...

• Extensions fully defined in the Scalar Crypto Specification:  K, Zkn, Zks, Zkr, Zkne, Zknd, Zknh, ZkseZksed, Zksd, Zksh
• Shared with the Bit-Manipulation Specification: Zkg, Zkb

...

• Opcodes and encodings proposed
• Instruction extensions (instruction groupings) proposed
• Submitted to review task group
• The Bit-Manipulation shared subsets are being reviewed first as part of Bit-Manipulation specification review
  • Proposed as Zkg (clmul) and Zkb (specific crypto-required bit-manipulation commands)
• The Proposed Scalar Crypto-unique subsets are next in line for review:
  
  • K (Krypto): 
    • Zkn (full NIST Suite):  ZKne (NIST encrypt suite), ZKnd (NIST decrypt suite), ZKnh (NIST hash suite), Zkg, Zkb (see above)
    • Zkr (random entropy source)
  • Zks (full ShangMi Suite):  Zkse Zksed (SM encrypt suite), Zksd (SM SM4 encrypt/decrypt suite), Zksh (SM SM3 hash suite), Zkg, Zkb (see above)

...

• Test plan for the scalar-crypto specific instructions is available.
• No actual tests suitable for use currently available. An old experimental set need removing from the riscv-crypto repository, as these no longer work with the latest toolchain or architectural test framework.
• What's next:  Currently exploring two paths:
  • Imperas have a complete set of tests, written to the existing test plan, for the scalar crypto instructions and the bitmanip instructions we borrow.
    • Some work required to re-generate them in a form suitable for merging into the main architectural test suite.
    • No exact estimate for how much work this is in days/weeks.
  • IIT Madras are looking at writing the scalar crypto tests for integration into the official architectural tests repo as well.
    • No estimate for how long that would take yet.
  • Possible path forward:
    • Ask Imperas to contribute their complete scalar-crypto + bitmanip subset tests.
    • IIT Madras can then write the coverage plan for the architectural test framework.
    • Any future changes to the contributed tests would need to be carefully managed, as they were not generated with the RISC-V test generator tool.

Compilers / Toolchains

GCC and Assembler

• Experimental / development toolchain available in the riscv-crypto repository.
  
  • This cannot be up-streamed, but can be used for development work for now.
• Up-streamable support is WiP with PQShield.
  • Progress so far:
• Intrinsics proposal from Markku

LLVM

• No work started yet.
• Work will be done by PLTC lab under the group contributor model.

Simulators

Though all listed under "simulators", these are actually a collection of formal model / virtual machine / architectural simulators / DV simulators etc.

SAIL

• Currently working on getting support merged in upstream in PR#80
  • Support for all scalar-crypto dedicated instructions is present.
  • Support for the entropy source is still the main point of discussion.
  • No support for Bitmanip. The Bitmanip TG is waiting until after the opcode and consistency review to start writing SAIL code.

Spike

• Upstream support has been merged in as of PR#635
  • Support for all of scalar crypto specific instructions and entropy source.
  • The only feature left is to enable the right Bitmanip instructions when K is enabled. Currently, one must include "b" in the spike "–isa=" argument.
  • Some pending bug fixes in PR#649

LLVM

...

riscvOVPSimPlus

• Imperas Commercial Simulator
• Freeware version
• Support for:
  • Crypto-scalar v0.7.2, v0.81 + Bitmanip subsets
  • Bitmanip 0.92, 0.93
  • Functional coverage collection

...

• • .

QEMU

• No work started yet.
• Work will be done by PLTC lab under the group contributor model.

...

• We still need a RV64 implementation.
  • I (Ben) am working on adding support to a toy core of mine, but I don't have much time to dedicate to this.
• Barry Spinney has offered to do advanced node synthesis runs for open source implementations.
  • I (Ben) intend to take him up on this when I get time. No idea when that will be.

Software

ABI Extensions

• None required

...