RISC-V Scalar Cryptography Extension reaches public review
1–10 of 19 posts
Re: RISC-V Scalar Cryptography Extension reaches public review
#2A quick summary of what is included for those who don't feel like reading the spec:
- Some miscellaneous bit twiddling instructions (rotate, permute, pack, ...) useful in various crypto schemes.
- AES.
- SHA2 (-256 and -512).
- SM3 and SM4.
- Physical entropy source (with some variants to accommodate low profile variants)
Re: RISC-V Scalar Cryptography Extension reaches public review
#3This extension is great. If anyone is interested, my roommate and I partially implemented the previous revision of it on a RISC-V GPU called Vortex: https://carrv.github.io/2021/papers/CARRV2021_paper_87_Adams...
I'm excited to see that the RV32 AES instructions now have separate rs1 and rd fields, because the previous version combined them into just rt, which was kind of annoying from an implementation perspective, since you had some register that was both input and output (iirc, unlike any other RV32 instruction previously implemented on that hardware)
Re: RISC-V Scalar Cryptography Extension reaches public review
#4A quick summary of what is included for those who don't feel like reading the spec: - Some miscellaneous bit twiddling instructions (rotate, permute, pack, ...) useful in various crypto schemes. - AES. - SHA2 (-256 and -512). - SM3 and SM4. - Physical entropy source (with some variants to accommodate low profile variants) The SM3/4 were unfamiliar to me - apparently it is a hash function & block cipher used in Chines…
> for those who don't feel like reading the spec:
I'm biased, but the spec is supposed to be very accessible to people without a cryptography background. There's a section on who the intended audience is and what assumptions are made about their background. I'd really recommend it.
> The SM3/4 were unfamiliar to me - apparently it is a hash function & block cipher used in Chinese WiFi variant.
SM3/4 are required for use in certain places in China. RISC-V is popular in China, hence their inclusion in the RISC-V spec. My expectation is that SM3/4 will not likely ever be adopted outside China.
> Physical entropy source (with some variants to accommodate low profile variants)
There are no "variants" of the entropy source. There is one entropy source interface definition which is designed to scale across the many RISC-V implementation profiles. It's very different to x86/RDRAND which lots of people are used to.
Re: RISC-V Scalar Cryptography Extension reaches public review
#5What is the "2-read-1-write register access constraint" mentioned in the introduction?
Re: RISC-V Scalar Cryptography Extension reaches public review
#6What is the "2-read-1-write register access constraint" mentioned in the introduction?
It means that each instruction reads no more than two general purpose registers (i.e. inputs), and writes at most one. When you build CPUs, register files are expensive components, and the more parallel accesses to them you need, the more expensive they become. RISC architectures generally rely on only reading two operands and writing only one result. Sometimes this rule is broken, but RISC-V tries to stick to it unless there's an extremely good reason.
Re: RISC-V Scalar Cryptography Extension reaches public review
#7A quick summary of what is included for those who don't feel like reading the spec: - Some miscellaneous bit twiddling instructions (rotate, permute, pack, ...) useful in various crypto schemes. - AES. - SHA2 (-256 and -512). - SM3 and SM4. - Physical entropy source (with some variants to accommodate low profile variants) The SM3/4 were unfamiliar to me - apparently it is a hash function & block cipher used in Chines…
> for those who don't feel like reading the spec: I'm biased, but the spec is supposed to be very accessible to people without a cryptography background. There's a section on who the intended audience is and what assumptions are made about their background. I'd really recommend it. > The SM3/4 were unfamiliar to me - apparently it is a hash function & block cipher used in Chinese WiFi variant. SM3/4 are required for…
> I'm biased, but the spec is supposed to be very accessible to people without a cryptography background. There's a section on who the intended audience is and what assumptions are made about their background. I'd really recommend it.
Certainly! As you can probably tell from my comment I'm not expert and I found it easy to follow.
I just wanted to post a summary for anyone who is interested but doesn't find time to go into details. I know that I myself often read this site on phone and I appreciate similar comments giving a tl;dr on more complex stories.
> There are no "variants" of the entropy source. There is one entropy source interface definition which is designed to scale across the many RISC-V implementation profiles. It's very different to x86/RDRAND which lots of people are used to.
Maybe I phrased it poorly but section "4.2. Entropy Source Requirements" states: "An implementation of the entropy source should meet at least one of the following requirements sets in order to be considered a secure and safe design". It then gives three options, one of which ("4.2.3 Virtual Sources: Security Requirement") states "A virtual source is not a physical entropy source" and "A virtual source traps access to the seed CSR, emulates it, or otherwise implements it without direct access to a physical entropy source.".
My interpretation is that there is indeed a single interface (CSR) however the hardware implementation could be both real physical entropy source or a CSPRNG. And presumably the latter is more likely on low-end devices.
Please let me know if I'm getting this wrong.
Re: RISC-V Scalar Cryptography Extension reaches public review
#8A quick summary of what is included for those who don't feel like reading the spec: - Some miscellaneous bit twiddling instructions (rotate, permute, pack, ...) useful in various crypto schemes. - AES. - SHA2 (-256 and -512). - SM3 and SM4. - Physical entropy source (with some variants to accommodate low profile variants) The SM3/4 were unfamiliar to me - apparently it is a hash function & block cipher used in Chines…
> for those who don't feel like reading the spec: I'm biased, but the spec is supposed to be very accessible to people without a cryptography background. There's a section on who the intended audience is and what assumptions are made about their background. I'd really recommend it. > The SM3/4 were unfamiliar to me - apparently it is a hash function & block cipher used in Chinese WiFi variant. SM3/4 are required for…
> SM3/4 are required for use in certain places in China. RISC-V is popular in China, hence their inclusion in the RISC-V spec.
That sounds like a pretty poor reason.
China could create the RISC-V SCE-China spec that extends RISC-V SCE with these, and call it a day, instead of requiring the rest of the world to waste transistors for something that's useless.
Re: RISC-V Scalar Cryptography Extension reaches public review
#9Earlier quoted context omitted.
> for those who don't feel like reading the spec: I'm biased, but the spec is supposed to be very accessible to people without a cryptography background. There's a section on who the intended audience is and what assumptions are made about their background. I'd really recommend it. > The SM3/4 were unfamiliar to me - apparently it is a hash function & block cipher used in Chinese WiFi variant. SM3/4 are required for…
> SM3/4 are required for use in certain places in China. RISC-V is popular in China, hence their inclusion in the RISC-V spec. That sounds like a pretty poor reason. China could create the RISC-V SCE-China spec that extends RISC-V SCE with these, and call it a day, instead of requiring the rest of the world to waste transistors for something that's useless.
The algorithm specific instructions are all optional. You can have AES without SM4 or vice versa. RISC-V is great like that, it's designed to be modular.
> instead of requiring the rest of the world to waste transistors for something that's useless.
I'm sure Chinese manufacturers might feel the same about NIST standards.
Re: RISC-V Scalar Cryptography Extension reaches public review
#10This extension is great. If anyone is interested, my roommate and I partially implemented the previous revision of it on a RISC-V GPU called Vortex: https://carrv.github.io/2021/papers/CARRV2021_paper_87_Adams... I'm excited to see that the RV32 AES instructions now have separate rs1 and rd fields, because the previous version combined them into just rt, which was kind of annoying from an implementation perspective,…
It is correct to call Vortex a GPU? I looked at the github but there doesn't seem to be anything there related to graphics.