x86 Instruction Set – Cryptography (AES, SHA, GFNI, SM3, SM4, Key Locker)

AES

The state is a 128-bit AES block in xmm1; the round key is the second source. A full AES-128 encryption is an XOR with the first round key, nine aesenc and one aesenclast. The wider VEX and EVEX forms do the same in each 128-bit lane, with a separate destination.

Carry-less multiplication

A carry-less multiply is multiplication of polynomials over GF(2): partial products are combined with XOR instead of addition. AES-GCM’s GHASH and fast CRC routines are built on it. Assemblers also accept Intel’s names for the four immediates, pclmullqlqdq (00h), pclmulhqlqdq (01h), pclmullqhqdq (10h) and pclmulhqhqdq (11h); the disassembler shows the immediate.

SHA-1 and SHA-256

The state and the message words are packed four 32-bit words to a register. Rounds and message scheduling are separate instructions, so that they can run interleaved.

SHA-512

The SHA-512 instructions have VEX encodings only, take 256-bit YMM registers (four 64-bit words each), and take register operands only (ModRM.mod 11).

SM3 and SM4

SM3 is the Chinese national hash function and SM4 the Chinese national block cipher (128-bit block and key). Both sets have VEX encodings only.

Galois field (GFNI)

These work on bytes as elements of GF(2⁸), with the reduction polynomial x⁸ + x⁴ + x³ + x + 1, which AES uses. The affine forms treat each quadword of the second source as an 8×8 bit matrix. Uses include AES and SM4 S-boxes, bit permutations and erasure codes. The EVEX forms take a mask ({k1}{z}); the affine ones can also broadcast a quadword (m64bcst).

Key Locker

Key Locker lets software use an AES key without holding it. The operating system loads a secret wrapping key into the processor with loadiwkey. A program turns its AES key into a handle with encodekey128 or encodekey256 and can then discard the key: the encryption and decryption instructions take the handle from memory, unwrap it inside the processor and check it. A handle that fails the check, or whose restrictions forbid the operation, sets ZF and leaves the data unchanged. All of them clear OF, SF, AF, PF and CF. They need CR4.KL (bit 19) set.

VIA PadLock

VIA’s C3, C7 and Nano processors, and Zhaoxin’s, which descend from them, have PadLock units: a random number generator (RNG), AES (ACE, later ACE2), SHA (PHE) and a Montgomery multiplier (PMM). The instructions take no ModRM operands: each is a fixed ModRM byte after 0F A6 or 0F A7, and works on fixed general registers and memory. VIA writes XCRYPT, XSHA and MONTMUL with a REP prefix (F3), as below, and XSTORE with or without it. The disassembler names each from the opcode and ModRM byte, whether F3 is there or not.

Reference

• Intel 64 and IA-32 Architectures Software Developer’s Manuals – Intel’s manuals; volume 2 describes each instruction
• Intel Architecture Instruction Set Extensions Programming Reference – Intel’s reference to instructions before they reach the main manual, among them SHA512, SM3 and SM4
• Intel Key Locker Specification – Intel’s specification of Key Locker
• AMD64 Architecture Programmer’s Manual, Volume 4 – AMD’s reference to the media instructions, with AES, PCLMULQDQ and SHA
• x86 and amd64 instruction reference – Félix Cloutier’s web copy of the instruction pages of Intel’s manual