Status at a glance:

• Current  Definition-of-Done Status:  Stable
• Next  Definition-of-Done Status::  Freeze
  • (allows start of formal public review period)

Scalar Crypto Specification:

Lightweight instruction set extensions for RV32 and RV64 HARTs.  Proposed extensions:

• Extensions fully defined in the Scalar Crypto Specification:  K, Zkn, Zks, Zkr, Zkne, Zknd, Zknh, Zksed, Zksh
• Shared with the Bit-Manipulation Specification: Zkg, Zkb

Specification

• Draft Scalar Crypto Specification (v0.8.1)
• Stable
• What's next:
  • Needs translation into ASCIIDOC
  • Incorporate results of OpCode consistency review, once available
• Roadmap:
  • Version v0.9.0 will include any feedback from opcode consistency review, plus any small cleanups and editorial work.
    • No functional changes to instruction or entropy source behaviour are expected.
      • Single minor functional change: removing gorci.
    • Exact encodings may be changed for the better.
  • v0.9.0 will likely be the public review version.

Encoding/OpCode consistency review

• Opcodes and encodings proposed
• Instruction extensions (instruction groupings) proposed
• Submitted to review task group
• The Bit-Manipulation shared subsets are being reviewed first as part of Bit-Manipulation specification review
  • Proposed as Zkg (clmul) and Zkb (specific crypto-required bit-manipulation commands)
• The Proposed Scalar Crypto-unique subsets are next in line for review:
  
  • K (Krypto): 
    • Zkn (full NIST Suite):  ZKne (NIST encrypt suite), ZKnd (NIST decrypt suite), ZKnh (NIST hash suite), Zkg, Zkb (see above)
    • Zkr (random entropy source)
  • Zks (full ShangMi Suite):  Zksed (SM4 encrypt/decrypt suite), Zksh (SM3 hash suite), Zkg, Zkb (see above)

• OpCode and Consistency Review page
• What's next:  Respond to OpCode and Consistency Review comments, once available, and achieve consensus on any changes
  • Some discussion already in Github issue #75 around suggestions for improving the encodings.

Architecture Tests

• Test plan for the scalar-crypto specific instructions is available.
• No actual tests suitable for use currently available. An old experimental set need removing from the riscv-crypto repository, as these no longer work with the latest toolchain or architectural test framework.
• What's next:
  
  • Imperas have a complete set of tests, written to the existing test plan, for the scalar crypto instructions and the bitmanip instructions we borrow.
    • These tests will be contributed upstream to the riscv-arch-test repository imminently, with many thanks to Imperas.
    • They form a base we can use to develop prototype implementations / Spike / SAIL / QEMU very easily and quickly.
  • IIT Madras are also looking at writing the scalar crypto tests for integration into the official architectural tests repo as well.
    • Meeting on Wednesday 24th Feb'21 to discuss this.
    • Likely path is that they re-implement the tests as part of the blessed coverage and test generation tooling.
    • We then switch over to using the IIT tests when they are finished, since they will be easier to maintain/extend going forward than the Imperas tests.

Compilers / Toolchains

GCC and Assembler

• Experimental / development toolchain available in the riscv-crypto repository.
  
  • This cannot be up-streamed, but can be used for development work for now.
• Up-streamable support is WiP with PQShield.
  • Progress so far:
• Intrinsics proposal from Markku

LLVM

• Work will be done by PLTC lab under the group contributor model.
• Looks like the work is just getting started.
• Need to set up a meeting.

Simulators

Though all listed under "simulators", these are actually a collection of formal model / virtual machine / architectural simulators / DV simulators etc.

SAIL

• Currently working on getting support merged in upstream in PR#80
  • Support for all scalar-crypto dedicated instructions is present.
  • Support for the entropy source is still the main point of discussion.
  • No support for Bitmanip. The Bitmanip TG is waiting until after the opcode and consistency review to start writing SAIL code.

Spike

• Upstream support has been merged in as of PR#635
  • Support for all of scalar crypto specific instructions and entropy source.
  • The only feature left is to enable the right Bitmanip instructions when K is enabled. Currently, one must include "b" in the spike "–isa=" argument.
  • Some pending bug fixes in PR#649

riscvOVPSimPlus

• Imperas Commercial Simulator
• Freeware version
• Support for:
  • Crypto-scalar v0.7.2, v0.81 + Bitmanip subsets
  • Bitmanip 0.92, 0.93
  • Functional coverage collection.

QEMU

• No work started yet.
• Work will be done by PLTC lab under the group contributor model.

Proof-of-Concept implementations

Hardware

• We still need RV64 implementations. 
• Barry Spinney has offered to do advanced node synthesis runs for open source implementations.
  • I (Ben) intend to take him up on this when I get time. No idea when that will be.

Software

ABI Extensions

• None required