Versions Compared

Old Version 8

changes.mady.by.user Richard Newell

Saved on

compared with

New Version Current

changes.mady.by.user Mingjie Xing

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Status at a glance:

...

  • Current 

...

...

  • Status:: 

...

Scalar Crypto Specification:

Lightweight instruction set extensions for RV32 and RV64 HARTs.  Proposed extensions:

  • Extensions fully defined in the Scalar Crypto Specification:  KZk, Zkn, Zks, Zkr, Zkne, Zknd, Zknh, ZkseZksed, ZksdZksh, ZkshZkt
  • Shared with the Bit-Manipulation Specification: Zkg, Zkb

Status by Topic:

Specification

  • Stable
  • What's next:
    • Needs translation into ASCIIDOC
    • Incorporate results of OpCode consistency review, once available

Every topic section:

Status (what's done, and not done), and What's next

links to GitHub, etc., as relevant to each of the topics here

links to PLTC and IIT Madras status pages, TBD

OpCode Encoding/OpCode consistency review

  • Opcodes and encodings proposed
  • Instruction extensions (instruction groupings) proposed
  • Submitted to review task group
  • The Bit-Manipulation shared subsets are being reviewed first as part of Bit-Manipulation specification review
    • Proposed as Zkg (clmul) and Zkb (specific crypto-required bit-manipulation commands)
  • Proposed Scalar Crypto-unique subsets next in line for review:
    • K (Krypto): 
      • Zkn (full NIST Suite):  ZKne (NIST encrypt suite), ZKnd (NIST decrypt suite), ZKnh (NIST hash suite)
      • Zkr (random entropy source)
    • Zks (full ShangMi Suite):  Zkse (SM encrypt suite), Zksd (SM decrypt suite), Zksh (SM hash suite)

Architecture Tests

  • (Status)
  • What's next:  

ABI Extensions

  • None required

GCC and Assembler

  • (Intrinsics)

LLVM

SAIL

Spike

QMU

Proof-of-Concept

Image Added

Pub

Architecture & Opcode consistency review

  • The results of the review can be seen here. Scalar Crypto Arch Review Results.pdf
  • After discussion within the task group, the following changes will be made to the spec, with the changes expected to land in 0.9.4 before the end of August.
    • Stop overlapping the aes32 and aes64 opcodes. See riscv/riscv-opcodes#77
    • Clarify the effect of misa.k
    • Some updates to the entropy source and zkt detailed here.
    • Miscellaneous editorial issues.
  • Some downstream tasks for our group development partners now we are in public review.
WhoWhatStatusTask
PLCTGCCNot startedUpdate extension names: Zkb → Zbkb etc.
PLCTGCCNot startedUpdate aes32/64* encodings if applicable.
PLCTLLVMDoneUpdate extension names: Zkb → Zbkb etc.
PLCTLLVMDoneUpdate aes32/64* encodings if applicable.
IITriscv-configNot startedUpdate extension names: Zkb → Zbkb etc.
IITriscv-configNot startedUpdate instruction inclusion in different extensions
IITriscv-arch-testsNot startedBreak up K suite into Zk* extensions
IITriscv-arch-testsNot startedUpdate instruction inclusion in different extensions

Architecture Tests

  • Test plan for the scalar-crypto specific instructions is available.
  • Imperas have a complete set of tests, written to the existing test plan, for the scalar crypto instructions and the bitmanip instructions we borrow.
    • These have been merged into the main test suite as of PR#177, with many thanks to Imperas for the contribution.
      • Spike, OVPSim and Sail all agree on the test signatures.
    • They form a base we can use to develop prototype implementations / Spike / SAIL / QEMU very easily and quickly.
  • Upstream Spike support for enabling it to work with the K test suite is being added in PR#687.
  • IIT Madras are also looking at writing the scalar crypto tests for integration into the official architectural tests repo as well.
    • Agreed SoW for IITM
    • They are re-implementing the tests as part of the blessed coverage and test generation tooling.
      • Making good progress with the simple test patterns for scalar-crypto specific instructions A/O April 7'th '21
    • We then switch over to using the IIT tests when they are finished, since they will be easier to maintain/extend going forward than the Imperas tests.
  • YAML config changes for K have been merged in. See here.
  • Update from IIT Madras as on 25-Oct
  • Status from IIT Madras as on 17-Jun:
    • All test cases and coverage reports has been generated and presented.
    • If there are any changes in future on these that is required in future, IIT Madras will enhance the scripts as per requirements.
  • Status from IIT Madras as on 20-May:
    • Real world test cases as per the test plan has been generated.
    • Currently waiting for the fixed toolchain with K extension from PLCT to test the generated test cases. All the test cases are working fine when we run against the patched toolchain
    • A PR has been raised with a pull request for this suite to be reviewed and merged in the riscv-arch tests github repo.
  • Status from IIT Madras as on 12-May:
    • Coverage report for all developed cases in CTG/ISAC has been generated and it is reported as 100%
    • Currently real world test cases are being developed as per test plan and will be completed and send for review by beginning of next week
  • Status from IIT Madras as on 05-May:
    • Resolved issues in running the rv64ik toolchain after interacting with PLCT and compile the relevant tests generated from CTG and run them on spike
    • Currently resolving issues in the running the rv64ibk toolchain. Once this is done, will generate the coverage report of the test cases built till now and share with team.
  • Status from IIT Madras as on 26-Apr:
    • Completed the coverage points specification for all 32-bit and 64-bit instructions
    • Generated test cases from the coverage points
    • Currently working on trying to install the scalar crypto enabled toolchain.

Compilers / Toolchains

Imperas maintain pre-built toolchains for various in-progress RISC-V extensions here. See the "rvk-*" branches for scalar crypto.

GCC and Binutils

LLVM

  • Work will be done by PLCT lab under the group contributor model.
  • Slides from PLCT Update Weds 10'th Feb
  • As of 21'st April '21, LLVM work is mostly complete, waiting on PLCT lab for an update about merging things upstream.
    • Some small changes will be needed as we move to v1.0 of scalar crypto around encodings.
  • As of 24'st Jan '22, LLVM upstream is able to compile the assembly code of Zk* and Zbk*

Simulators

Though all listed under "simulators", these are actually a collection of formal model / virtual machine / architectural simulators / DV simulators etc.

SAIL

  • Currently working on getting support merged in upstream in PR#99
    • Support for all scalar-crypto dedicated instructions and the entropy source is present.
    • No support for Bitmanip yet.

Spike

  • Upstream support has been merged in.
  • Instructions are up to date with v1.0.0

riscvOVPSimPlus

  • Imperas Commercial Simulator
  • Freeware version
  • Supports:
    • Crypto-scalar v0.7.2, v0.8.1, 0.9.0,  0.9.2, 1.0.0-rc1, + Bitmanip subsets
    • Bitmanip 0.90, 0.91, 0.92, 0.93-draft, 0.93, 0.94, 1.0.0
    • Functional coverage collection.

QEMU

Proof-of-Concept implementations

Hardware

Project NameBase ArchitectureLevel of implementationNotes
Stand-alone functional unitsRV32/64Yosys SynthesisStand-alone functional-unit style implementations of the dedicated scalar crypto instructions. Free to use as "drop-ins" for prototyping.
scarv-cpuRV32Behavioural RTL simulation / Yosys Synthesis / FPGA

Completely Public/Open Source. Useful as a public baseline. Commercial implementations should aim to be better than this!

PQShield security coreRV32(assumed) Behavioural RTL simulation. Running on FPGA.Closed / commercial source - PQShield.
Minidice TRNGN/AFPGA ImplementationClosed / commercial source - PQShield. Complete implementation of the RISC-V entropy source.
Romain Dolbeau / VexRISC-VRV32Running on FPGA.Uses VexRiscv core as a base. Completely independent implementation from scratch, outside the Crypto TG.
IQonIC Works RV32IC_P5RV32In development"implemented Zkn (...), along with selectable Zb* and Zkb. We also have an optional custom extension that does AES block encrypt/decrypt, and a bus-based AES/cipher-mode accelerator. Work in progress benchmarking them on FPGA to compare relative performance in accelerating crypto library functions."
croyde-riscvRV64Behavioural RTL simulation / Yosys Synthesis / FPGA3-stage RV64 micro-controller. rv64imck. Free/Open source. Something commercial implementations should better. Implements everything except ZKR.
  • (warning) We still need RV64 implementations. (warning)
  • Barry Spinney has offered to do advanced node synthesis runs for open source implementations.
    • I (Ben) intend to take him up on this when I get time. No idea when that will be.

Software

Project/MaintainerDescription
Romain DolbeauIndependent implementations of various important ciphers + modes of operation.
rvkrypto-fips / Markku"FIPS 140-3 and higher-level algorithm Tests for RISC-V Crypto Extension"
riscv-crypto benchmarksInitial benchmarks used to develop the scalar crypto extension.

ABI Extensions

  • None required
  • RV32
    • (project name/link)
    • (extensions verified)
    • level of verification achieved (behavioral RTL/simulation, synthesized RTL/area-&-timing, actual silicon, etc.)
  • RV64