
All instructions in the scalar cryptography extension are grouped into
{\em functional sets} and {\em feature sets}.
Functional sets are very fine grained, and are constructed around
specific algorithms, standards requirements, or small logical groupings
of instructions.
Feature sets are more coarse grained, and are what cores are expected
to implement.
The letters used to construct Functional Set names are explained in
Table \ref{tab:scalar:functional-sets}.
%Bit-manipulation instructions
%which are included in the scalar-cryptography extension are listed in
%Table \ref{tab:scalar:feature-sets:bitmanip}.

The Feature Sets for instructions exclusive to the scalar cryptography
extension are listed in
Table \ref{tab:scalar:feature-sets:crypto}.
All Bit-manipulation instructions used by the scalar cryptography extension
(see Section \ref{sec:scalar:bitmanip})
are always included in the feature sets listed in
Table \ref{tab:scalar:feature-sets:crypto}.
Exceptions are RV64 only instructions, which are not included in RV32
based implementations.

\begin{table}[h]
\centering
\begin{tabular}{l|l}
Functional Set    & Description \\
\hline
       {\tt Zkg  }& Constant time carry-less multiply for Galois/Counter Mode.          \\
       {\tt Zkb  }& Bitmanip subset included in the scalar cryptography extension, minus those in {\tt Zkg}. \\
       {\tt Zkr  }& Entropy source for seeding random number generators.                \\
       {\tt Zkne }& NIST AES Encryption Instructions.                                   \\
       {\tt Zknd }& NIST AES Decryption Instructions.                                   \\
       {\tt Zknh }& NIST SHA2 Hash function instructions.                               \\
       {\tt Zksed}& SM4 Instructions.                                        \\
       {\tt Zksh }& SM3 Hash function instructions.                                     \\
\hline
\end{tabular}
\caption{
    Explanation of the functional sets.
}
\label{tab:scalar:functional-sets}
\end{table}

\begin{table}[h]
\centering
\begin{tabular}{l|l}
Feature Set    & Description \\
\hline
       {\tt  K   }& The default scalar cryptography extension, short for {\tt Zkn\_Zkr}   \\
       {\tt Zkn  }& NIST algorithm suite. Short for {\tt Zkne\_Zknd\_Zknh\_Zkg\_Zkb}.           \\
       {\tt Zks  }& ShangMi (SM) algorithm suite. Short for {\tt Zksed\_Zksh\_Zkg\_Zkb}.   \\
\hline
\end{tabular}
\caption{
    Explanation of the feature strings used to refer to the functional sets.
}
\label{tab:scalar:feature-sets}
\end{table}

Encryption and decryption instructions are separated into different functional
groups because some popular use cases (e.g., Galois/Counter Mode in TLS 1.3, among others)
do not require decryption functionality.
The NIST and ShangMi algorithms suites are separated because their usefulness is
heavily dependent on the countries a device is expected to operate in.
NIST ciphers are a part of most standardised internet protocols, while ShangMi ciphers are
required for use in China.

Presence of the cryptography extension in any form is indicated
by bit $10$ of the {\tt MISA} CSR.
i.e. bit ``K'', because ``C'' is taken and ``K'' is for Kappa, the
first letter of the ancient Greek word kruptós,
meaning ``{\em hidden}''.
Detection of fine-grained functionality uses the mechanisms defined
by the {\tt tech-config} RISC-V Task Group.
At the time of writing, these mechanisms are still being defined.

Some example GCC {\tt -march=} strings:
\begin{itemize}
\item {\tt rv32ik} -
    Implement the 32-bit NIST feature set ({\tt Zkn},
    the entropy source feature set ({\tt Zkr}) and
    all of the 32-bit Bit-manipulation instructions used by the
    scalar cryptography extension listed in Section \ref{sec:scalar:bitmanip}.
\item {\tt rv64ik} -
    As above, but implementing the 64-bit version of the NIST feature set,
    and additional 64-bit instructions from the Bit-manipulation subset.
\item {\tt rv64i\_Zks\_Zkr} -
    Implement the Entropy Source instructions,
    the 64-bit Bit-manipulation instructions,
    and the XLEN independent ShangMi suite instructions.
\item {\tt rv64i\_Zkne\_Zknh} -
    Implement only the 64-bit NIST AES Encryption and hash function instructions.
\end{itemize}

%\begin{table}[h]
%\centering
%\begin{tabular}{lcccccc}
%\hline
%\multirow{2}{*}{Instructions} & 
%\multirow{2}{*}{Functional Set} &
%\multicolumn{3}{c}{Feature Sets}    \\
%                              &            & Zkn (RV32) & Zkn (RV64) & Zks    \\ \hline
%{\tt clmul                   }& {\tt Zkg } & \cmark     & \cmark     & \cmark \\
%{\tt clmulh                  }& {\tt Zkg } & \cmark     & \cmark     & \cmark \\
%{\tt xperm.n                 }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt xperm.b                 }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt ror                     }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt rol                     }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt rori                    }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt roriw                   }& {\tt Zkb } &            & \cmark     & \cmark \\
%{\tt andn                    }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt orn                     }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt xnor                    }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt pack                    }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt packu                   }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt packh                   }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt packw                   }& {\tt Zkb } &            & \cmark     & \cmark \\
%{\tt packuw                  }& {\tt Zkb } &            & \cmark     & \cmark \\
%{\tt grevi                   }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt shfli                   }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%{\tt unshfli                 }& {\tt Zkb } & \cmark     & \cmark     & \cmark \\
%\hline
%\end{tabular}
%\caption{Feature sets for instructions from the Bit-manipulation extension which
%are re-used by the scalar cryptography extension.}
%\label{tab:scalar:feature-sets:bitmanip}
%\end{table}

\begin{table}[]
\centering
\begin{tabular}{llcccccc}
\hline
\multirow{2}{*}{Instructions} & 
\multirow{2}{*}{Functional Set} &
\multicolumn{4}{c}{Feature Sets}    \\
                              &             & Zkn (RV32) & Zkn (RV64) & Zks (RV32) & Zks (RV64) & Zkr     \\ \hline
{\tt aes32dsi                }& {\tt Zknd } & \cmark     &            &         &        &         \\
{\tt aes32dsmi               }& {\tt Zknd } & \cmark     &            &         &        &         \\
{\tt aes32esi                }& {\tt Zkne } & \cmark     &            &         &        &         \\
{\tt aes32esmi               }& {\tt Zkne } & \cmark     &            &         &        &         \\
{\tt aes64ds                 }& {\tt Zknd } &            & \cmark     &         &        &         \\
{\tt aes64dsm                }& {\tt Zknd } &            & \cmark     &         &        &         \\
{\tt aes64es                 }& {\tt Zkne } &            & \cmark     &         &        &         \\
{\tt aes64esm                }& {\tt Zkne } &            & \cmark     &         &        &         \\
{\tt aes64im                 }& {\tt Zknd } &            & \cmark     &         &        &         \\
{\tt aes64ks1i               }& {\tt Zkne } &            & \cmark     &         &        &         \\
{\tt aes64ks2                }& {\tt Zkne } &            & \cmark     &         &        &         \\
{\tt sha256sig0              }& {\tt Zknh } & \cmark     & \cmark     &         &        &         \\
{\tt sha256sig1              }& {\tt Zknh } & \cmark     & \cmark     &         &        &         \\
{\tt sha256sum0              }& {\tt Zknh } & \cmark     & \cmark     &         &        &         \\
{\tt sha256sum1              }& {\tt Zknh } & \cmark     & \cmark     &         &        &         \\
{\tt sha512sig0h             }& {\tt Zknh } & \cmark     &            &         &        &         \\
{\tt sha512sig0l             }& {\tt Zknh } & \cmark     &            &         &        &         \\
{\tt sha512sig1h             }& {\tt Zknh } & \cmark     &            &         &        &         \\
{\tt sha512sig1l             }& {\tt Zknh } & \cmark     &            &         &        &         \\
{\tt sha512sum0r             }& {\tt Zknh } & \cmark     &            &         &        &         \\
{\tt sha512sum1r             }& {\tt Zknh } & \cmark     &            &         &        &         \\
{\tt sha512sig0              }& {\tt Zknh } &            & \cmark     &         &        &         \\
{\tt sha512sig1              }& {\tt Zknh } &            & \cmark     &         &        &         \\
{\tt sha512sum0              }& {\tt Zknh } &            & \cmark     &         &        &         \\
{\tt sha512sum1              }& {\tt Zknh } &            & \cmark     &         &        &         \\
\hline                                                                                   
{\tt sm3p0                   }& {\tt Zksh } &            &            & \cmark  & \cmark &         \\
{\tt sm3p1                   }& {\tt Zksh } &            &            & \cmark  & \cmark &         \\
{\tt sm4ed                   }& {\tt Zksed} &            &            & \cmark  & \cmark &         \\
{\tt sm4ks                   }& {\tt Zksed} &            &            & \cmark  & \cmark &         \\
\hline                                                                                   
{\tt pollentropy             }& {\tt Zkr  } &            &            &         &        & \cmark  \\
{\tt getnoise                }& {\tt Zkr  } &            &            &         &        & \cmark  \\
\hline                                                                                   
{\tt clmul, clmulh           }& {\tt Zkg  } & \cmark     & \cmark     & \cmark  & \cmark &         \\
{\tt xperm.n, xperm.b        }& {\tt Zkb  } & \cmark     & \cmark     & \cmark  & \cmark &         \\
{\tt ror, rol, rori          }& {\tt Zkb  } & \cmark     & \cmark     & \cmark  & \cmark &         \\
{\tt rorw, rolw, roriw       }& {\tt Zkb  } &            & \cmark     &         & \cmark &         \\
{\tt andn, orn, xnor         }& {\tt Zkb  } & \cmark     & \cmark     & \cmark  & \cmark &         \\
{\tt pack, packu, packh      }& {\tt Zkb  } & \cmark     & \cmark     & \cmark  & \cmark &         \\
{\tt packw, packuw           }& {\tt Zkb  } &            & \cmark     &         & \cmark &         \\
{\tt rev.b, rev8 (grevi)     }& {\tt Zkb  } & \cmark     & \cmark     & \cmark  & \cmark &         \\
{\tt rev8.w      (grevi)     }& {\tt Zkb  } &            & \cmark     &         & \cmark &         \\
{\tt zip    (shfli)          }& {\tt Zkb  } & \cmark     &            & \cmark  &        &         \\
{\tt unzip  (unshfli)        }& {\tt Zkb  } & \cmark     &            & \cmark  &        &         \\
\hline
\end{tabular}
\caption{
Feature sets for instructions in the scalar cryptography extension.
}
\label{tab:scalar:feature-sets:crypto}
\end{table}

