论文标题
AES和SM4轻巧的ISA扩展
A Lightweight ISA Extension for AES and SM4
论文作者
论文摘要
我们描述了AES和SM4块密码的轻质RISC-V ISA扩展。需要16个说明（和一个子键负载）才能实现使用扩展名的AES回合，而不是80条没有。 SM4步骤（四分之一轮）具有6.5个算术说明，相似的降低。也许更重要的是，ISA扩展有助于消除缓慢的，秘密的桌子查找，并防止缓存定时侧通道攻击。该扩展名只有一个S-box，具有最小的硬件尺寸，并且非常适合超低功率应用。使用ISA扩展程序的AES和SM4实现也具有大量降低的软件足迹。 AES和SM4实例可以共享相同的数据路径，但在芯片设计师可以在没有AE的情况下实现SM4的意义上是独立的，反之亦然。完整的AES和SM4汇编器列表，指令组合逻辑的HDL源代码以及仿真的C代码根据宽松的开源开源许可提供给社区。该实现包含基于Boyar-Peralta构造的深度和大小优化的关节AES和SM4 S-Box逻辑，并具有共享的非线性中间层，展示了逻辑优化的其他途径。该指令逻辑已被实验集成到“ Pluto” RV32核心的单周执行路径中，并已在FPGA系统上进行了测试。
We describe a lightweight RISC-V ISA extension for AES and SM4 block ciphers. Sixteen instructions (and a subkey load) is required to implement an AES round with the extension, instead of 80 without. An SM4 step (quarter-round) has 6.5 arithmetic instructions, a similar reduction. Perhaps even more importantly the ISA extension helps to eliminate slow, secret-dependent table lookups and to protect against cache timing side-channel attacks. Having only one S-box, the extension has a minimal hardware size and is well suited for ultra-low power applications. AES and SM4 implementations using the ISA extension also have a much-reduced software footprint. The AES and SM4 instances can share the same data paths but are independent in the sense that a chip designer can implement SM4 without AES and vice versa. Full AES and SM4 assembler listings, HDL source code for instruction's combinatorial logic, and C code for emulation is provided to the community under a permissive open source license. The implementation contains depth- and size-optimized joint AES and SM4 S-Box logic based on the Boyar-Peralta construction with a shared non-linear middle layer, demonstrating additional avenues for logic optimization. The instruction logic has been experimentally integrated into the single-cycle execution path of the "Pluto" RV32 core and has been tested on an FPGA system.
