Fixslicing is a slightly different technique that is a little bit faster: https://eprint.iacr.org/2020/1123.pdf https://eprint.iacr.org/2020/1123.pdf Bitsliced

Fixslicing is a slightly different technique that is a little bit faster: https://eprint.iacr.org/2020/1123.pdf https://eprint.iacr.org/2020/1123.pdf Bitsliced/fixsliced AES remains painfully slow compared to lookup-based AES, but also to ciphers that can easily be implemented without side channels to start with. So, my recommendation would be: - Do you have hardware-accelerated, side-channels free AES? Go use it. - Are side channels part of your threat model? Do you think they are practical in the context of your application? (for the vast majority of cases, the honest answer is: they aren't) If this is the case, do NOT use AES or anything that would require bitslicing/fixslicing to be safe. ChaCha20 is likely to perform way better on that platform. Not to mention more recent alternatives. - They are not? For some reason, you still want to use AES? Use a table-based implementation and don't worry about it. Yes, this is fine. Don't take it the wrong way. Bitslicing/fixslicing are excellent mitigation against side channels. But AES+bitslicing shouldn't be your go to choice.