Use as a Workload for Fault-Emulation Studies

In the paper An Engineered Minimal-Set Stimulus for Periodic Information Leakage Fault Detection on a RISC-V Microprocessor (OSTI 2341388), AES is used as the executable binary loaded onto the Potato RISC-V microprocessor for fault-emulation experiments.

Specifically:

• The Potato core is loaded with an AES executable; both a clean simulation and the instrumented emulation run the same AES binary so that, in a fault-free run, they are in identical states (register values, peripheral states, instruction inputs).
• The Fault Emulation Engine (FE) is realized as a set of state machines that collect serial and address-bus data as Potato executes AES; combined with a binary search routine in the Fault Injection Manager (FIM), this determines the latency of fault effects during AES execution.
• Counter values for each node are generated in a fault-free run of the AES binary and stored in increments of 1024 cycles from cycle 0 to cycle 6,717,440 to enable fault-observable cycle identification.
• Tables of Binary-Search Fault-Detected Cycles (BFTCs) and Incremental-Search Fault-Detected Cycles (IFTCs) for the AES binary running on Potato are reported, covering stuck-at-0, stuck-at-1, delay, and invert fault classes. The highest-latency detected fault for the AES workload occurs at cycle 6,078,464 (1024-cycle granularity) and at cycle 6,076,072 (single-cycle granularity), both corresponding to delay faults.
• A SystemVerilog test bench simulates Potato to the IFTC under the AES binary, capturing general-purpose register values, the previous 10 instructions, and memory/Wishbone interconnect bus reads and writes, so that the microprocessor (μP) state at the IFTC can be replicated.

Source: OSTI 2341388, An Engineered Minimal-Set Stimulus for Periodic Information Leakage Fault Detection on a RISC-V Microprocessor.

Relation to Related Work on RISC-V Hardware/Software Codesign

The authors of the related RISC-V framework (cited as reference [7] in OSTI 2341388) demonstrate its use for fast implementation, functional verification, and post-synthesis verification of cryptographic hardware accelerators for AES and of post-quantum cryptography ISA extensions for RISC-V. They note, however, that the framework has not been shown to aid in the detection of hardware-based information-leakage faults — motivating the periodic counter-based approach evaluated in the same paper.

Applications Beyond Fault Emulation

AES is also used as the underlying cipher for full-disk encryption (FDE) schemes protecting hard-disk drives (HDDs) in PCs and laptops, where its symmetric-key cryptography with adjustable key sizes is applied to entire volumes or single volumes. Example: the DiskTrust adaptive method.

Source: An Adaptive Technique using Advanced Encryption Standard to Implement Hard Disk Security (arXiv:1109.4565).

Key Characteristics (from cited evidence)