| Operation | In | |
|---|---|---|
| vrol.[vv,vx] | Per-element rotate left by vs1/x[rs1] mod SEW — ARX cipher and hash-schedule backbone. | Zvbb / Zvkb |
| vror.[vv,vx,vi] | Per-element rotate right, with an immediate form. Constant-time under Zvkt. | Zvbb / Zvkb |
| vsha2ch.vv / vsha2cl.vv | SHA-2 compression: the high / low halves of the working-variable update, advancing two rounds per pair over the state and message-schedule element groups. | Zvknha / Zvknhb |
Hardware Designer Notes
Vector SHA-2 parallelizes across INDEPENDENT messages (a single hash is inherently serial in its compression chain). The win is batched HMAC, tree hashing, or many-connection TLS — where dozens of digests progress in lockstep. The datapath is the scalar round function replicated per lane.
Minimal Linux-boot hart MUST
- vsha2ch/cl: the full SHA-2 round datapath (Σ/σ rotations, Ch/Maj functions, additions) over the state element group, data-independent latency
- Support both 128-bit (SHA-256) and 256-bit (SHA-512, Zvknhb) element-group widths
- Vector rotates as per-lane barrel rotators; Zvkt makes them constant-time
MAY simplify / trap-and-emulate
- Share the SHA round logic with your scalar Zknh if present, widened to lanes
- Batch independent message streams across lanes — vector SHA shines on many-message workloads, not a single serial hash
Check yourself — rotates & SHA-2 compression
1.vsha2ch.vv and vsha2cl.vv split the SHA-2 compression. Why two instructions (high/low)?
2.vrol.vv and vror.vi in the vector crypto context — what makes them crypto-relevant?
2 questions