A Lightweight ISA Extension for AES and SM4
A Lightweight ISA Extension for AES and SM4
复制标题
AES 和 SM4 的轻量级 ISA 扩展
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Markku
中科院分区：
文献类型：
--
作者：
Markku
我们描述了一个针对AES和SM4分组密码的轻量级RISC-V ISA扩展。需要16条指令(和子密钥加载)来实现带有扩展名的AES轮，而不是没有扩展名的80条指令。SM4步(四分之一轮)有6.5条算术指令，减少的幅度与此类似。也许更重要的是，ISA扩展有助于消除缓慢的、依赖于秘密的表查找，并防止缓存计时旁路攻击。只有一个S盒，扩展具有最小的硬件尺寸，非常适合超低功耗应用。使用ISA扩展的AES和SM4实现也大大减少了软件占用空间。AES和SM4实例可以共享相同的数据路径，但在芯片设计者可以在没有AES的情况下实现SM4的意义上是独立的，反之亦然。完整的AES和SM4汇编器清单、用于指令组合逻辑的HDL源代码以及用于仿真的C代码在许可的开源许可下被提供给社区。该实现包含深度和大小优化的联合AES和SM4 S盒逻辑，该逻辑基于Boyar-Peralta结构和共享的非线性中间层，展示了其他逻辑优化的方法。该指令逻辑已被实验集成到“冥王星”RV32核的单周期执行路径中，并在FPGA系统上进行了测试。
We describe a lightweight RISC-V ISA extension for AES and SM4 block ciphers. Sixteen instructions (and a subkey load) is required to implement an AES round with the extension, instead of 80 without. An SM4 step (quarter-round) has 6.5 arithmetic instructions, a similar reduction. Perhaps even more importantly the ISA extension helps to eliminate slow, secret-dependent table lookups and to protect against cache timing side-channel attacks. Having only one S-box, the extension has a minimal hardware size and is well suited for ultra-low power applications. AES and SM4 implementations using the ISA extension also have a much-reduced software footprint. The AES and SM4 instances can share the same data paths but are independent in the sense that a chip designer can implement SM4 without AES and vice versa. Full AES and SM4 assembler listings, HDL source code for instruction's combinatorial logic, and C code for emulation is provided to the community under a permissive open source license. The implementation contains depth- and size-optimized joint AES and SM4 S-Box logic based on the Boyar-Peralta construction with a shared non-linear middle layer, demonstrating additional avenues for logic optimization. The instruction logic has been experimentally integrated into the single-cycle execution path of the "Pluto" RV32 core and has been tested on an FPGA system.