Fast implementation of GF(28) inversion with applications to the AES S-box using ARM Helium MVE extensions

The AES block cipher is widely used in embedded systems. Efficient realizations of its S-box, which consists of a costly inversion in GF(28) and an affine transformation, are usually done with lookup tables, which may be vulnerable to timing side-channel attacks. We develop a constant-time inversion algorithm in GF(28) optimized with Arm Helium MVE extensions and a fully vectorized suite of field-arithmetic primitives, from which we derive three Cortex-M S-box implementations: two table-free exponentiation schedules requiring only three field multiplications, and a third variant employing a compact, vectorized 16-byte lookup table. We integrate these methods into a constant-time AES-128 implementation on a Cortex-M85, demonstrating that our proposal is competitive with state-of-the-art implementations.