Status at a glance:

Current Definition-of-Done Status: Stable
Next Definition-of-Done Status:: Freeze
- (allows start of formal public review period)

Scalar Crypto Specification:

Lightweight instruction set extensions for RV32 and RV64 HARTs. Proposed extensions:

Extensions fully defined in the Scalar Crypto Specification: K, Zkn, Zks, Zkr, Zkne, Zknd, Zknh, Zksed, Zksh
Shared with the Bit-Manipulation Specification: Zkg, Zkb

Specification

Draft Scalar Crypto Specification (v0.8.1)
Stable
What's next:
- Needs translation into ASCIIDOC
- Incorporate results of OpCode consistency review, once available
- Need to discuss removing gorci
Roadmap:
- Version v0.9.0 will include any feedback from opcode consistency review, plus any small cleanups and editorial work.
  - No functional changes to instruction or entropy source behaviour are expected.
  - Exact encodings may be changed for the better.
- v0.9.0 will likely be the public review version.

Encoding/OpCode consistency review

Opcodes and encodings proposed
Instruction extensions (instruction groupings) proposed
Submitted to review task group
The Bit-Manipulation shared subsets are being reviewed first as part of Bit-Manipulation specification review
- Proposed as Zkg (clmul) and Zkb (specific crypto-required bit-manipulation commands)
The Proposed Scalar Crypto-unique subsets are next in line for review:
- K (Krypto):
  - Zkn (full NIST Suite): ZKne (NIST encrypt suite), ZKnd (NIST decrypt suite), ZKnh (NIST hash suite), Zkg, Zkb (see above)
  - Zkr (random entropy source)
- Zks (full ShangMi Suite): Zksed (SM4 encrypt/decrypt suite), Zksh (SM3 hash suite), Zkg, Zkb (see above)

OpCode and Consistency Review page
What's next: Respond to OpCode and Consistency Review comments, once available, and achieve consensus on any changes

Architecture Tests

Test plan for the scalar-crypto specific instructions is available.
No actual tests suitable for use currently available. An old experimental set need removing from the riscv-crypto repository, as these no longer work with the latest toolchain or architectural test framework.
What's next:
- Imperas have a complete set of tests, written to the existing test plan, for the scalar crypto instructions and the bitmanip instructions we borrow.
  - These tests will be contributed upstream to the riscv-arch-test repository imminently, with many thanks to Imperas.
  - They form a base we can use to develop prototype implementations / Spike / SAIL / QEMU very easily and quickly.
- IIT Madras are also looking at writing the scalar crypto tests for integration into the official architectural tests repo as well.
  - Meeting on Wednesday 24th Feb'21 to discuss this.
  - Likely path is that they re-implement the tests as part of the blessed coverage and test generation tooling.
  - We then switch over to using the IIT tests when they are finished, since they will be easier to maintain/extend going forward than the Imperas tests.

Compilers / Toolchains

GCC and Assembler

Experimental / development toolchain available in the riscv-crypto repository.
- This cannot be up-streamed, but can be used for development work for now.
Up-streamable support is WiP with PQShield.
- Progress so far:
Intrinsics proposal from Markku

LLVM

Work will be done by PLTC lab under the group contributor model.
Looks like the work is just getting started.
Need to set up a meeting.

Simulators

Though all listed under "simulators", these are actually a collection of formal model / virtual machine / architectural simulators / DV simulators etc.

SAIL

Currently working on getting support merged in upstream in PR#80
- Support for all scalar-crypto dedicated instructions is present.
- Support for the entropy source is still the main point of discussion.
- No support for Bitmanip. The Bitmanip TG is waiting until after the opcode and consistency review to start writing SAIL code.

Spike

Upstream support has been merged in as of PR#635
- Support for all of scalar crypto specific instructions and entropy source.
- The only feature left is to enable the right Bitmanip instructions when K is enabled. Currently, one must include "b" in the spike "–isa=" argument.
- Some pending bug fixes in PR#649

riscvOVPSimPlus

Imperas Commercial Simulator
Freeware version
Support for:
- Crypto-scalar v0.7.2, v0.81 + Bitmanip subsets
- Bitmanip 0.92, 0.93
- Functional coverage collection.

QEMU

No work started yet.
Work will be done by PLTC lab under the group contributor model.

Proof-of-Concept implementations

Hardware

Project Name	Base Architecture	Level of implementation	Notes
scarv-cpu	RV32	Behavioural RTL simulation / Yosys Synthesis / FPGA	Completely Public/Open Source. Useful as a public baseline. Commercial implementations should aim to be better than this!
PQShield security core	RV32	(assumed) Behavioural RTL simulation. Running on FPGA.	Closed / commercial source. Most complete implementation of the entropy source.
Romain Dolbeau / VexRISC-V	RV32	Running on FPGA.	Uses VexRiscv core as a base. Completely independent implementation from scratch, outside the Crypto TG.

We still need RV64 implementations.
Barry Spinney has offered to do advanced node synthesis runs for open source implementations.
- I (Ben) intend to take him up on this when I get time. No idea when that will be.

Software

Project/Maintainer	Description
Romain Dolbeau	Independent implementations of various important ciphers + modes of operation.
rvkrypto-fips / Markku	"FIPS 140-3 and higher-level algorithm Tests for RISC-V Crypto Extension"
riscv-crypto benchmarks	Initial benchmarks used to develop the scalar crypto extension.

ABI Extensions

None required