Introduction
The scalar cryptography extensions are named Zk (all of Zkn, Zkr and Zkt), Zkn (NIST algorithms: Zbkb, Zbkc,
Zbkx, Zkne, Zknd, Zknh) and Zks (ShangMi: Zbkb, Zbkc, Zbkx, Zksed, Zksh). The instructions are R-format
(opcode 0110011 or 0010011) and are described below by the extension that has them.
Zkt adds no instruction (it promises constant-time execution of a list of them).
Zbkb, Zbkc, Zbkx: bit manipulation for cryptography
Zbkb has rol, ror, rori, andn, orn,
xnor and rev8 (shared with Zbb) and the following.
Zbkc has clmul and clmulh (the other half of Zbc).
| Instruction | Encoding | What it does |
|---|---|---|
pack | OP, funct7 0000100, funct3 100 | rd = low half of rs2 : low half of rs1. |
packh | OP, funct7 0000100, funct3 111 | rd = zero-extended (low byte of rs2 : low byte of rs1). |
packw (rv64) | OP-32, funct7 0000100, funct3 100 | Pack the low halfwords into a sign-extended word. |
brev8 | OP-IMM, 011010000111, funct3 101 | Reverse the bits within each byte. |
zip, unzip (rv32) | OP-IMM, 000010001111, funct3 001, 101 | Interleave the two halves of rs1 bit by bit; the inverse. |
xperm4, xperm8 (Zbkx) | OP, funct7 0010100, funct3 010, 100 | Crossbar permutation: rs2 holds indices into the nibbles or bytes of rs1. |
Zknd and Zkne: AES
| Instruction | Encoding | What it does |
|---|---|---|
aes32esi, aes32esmi (rv32, Zkne) | OP, funct3 000, bits 29:25 = 10001, 10011; bs = bits 31:30 | One byte of the final / middle encryption round: rd, rs1, rs2, bs. |
aes32dsi, aes32dsmi (rv32, Zknd) | OP, funct3 000, bits 29:25 = 10101, 10111 | The same for decryption. |
aes64es, aes64esm (rv64, Zkne) | OP, funct7 0011001, 0011011 | Final and middle encryption round, half a block. |
aes64ds, aes64dsm (rv64, Zknd) | OP, funct7 0011101, 0011111 | Final and middle decryption round. |
aes64im (rv64, Zknd) | OP-IMM, 001100000000, funct3 001 | Inverse MixColumns. |
aes64ks1i (rv64) | OP-IMM, 00110001 + rnum (bits 23:20), funct3 001 | Key schedule step 1, round number 0 to 10 (11 to 15 are reserved). |
aes64ks2 (rv64) | OP, funct7 0111111 | Key schedule step 2. |
Zknh: SHA-2
| Instruction | Encoding | What it does |
|---|---|---|
sha256sum0, sha256sum1, sha256sig0, sha256sig1 | OP-IMM, funct3 001, bits 31:20 = 000100000000 to …0011 | The SHA-256 Σ and σ functions. |
sha512sum0, sha512sum1, sha512sig0, sha512sig1 (rv64) | OP-IMM, funct3 001, bits 31:20 = 000100000100 to …0111 | The SHA-512 functions. |
sha512sum0r, sha512sum1r, sha512sig0l, sha512sig0h, sha512sig1l, sha512sig1h (rv32) | OP, funct3 000, funct7 0101000, 0101001, 0101010, 0101110, 0101011, 0101111 | The SHA-512 functions in 32-bit halves. |
Zksed and Zksh: ShangMi (SM4, SM3)
| Instruction | Encoding | What it does |
|---|---|---|
sm4ed, sm4ks | OP, funct3 000, bits 29:25 = 11000, 11010; bs = bits 31:30 | One byte of an SM4 round / key schedule: rd, rs1, rs2, bs. |
sm3p0, sm3p1 | OP-IMM, funct3 001, bits 31:20 = 000100001000, …1001 | The SM3 permutations P0 and P1. |
Zkr: the entropy source
No instruction of its own: the CSR seed (number 0x015) is read with csrrw (the read has
a side effect, so the CSR instruction must write). Its value is 16 bits of entropy with a two-bit status in bits
31:30.