RISC-V International

Page tree
Skip to end of metadata
Go to start of metadata

Status at a glance:

Scalar Crypto Specification:

Lightweight instruction set extensions for RV32 and RV64 HARTs.  Proposed extensions:

  • Extensions fully defined in the Scalar Crypto Specification:  K, Zkn, Zks, Zkr, Zkne, Zknd, Zknh, Zksed, Zksh
  • Shared with the Bit-Manipulation Specification: Zkg, Zkb


  • Draft Scalar Crypto Specification (v0.8.1)
  • Stable
  • What's next:
    • Needs translation into ASCIIDOC
    • Incorporate results of OpCode consistency review, once available
  • Roadmap:
    • Version v0.9.0 will include any feedback from opcode consistency review, plus any small cleanups and editorial work.
      • No functional changes to instruction or entropy source behaviour are expected.
      • Exact encodings may be changed for the better.
    • v0.9.0 will likely be the public review version.

Encoding/OpCode consistency review

  • Opcodes and encodings proposed
  • Instruction extensions (instruction groupings) proposed
  • Submitted to review task group
  • The Bit-Manipulation shared subsets are being reviewed first as part of Bit-Manipulation specification review
    • Proposed as Zkg (clmul) and Zkb (specific crypto-required bit-manipulation commands)
  • The Proposed Scalar Crypto-unique subsets are next in line for review:
    • K (Krypto): 
      • Zkn (full NIST Suite):  ZKne (NIST encrypt suite), ZKnd (NIST decrypt suite), ZKnh (NIST hash suite), Zkg, Zkb (see above)
      • Zkr (random entropy source)
    • Zks (full ShangMi Suite):  Zksed (SM4 encrypt/decrypt suite), Zksh (SM3 hash suite), Zkg, Zkb (see above)

Architecture Tests

  • Test plan for the scalar-crypto specific instructions is available.
  • No actual tests suitable for use currently available. An old experimental set need removing from the riscv-crypto repository, as these no longer work with the latest toolchain or architectural test framework.
  • What's next:
    • Imperas have a complete set of tests, written to the existing test plan, for the scalar crypto instructions and the bitmanip instructions we borrow.
      • These tests will be contributed upstream to the riscv-arch-test repository imminently, with many thanks to Imperas.
      • They form a base we can use to develop prototype implementations / Spike / SAIL / QEMU very easily and quickly.
    • IIT Madras are also looking at writing the scalar crypto tests for integration into the official architectural tests repo as well.
      • Meeting on Wednesday 24th Feb'21 to discuss this.
      • Likely path is that they re-implement the tests as part of the blessed coverage and test generation tooling.
      • We then switch over to using the IIT tests when they are finished, since they will be easier to maintain/extend going forward than the Imperas tests.

Compilers / Toolchains

GCC and Assembler

  • Experimental / development toolchain available in the riscv-crypto repository.
    • This cannot be up-streamed, but can be used for development work for now.
  • Up-streamable support is WiP with PQShield.
    • Progress so far: (question)
  • Intrinsics proposal from Markku


  • Work will be done by PLTC lab under the group contributor model.
  • Looks like the work is just getting started.
  • Need to set up a meeting.


Though all listed under "simulators", these are actually a collection of formal model / virtual machine / architectural simulators / DV simulators etc.


  • Currently working on getting support merged in upstream in PR#80


  • Upstream support has been merged in as of PR#635
    • Support for all of scalar crypto specific instructions and entropy source.
    • The only feature left is to enable the right Bitmanip instructions when K is enabled. Currently, one must include "b" in the spike "–isa=" argument.
    • Some pending bug fixes in PR#649


  • Imperas Commercial Simulator
  • Freeware version
  • Support for:
    • Crypto-scalar v0.7.2, v0.81 + Bitmanip subsets
    • Bitmanip 0.92, 0.93
    • Functional coverage collection.


  • No work started yet.
  • Work will be done by PLTC lab under the group contributor model.

Proof-of-Concept implementations


Project NameBase ArchitectureLevel of implementationNotes
Stand-alone functional unitsRV32/64Yosys SynthesisStand-alone functional-unit style implementations of the dedicated scalar crypto instructions. Free to use as "drop-ins" for prototyping.
scarv-cpuRV32Behavioural RTL simulation / Yosys Synthesis / FPGA

Completely Public/Open Source. Useful as a public baseline. Commercial implementations should aim to be better than this!

PQShield security coreRV32(assumed) Behavioural RTL simulation. Running on FPGA.Closed / commercial source. Most complete implementation of the entropy source.
Romain Dolbeau / VexRISC-VRV32Running on FPGA.Uses VexRiscv core as a base. Completely independent implementation from scratch, outside the Crypto TG.
IQonIC Works RV32IC_P5RV32In development"implemented Zkn (...), along with selectable Zb* and Zkb. We also have an optional custom extension that does AES block encrypt/decrypt, and a bus-based AES/cipher-mode accelerator. Work in progress benchmarking them on FPGA to compare relative performance in accelerating crypto library functions."
croyde-riscvRV64Behavioural RTL simulation / Yosys Synthesis / FPGA3-stage RV64 micro-controller. rv64imck. Free/Open source. Something commercial implementations should better. Implements everything except ZKR.
  • (warning) We still need RV64 implementations. (warning)
  • Barry Spinney has offered to do advanced node synthesis runs for open source implementations.
    • I (Ben) intend to take him up on this when I get time. No idea when that will be.


Romain DolbeauIndependent implementations of various important ciphers + modes of operation.
rvkrypto-fips / Markku"FIPS 140-3 and higher-level algorithm Tests for RISC-V Crypto Extension"
riscv-crypto benchmarksInitial benchmarks used to develop the scalar crypto extension.

ABI Extensions

  • None required

  • No labels