ARM64 Instruction Set – Cryptography

AES, polynomial multiply, SHA-1, SHA-2, SHA-3, SM3 and SM4

Introduction

These instructions do the core steps of common ciphers and hash functions. They use the SIMD and floating-point registers V0 to V31, nearly always as whole 128-bit values. Each algorithm has its own optional feature: FEAT_AES, FEAT_PMULL, FEAT_SHA1, FEAT_SHA256, FEAT_SHA512, FEAT_SHA3, FEAT_SM3 and FEAT_SM4.

None of these instructions changes NZCV, so the Flags column is a dash throughout.

The instructions

AES

A round of AES is the pair aese and aesmc, or aesd and aesimc to decrypt. The round key is applied at the start of the first instruction of the pair.

MnemonicSyntaxWhat it doesFlags
aeseaese Vd.16b, Vn.16bXORs Vd with the round key Vn, then applies ShiftRows and SubBytes.–
aesdaesd Vd.16b, Vn.16bXORs Vd with the round key Vn, then applies InvShiftRows and InvSubBytes.–
aesmcaesmc Vd.16b, Vn.16bApplies MixColumns to Vn and writes the result to Vd.–
aesimcaesimc Vd.16b, Vn.16bApplies InvMixColumns to Vn and writes the result to Vd.–

Polynomial multiply

The 8-bit forms of these mnemonics are ordinary Advanced SIMD instructions; see the Advanced SIMD page. The 64-bit forms here are used for GCM and for CRC calculations.

MnemonicSyntaxWhat it doesFlags
pmull, pmull2pmull Vd.1q, Vn.1d, Vm.1d; pmull2 Vd.1q, Vn.2d, Vm.2dCarry-less multiply of two 64-bit values, giving a 128-bit result. pmull reads the lower doublewords, pmull2 the upper.–

SHA-1

Each hash update does four rounds, and the three differ in the round function they use.

MnemonicSyntaxWhat it doesFlags
sha1csha1c Qd, Sn, Vm.4sHash update using the choose function.–
sha1psha1p Qd, Sn, Vm.4sHash update using the parity function.–
sha1msha1m Qd, Sn, Vm.4sHash update using the majority function.–
sha1hsha1h Sd, SnRotates a 32-bit value left by 30.–
sha1su0, sha1su1sha1su0 Vd.4s, Vn.4s, Vm.4s; sha1su1 Vd.4s, Vn.4sThe two parts of the message schedule update.–

SHA-256

MnemonicSyntaxWhat it doesFlags
sha256h, sha256h2sha256h Qd, Qn, Vm.4sThe two parts of the hash update. Together they do four rounds: sha256h gives the new A to D words of the state, and sha256h2 the new E to H words.–
sha256su0, sha256su1sha256su0 Vd.4s, Vn.4s; sha256su1 Vd.4s, Vn.4s, Vm.4sThe two parts of the message schedule update.–

SHA-512

MnemonicSyntaxWhat it doesFlags
sha512h, sha512h2sha512h Qd, Qn, Vm.2dThe two parts of the hash update. Together they do two rounds.–
sha512su0, sha512su1sha512su0 Vd.2d, Vn.2d; sha512su1 Vd.2d, Vn.2d, Vm.2dThe two parts of the message schedule update.–

SHA-3 helpers

These are general bitwise operations chosen to suit the Keccak permutation.

MnemonicSyntaxWhat it doesFlags
eor3eor3 Vd.16b, Vn.16b, Vm.16b, Va.16bXORs three registers.–
bcaxbcax Vd.16b, Vn.16b, Vm.16b, Va.16bVn XOR (Vm AND NOT Va).–
rax1rax1 Vd.2d, Vn.2d, Vm.2dRotates each doubleword of Vm left by 1, then XORs with Vn.–
xarxar Vd.2d, Vn.2d, Vm.2d, #immXORs Vn and Vm, then rotates each doubleword right by the immediate (0 to 63).–

SM3

SM3 is the Chinese national hash function.

MnemonicSyntaxWhat it doesFlags
sm3ss1sm3ss1 Vd.4s, Vn.4s, Vm.4s, Va.4sComputes the SS1 value of a round from the top words of the three sources: Vn rotated left by 12, plus Vm and Va, the whole rotated left by 7. The other three words of Vd are cleared.–
sm3tt1a, sm3tt1bsm3tt1a Vd.4s, Vn.4s, Vm.s[i]The TT1 half of a compression round. The a form is for rounds 0 to 15 and the b form for rounds 16 to 63.–
sm3tt2a, sm3tt2bsm3tt2a Vd.4s, Vn.4s, Vm.s[i]The TT2 half of a compression round, with the same division of rounds.–
sm3partw1, sm3partw2sm3partw1 Vd.4s, Vn.4s, Vm.4sThe two parts of the message schedule update.–

SM4

SM4 is the Chinese national block cipher.

MnemonicSyntaxWhat it doesFlags
sm4esm4e Vd.4s, Vn.4sEncrypts the block in Vd by four rounds, with the round keys in Vn.–
sm4ekeysm4ekey Vd.4s, Vn.4s, Vm.4sDerives four round keys from Vn and the constants in Vm.–

Links

Reference