The AES acceleration set, in two flavors dictated by register width. Every one carries the mandatory clause: execution latency must not depend on the data — constant-time by definition, not just by Zkt contract.
| Operation | In | |
|---|---|---|
| aes32esi / aes32esmi (RV32) | Byte-at-a-time forward round: bs selects a byte of rs2, apply forward SBox (esi) — plus partial MixColumn (esmi) — rotate by bs·8, XOR into rs1. Four instructions build one output column. | Zkne |
| aes32dsi / aes32dsmi (RV32) | The inverse: inverse SBox (and inverse partial MixColumn for dsmi), same bs/rotate/XOR structure. | Zknd |
| aes64es / aes64esm (RV64) | Two columns per instruction: ShiftRows across the rs1/rs2 pair, forward SBox, (MixColumns for esm), producing a 64-bit half-state. | Zkne |
| aes64ds / aes64dsm (RV64) | Inverse two-column round, final / middle. | Zknd |
| aes64im (RV64) | Apply InvMixColumns to round keys — adapts the key schedule for the equivalent inverse cipher so decryption reuses the efficient round structure. | Zknd |
| aes64ks1i / aes64ks2 (RV64) | Key expansion: ks1i does SubWord/RotWord/Rcon (round-number immediate), ks2 combines to produce the next round-key words. | Zkne + Zknd |
Hardware Designer Notes
The AES SBox is the area centerpiece of scalar crypto — a GF(2⁸)-inverse-plus-affine circuit, ~200-400 gates done compactly. Everything else (ShiftRows, the XOR accumulation, key Rcon) is wiring and a small ROM. Get the constant-time property into your timing signoff, not just functional test.
Minimal Linux-boot hart MUST
- Build the forward and inverse SBox as shared combinational logic (the compact-AES-SBox literature is the reference); latency MUST be data-independent
- Implement the bs-driven byte extract + post-SBox rotate for RV32, and the ShiftRows-across-register-pair path for RV64
- Include aes64im and the ks pair in any Zknd implementation — decryption key expansion depends on them
MAY simplify / trap-and-emulate
- Share one SBox array across encrypt/decrypt with a direction mux (inverse SBox = affine⁻¹ ∘ GF-inverse ∘ … — the structure overlaps heavily)
- Pipeline the round instruction if your frequency target demands it, holding latency constant
Check yourself — AES instructions
1.How does the RV32 aes32esmi instruction fit AES into a 2-read-1-write register file?
2.What does aes64im (AES Decrypt KeySchedule MixColumns) exist for?
3.Every AES instruction's description repeats one mandatory implementation requirement. What?
4.What does the bs (byte select) immediate encode, and where does the result land?