Does AES64DS use floating-point or vector registers?
No. These scalar crypto extension instructions use integer X registers.
AES64DS
RISC-V AES64DS Instruction Details
Instruction ManualR-typeAES final-round decrypt (RV64): two 64-bit source registers represent the full state and produce half of the next-round output
Instruction Syntax
aes64ds rd, rs1, rs2
Operand Breakdown
Destination rd: register receiving the operation result.
Source rs1: register holding the first operand.
Source rs2: register holding the second operand.
ZkndCrypto & Security
Instruction Behavior
aes64ds is an RV64 AES decrypt final-round instruction in Zknd. It uses rs1 and rs2 as two 64-bit source registers representing the full 128-bit AES state, applies Inverse ShiftRows and inverse SubBytes, and writes half of the next-round output to rd. The full 128-bit output is normally produced by executing the official paired instruction with reversed source-register order; round-key XOR is not implicitly performed by this AES64 round instruction.
AES64DS Decode And Execute Animation
Bounded teaching inputs follow the local official ISA formulas; this does not model a complete AES round, round-key XOR, or microarchitecture.
aes64ds
Execution Context
XLEN is fixed at 64; rs1 and rs2 jointly represent the complete 128-bit state.
fixed funct7
source state
source state
fixed
destination
OP
31..25
0011101
24..20
rs2=x12
19..15
rs1=x11
14..12
000
11..7
rd=x10
6..0
0110011
Execution Data Path
rs1[63:0]
0x0011223344556677
rs2[63:0]
0x8899AABBCCDDEEFF
aes_rv64_shiftrows_inv
0xCC99663300DDAA77
inverse SubBytes
0x27F9D36652C96202
Current Step
Decode AES64 fixed OP fields
funct7=0011101, funct3=000, and OP=0110011; this encoding is RV64-only.
encoding: 0x3AC58533
syntax: aes64ds a0(x10), a1(x11), a2(x12)
syntax: aes64ds a0(x10), a1(x11), a2(x12)
Architectural Result
a0(x10) = 0x27F9D36652C96202
This animation shows only official ISA fields and architectural state, not a particular CPU pipeline, cache, or timing implementation.
Quick Understanding & Search Notes
AES64DS is a Zknd scalar cryptography instruction for AES final-round decrypt half-block. This page is checked against the official scalar crypto extension, avoiding confusion among round functions, key schedule steps, and operand sources.
RV64 instruction: rs1/rs2 together represent the full AES state, and the instruction produces half of the next-round output; compute the other half with reversed source-register order.
Scalar crypto instructions use integer X registers, and the official spec requires the relevant crypto instructions to be implemented with data-independent execution latency.
aes64* forms are defined only for RV64.
Common Usage Scenarios
Crypto & Security
Understand this scenario with real code like «aes64ds a0, a1, a2».
Data Protection
Understand this scenario with real code like «aes64ds a0, a1, a2».
Pre-Use Checklist
Syntax Check
- Verify rd, rs1, rs2 (and rs3) are valid GPRs.
- Confirm funct3 and funct7 encoding is correct.
Semantic Check
- Check if the result affects subsequent branches or address calculations.
- Ensure the rd register is not overwritten by another instruction.
Pitfalls / Common Confusions
RV64 only; this AES64 form is not available on RV32.
rs1 and rs2 are the two 64-bit halves of the current AES state; do not describe rs2 as a fixed round-key operand.
Final-round forms do not include MixColumns/InvMixColumns.
One execution produces only half of the 128-bit state output; compute the other half using the official reversed source-register order.
FAQ
Is AES64DS a complete algorithm implementation?
No. It performs one architecturally defined AES half-state step; software still combines instructions and round keys in algorithm order.