All the AES You Need on Cortex M3 and M4
This paper describes highly optimized AES {128,192,256\ CTR assembly implementations for the popular ARM Cortex M3 and M4 embedded microprocessors. These implementations are about twice as fast as existing implementations. Additionally, we provide the fastest bitsliced constant time and masked implementations of AES 128 CTR to protect against timing attacks, power analysis and other (first order) side channel attacks. All implementations, including an architecture specific instruction scheduler and register allocator, which we use to minimize expensive loads, are released into the public domain.
SAC