RVOPcode
Home/Instructions/SM4 Key Schedule
SM4KS

RISC-V SM4KS Instruction Details

Instruction ManualR-type

SM4 key-schedule byte step: select an rs2[31:0] byte by bs, apply S-Box/key linear layer and rotate, then XOR rs1[31:0]

Instruction Syntax

sm4ks rd, rs1, rs2, bs

rd, rs1 and rs2 select integer x0–x31 or ABI names; bs is a 2-bit byte selector from 0 to 3.

32-bit OP: bits31:30=bs, bits29:25=11010, funct3=000, opcode=0110011.

RV32/RV64 Zksed; select byte bs from rs2[31:0], apply the SM4 S-box and key-schedule linear layer, rotate left by bs*8 and XOR rs1[31:0]; RV64 sign-extends the result.

x0 sources are zero and writes to x0 are discarded; overlapping operands read values before writeback. Execution latency must be data-independent.

ZksedCrypto & Security
Related Search Terms
sm4ks instructionRISC-V sm4kssm4ks bsrs2 byte selectSM4 key scheduleZksed

Instruction Behavior

sm4ks is a Zksed SM4 key-schedule acceleration instruction for RV32 and RV64. It selects one byte from rs2[31:0] using bs, applies the SM4 S-Box and key-schedule linear layer, rotates the result to the byte position selected by bs, XORs it with rs1[31:0], and writes rd; on RV64 the 32-bit result is sign-extended to XLEN. It is used to build the SM4 key schedule, not to run the data encrypt/decrypt round directly.

SM4KS Decode And Execute Animation

This bounded model shows only official ISA-visible fields, state, and conditions; it does not model a complete cryptographic protocol or microarchitecture.

sm4ks

Execution context: RV32/RV64; bounded teaching data fixes both low 32-bit sources to zero.

fixed 11010rs2=a2rs1=a1funct3=000rd=a0opcode=0110011
Execution Data Path

sb_in=0x00 -> sbox=0xD6 -> y=0xC01A6BD6 -> z=0xC01A6BD6

result pending

Quick Understanding & Search Notes

SM4KS selects one rs2 byte, applies the S-box, key-schedule linear layer and left rotation, then XORs rs1[31:0].

Selects an rs2[31:0] byte using bs, applies and rotates the SM4 S-box/key-schedule linear result, then XORs rs1[31:0]; on RV64 the 32-bit result is sign-extended.
Scalar crypto instructions use integer X registers, and the official spec requires the relevant crypto instructions to be implemented with data-independent execution latency.
The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture (20260120), 32.3.44

Common Usage Scenarios

Crypto & Security

RV32/RV64 Zksed, a1=a2=0, bs=0: S-box(0)=0xD6; the page's linear layer gives a0=0xC01A6BD6; RV64 sign-extends it.

Chinese National Crypto

RV32/RV64 Zksed, a1=a2=0, bs=0: S-box(0)=0xD6; the page's linear layer gives a0=0xC01A6BD6; RV64 sign-extends it.

Key Schedule

RV32/RV64 Zksed, a1=a2=0, bs=0: S-box(0)=0xD6; the page's linear layer gives a0=0xC01A6BD6; RV64 sign-extends it.

Pre-Use Checklist

Syntax Check
  • rd, rs1 and rs2 select integer x0–x31 or ABI names; bs is a 2-bit byte selector from 0 to 3.
  • 32-bit OP: bits31:30=bs, bits29:25=11010, funct3=000, opcode=0110011.
Semantic Check
  • RV32/RV64 Zksed; select byte bs from rs2[31:0], apply the SM4 S-box and key-schedule linear layer, rotate left by bs*8 and XOR rs1[31:0]; RV64 sign-extends the result.
  • x0 sources are zero and writes to x0 are discarded; overlapping operands read values before writeback. Execution latency must be data-independent.

Pitfalls / Common Confusions

bs selects one byte from rs2[31:0]; rs1 is the final XOR source.
The key-schedule linear layer differs from the data-round linear layer used by sm4ed.
On RV64, the 32-bit result is sign-extended to XLEN.

FAQ

Does SM4KS use floating-point or vector registers?

No. These scalar crypto extension instructions use integer X registers.

Is SM4KS a complete algorithm implementation?

No. It defines one byte operation of the SM4 key schedule.