Paper 2026/826 Original: eprint.iacr.org/2026/826 ↗

Efficient Implementation of ARIA on ARMv8 via Cryptographic Extensions

Abstract

The ARIA block cipher is the Korean national standard (KS X 1213) and an IETF standard (RFC 5794). Despite its widespread use, research on efficient implementation for modern ARMv8 processors has remained limited compared to AES, which benefits from dedicated hardware instructions. The best prior ARMv8 result by Eum et al. reported 0.573 cycles per byte (cpb); however, through direct communication with the authors and independent re-evaluation, we confirmed that this published figure reflects a measurement error and that the actual cost is 5.845cpb. In this paper, we present a 16-way parallel ARIA implementation on ARMv8 NEON that evaluates all four ARIA S-boxes through the AESE/AESD cryptographic extensions, eliminating S-box table lookups from the round function entirely. Two of the S-boxes reduce to a single AESE/AESD instruction, while the remaining two are computed via a nibble-split decomposition of the underlying multiplicative inverse, requiring only two NEON registers of precomputed constants per S-box. Combined with a byte-sliced data layout and a 64-instruction transposition butterfly, our implementation achieves 1.483cpb for ARIA-128 on the Apple M1—a 3.94× speedup over the corrected prior result. Multi-threaded CTR-mode measurements demonstrate near-linear scalability, reaching 6.67GB/s with 4 threads on the performance cores and 8.33GB/s with 8 threads. On the ARM Cortex-A76 (Raspberry Pi 5), the implementation achieves 3.586cpb and scales to 2.36GB/s with 4 threads.