Skip to content

Commit 73de909

Browse files
ben-marshallben-marshall
committed
Zvk: Update AES instruction specs
- Make destructive in most cases - Add `rnum` immediate to key schedule instructions On branch master Your branch is up-to-date with 'origin/master'. Changes to be committed: modified: insns/vaes128e.adoc new file: insns/vaes192e.adoc new file: insns/vaes256e.adoc modified: insns/vaesds.adoc modified: insns/vaesdsm.adoc modified: insns/vaeses.adoc modified: insns/vaesesm.adoc modified: insns/vaeskf128.vv.adoc modified: insns/vaeskf192.vv.adoc modified: insns/vaeskf256.vv.adoc modified: riscv-crypto-spec-vector.adoc
1 parent 17c2c39 commit 73de909

11 files changed

+273
-78
lines changed

‎doc/vector/insns/vaes128e.adoc

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
= vaes128e.[vv,vs]
33

44
Synopsis::
5-
Vector AES all rounds encryption instruction.
5+
Vector AES-128 all rounds encryption instruction.
66

77
Mnemonic::
88
vaes128e.[vv,vs] vd, vs1, vs2
@@ -15,7 +15,7 @@ Encoding (Vector-Scalar)::
1515
{bits: 5, name: 'vd'},
1616
{bits: 3, name: '???'},
1717
{bits: 5, name: 'vs1'},
18-
{bits: 5, name: 'vs2'},
18+
{bits: 5, name: '?????'},
1919
{bits: 7, name: '???????'},
2020
]}
2121
....
@@ -28,21 +28,21 @@ Encoding (Vector-Vector)::
2828
{bits: 5, name: 'vd'},
2929
{bits: 3, name: '???'},
3030
{bits: 5, name: 'vs1'},
31-
{bits: 5, name: 'vs2'},
31+
{bits: 5, name: '?????'},
3232
{bits: 7, name: '???????'},
3333
]}
3434
....
3535

3636
Description::
3737
This instruction implements the entire AES-128 block cipher encryption
3838
function.
39-
It treats each element of `vs1` as the current AES round state,
40-
and elements of `vs2` as the encryption key.
41-
The Vector-Vector (VV) variant encrypts elements of `vs1` under corresponding
42-
elements of `vs2`.
43-
The Vector-Scalar (VV) variant encrypts elements of `vs1` under the
44-
zeroth element of `vs2`.
45-
The result (i.e. the next round state) is written to elements of `vd`.
39+
It treats each element of `vd` as the plaintext
40+
and elements of `vs1` as the encryption key.
41+
The Vector-Vector (VV) variant encrypts elements of `vd` under corresponding
42+
elements of `vs1`.
43+
The Vector-Scalar (VV) variant encrypts elements of `vd` under the
44+
zeroth element of `vs1`.
45+
The result (i.e. the ciphertext) is written to elements of `vd`.
4646

4747
This instruction treats `EEW=128`, regardless of `vtype.vsew`
4848
and requires that `Zvl128b` be implemented (i.e `VLEN>=128`).
@@ -52,12 +52,12 @@ supported for any other instruction.
5252
Operation::
5353
[source,sail]
5454
--
55-
function clause execute (VAES128E(vs2, vs1, vd, vv)) = {
55+
function clause execute (VAES128E(vs1, vd, vv)) = {
5656
assert(VLEN>=128);
5757
foreach (i from vlstart to vl) {
5858
let keyelem = if vv then i else 0;
59-
state : bits(128) = get_velem(vs1, EEW=128, i);
60-
rkey : bits(128) = get_velem(vs2, EEW=128, keyelem);
59+
state : bits(128) = get_velem(vd, EEW=128, i);
60+
rkey : bits(128) = get_velem(vs1, EEW=128, keyelem);
6161
state = state ^ rkey;
6262
foreach(r from 0 to 10) {
6363
state = aes_fwd_sub_bytes(state);
@@ -87,5 +87,3 @@ Included in::
8787
| In Development
8888
|===
8989

90-
91-

‎doc/vector/insns/vaes192e.adoc

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
[[insns-vaes192e, Vector AES-192 all-rounds encrypt]]
2+
= vaes192e.[vv,vs]
3+
4+
Synopsis::
5+
Vector AES-192 all rounds encryption instruction.
6+
7+
Mnemonic::
8+
vaes192e.[vv,vs] vd, vs1, vs2
9+
10+
Encoding (Vector-Scalar)::
11+
[wavedrom, , svg]
12+
....
13+
{reg:[
14+
{bits: 7, name: '???????'},
15+
{bits: 5, name: 'vd'},
16+
{bits: 3, name: '???'},
17+
{bits: 5, name: 'vs1'},
18+
{bits: 5, name: 'vs2'},
19+
{bits: 7, name: '???????'},
20+
]}
21+
....
22+
23+
Encoding (Vector-Vector)::
24+
[wavedrom, , svg]
25+
....
26+
{reg:[
27+
{bits: 7, name: '???????'},
28+
{bits: 5, name: 'vd'},
29+
{bits: 3, name: '???'},
30+
{bits: 5, name: 'vs1'},
31+
{bits: 5, name: 'vs2'},
32+
{bits: 7, name: '???????'},
33+
]}
34+
....
35+
36+
Description::
37+
This instruction implements the entire AES-192 block cipher encryption
38+
function.
39+
It treats each element of `vd` as the plaintext
40+
and concatenates elements of `vs1` and `vs2` to create the 192-bit key.
41+
The Vector-Vector (VV) variant encrypts elements of `vd` under corresponding
42+
elements of `vs1` and `vs2`.
43+
The Vector-Scalar (VV) variant encrypts elements of `vd` under the
44+
zeroth element of `vs1` and `vs2`.
45+
The result (i.e. the ciphertext) is written to elements of `vd`.
46+
47+
This instruction treats `EEW=128`, regardless of `vtype.vsew`
48+
and requires that `Zvl128b` be implemented (i.e `VLEN>=128`).
49+
It _does not_ require that `EEW=128` be
50+
supported for any other instruction.
51+
52+
Operation::
53+
[source,sail]
54+
--
55+
function clause execute (VAES192E(vs1, vd, vv)) = {
56+
assert(VLEN>=128);
57+
foreach (i from vlstart to vl) {
58+
let keyelem = if vv then i else 0;
59+
state : bits(128) = get_velem(vd, EEW=128, i);
60+
ekey : bits(192) = get_velem(vs1, EEW=128, keyelem) @
61+
get_velem(vs2, EEW=128, keyelem) [128..64];
62+
rkey : bits(128) = ekey[127..0];
63+
state = state ^ rkey;
64+
foreach(r from 0 to 12) {
65+
state = aes_fwd_sub_bytes(state);
66+
state = aes_fwd_shift_rows(state);
67+
state = aes_fwd_mix_columns(state);
68+
state = state ^ rkey;
69+
rkey = aes_192_forward_key_schedule(ekey);
70+
ekey = rkey @ ekey[128..64];
71+
}
72+
state = aes_fwd_sub_bytes(state);
73+
state = aes_fwd_shift_rows(state);
74+
state = state ^ rkey;
75+
set_velem(vd, EEW=128, i, state);
76+
}
77+
RETIRE_SUCCESS
78+
}
79+
--
80+
81+
Included in::
82+
[%header,cols="4,2,2"]
83+
|===
84+
|Extension
85+
|Minimum version
86+
|Lifecycle state
87+
88+
| <<zvknf>>
89+
| v0.1.0
90+
| In Development
91+
|===
92+
93+

‎doc/vector/insns/vaes256e.adoc

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
[[insns-vaes256e, Vector AES-256 all-rounds encrypt]]
2+
= vaes256e.[vv,vs]
3+
4+
Synopsis::
5+
Vector AES-256 all rounds encryption instruction.
6+
7+
Mnemonic::
8+
vaes256e.[vv,vs] vd, vs1, vs2
9+
10+
Encoding (Vector-Scalar)::
11+
[wavedrom, , svg]
12+
....
13+
{reg:[
14+
{bits: 7, name: '???????'},
15+
{bits: 5, name: 'vd'},
16+
{bits: 3, name: '???'},
17+
{bits: 5, name: 'vs1'},
18+
{bits: 5, name: 'vs2'},
19+
{bits: 7, name: '???????'},
20+
]}
21+
....
22+
23+
Encoding (Vector-Vector)::
24+
[wavedrom, , svg]
25+
....
26+
{reg:[
27+
{bits: 7, name: '???????'},
28+
{bits: 5, name: 'vd'},
29+
{bits: 3, name: '???'},
30+
{bits: 5, name: 'vs1'},
31+
{bits: 5, name: 'vs2'},
32+
{bits: 7, name: '???????'},
33+
]}
34+
....
35+
36+
Description::
37+
This instruction implements the entire AES-256 block cipher encryption
38+
function.
39+
It treats each element of `vd` as the plaintext
40+
and concatenates elements of `vs1` and `vs2` to create the 256-bit key.
41+
The Vector-Vector (VV) variant encrypts elements of `vd` under corresponding
42+
elements of `vs1` and `vs2`.
43+
The Vector-Scalar (VV) variant encrypts elements of `vd` under the
44+
zeroth element of `vs1` and `vs2`.
45+
The result (i.e. the ciphertext) is written to elements of `vd`.
46+
47+
This instruction treats `EEW=128`, regardless of `vtype.vsew`
48+
and requires that `Zvl128b` be implemented (i.e `VLEN>=128`).
49+
It _does not_ require that `EEW=128` be
50+
supported for any other instruction.
51+
52+
Operation::
53+
[source,sail]
54+
--
55+
function clause execute (VAES256E(vs1, vd, vv)) = {
56+
assert(VLEN>=128);
57+
foreach (i from vlstart to vl) {
58+
let keyelem = if vv then i else 0;
59+
state : bits(128) = get_velem(vd, EEW=128, i);
60+
ekey : bits(256) = get_velem(vs1, EEW=128, keyelem) @
61+
get_velem(vs2, EEW=128, keyelem) ;
62+
rkey : bits(128) = ekey[127..0];
63+
state = state ^ rkey;
64+
foreach(r from 0 to 12) {
65+
state = aes_fwd_sub_bytes(state);
66+
state = aes_fwd_shift_rows(state);
67+
state = aes_fwd_mix_columns(state);
68+
state = state ^ rkey;
69+
rkey = aes_256_forward_key_schedule(ekey);
70+
ekey = rkey @ ekey[256..128];
71+
}
72+
state = aes_fwd_sub_bytes(state);
73+
state = aes_fwd_shift_rows(state);
74+
state = state ^ rkey;
75+
set_velem(vd, EEW=128, i, state);
76+
}
77+
RETIRE_SUCCESS
78+
}
79+
--
80+
81+
Included in::
82+
[%header,cols="4,2,2"]
83+
|===
84+
|Extension
85+
|Minimum version
86+
|Lifecycle state
87+
88+
| <<zvknf>>
89+
| v0.1.0
90+
| In Development
91+
|===
92+
93+
94+

‎doc/vector/insns/vaesds.adoc

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ Encoding (Vector-Scalar)::
1515
{bits: 5, name: 'vd'},
1616
{bits: 3, name: '???'},
1717
{bits: 5, name: 'vs1'},
18-
{bits: 5, name: 'vs2'},
18+
{bits: 5, name: '?????'},
1919
{bits: 7, name: '???????'},
2020
]}
2121
....
@@ -28,20 +28,20 @@ Encoding (Vector-Vector)::
2828
{bits: 5, name: 'vd'},
2929
{bits: 3, name: '???'},
3030
{bits: 5, name: 'vs1'},
31-
{bits: 5, name: 'vs2'},
31+
{bits: 5, name: '?????'},
3232
{bits: 7, name: '???????'},
3333
]}
3434
....
3535

3636
Description::
3737
This instruction implements the final-round decryption function of the AES
3838
block cipher for all parameterisations.
39-
It treats each element of `vs1` as the current AES round state,
40-
and elements of `vs2` as the round key.
41-
The Vector-Vector (VV) variant decrypts elements of `vs1` under corresponding
42-
elements of `vs2`.
43-
The Vector-Scalar (VV) variant dwcrypts elements of `vs1` under the
44-
zeroth element of `vs2`.
39+
It treats each element of `vd` as the current AES round state,
40+
and elements of `vs1` as the round key.
41+
The Vector-Vector (VV) variant decrypts elements of `vd` under corresponding
42+
elements of `vs1`.
43+
The Vector-Scalar (VV) variant decrypts elements of `vd` under the
44+
zeroth element of `vs1`.
4545
The result (i.e. the next round state) is written to elements of `vd`.
4646

4747
This instruction treats `EEW=128`, regardless of `vtype.vsew`
@@ -52,12 +52,12 @@ supported for any other instruction.
5252
Operation::
5353
[source,sail]
5454
--
55-
function clause execute (VAESDS(vs2, vs1, vd, vv)) = {
55+
function clause execute (VAESDS(vs1, vd, vv)) = {
5656
assert(VLEN>=128);
5757
foreach (i from vlstart to vl) {
5858
let keyelem = if vv then i else 0;
59-
let state : bits(128) = get_velem(vs1, EEW=128, i);
60-
let rkey : bits(128) = get_velem(vs2, EEW=128, keyelem);
59+
let state : bits(128) = get_velem(vd, EEW=128, i);
60+
let rkey : bits(128) = get_velem(vs1, EEW=128, keyelem);
6161
let sr : bits(128) = aes_inv_shift_rows(state);
6262
let sb : bits(128) = aes_inv_sub_bytes(sr);
6363
let ark : bits(128) = sb ^ rkey;

‎doc/vector/insns/vaesdsm.adoc

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ Encoding (Vector-Scalar)::
1515
{bits: 5, name: 'vd'},
1616
{bits: 3, name: '???'},
1717
{bits: 5, name: 'vs1'},
18-
{bits: 5, name: 'vs2'},
18+
{bits: 5, name: '?????'},
1919
{bits: 7, name: '???????'},
2020
]}
2121
....
@@ -28,20 +28,20 @@ Encoding (Vector-Vector)::
2828
{bits: 5, name: 'vd'},
2929
{bits: 3, name: '???'},
3030
{bits: 5, name: 'vs1'},
31-
{bits: 5, name: 'vs2'},
31+
{bits: 5, name: '?????'},
3232
{bits: 7, name: '???????'},
3333
]}
3434
....
3535

3636
Description::
3737
This instruction implements the middle-round decryption function of the AES
3838
block cipher for all parameterisations.
39-
It treats each element of `vs1` as the current AES round state,
40-
and elements of `vs2` as the round key.
41-
The Vector-Vector (VV) variant decrypts elements of `vs1` under corresponding
42-
elements of `vs2`.
43-
The Vector-Scalar (VV) variant decrypts elements of `vs1` under the
44-
zeroth element of `vs2`.
39+
It treats each element of `vd` as the current AES round state,
40+
and elements of `vs1` as the round key.
41+
The Vector-Vector (VV) variant decrypts elements of `vd` under corresponding
42+
elements of `vs1`.
43+
The Vector-Scalar (VV) variant decrypts elements of `vd` under the
44+
zeroth element of `vs1`.
4545
The result (i.e. the next round state) is written to elements of `vd`.
4646

4747
This instruction treats `EEW=128`, regardless of `vtype.vsew`
@@ -52,7 +52,7 @@ supported for any other instruction.
5252
Operation::
5353
[source,sail]
5454
--
55-
function clause execute (VAESDSM(vs2, vs1, vd, vv)) = {
55+
function clause execute (VAESDSM(vs1, vd, vv)) = {
5656
assert(VLEN>=128);
5757
foreach (i from vlstart to vl) {
5858
let keyelem = if vv then i else 0;

0 commit comments

Comments
 (0)