Versatile RISC-V ISA Galois Field arithmetic extension for cryptography and error-correction codes

[schirice]

Authors: Yao-Ming Kuo, Francisco Garcia Herrero, Juan Antonio Maestro (Antonio de Nebrija University)

[vogelpi]

Hi Yao-Ming,
thanks for your presentation. In your slides you mention that the encoding of your clmul(h) instructions is the same as for the B extension. So one could argue that your work is basically an extension of the B extension ;-) However, since the B extension doesn't offer the ffwidth/ffred inscructions, I was wondering what is the performance advantage of these two insctructions on top of the B extension?

[kuoyaoming93]

Hi Pirmin :)

Thank you for your comment.
Yes, these instructions could easily be part of the B or K extension since it is a small instruction set. (the extension will also have GF inversion and exponencial).

In terms of performance, the polynomial reduction of GF(2^m) is more complicated than the bit-manip instructions.
For example, using the traditional two-step multiplication, to reduce a GF(2^32) degree polynomial, we need at least 32 right rotations (ror), 32 xors. Using ffred its only one instruction because the degree and the primitive polynomial are loaded only once using ffwidth.
Combinational logic architectures must be found to have a hardware that it's flexible (different primitive polynomials and degree) and quick (low combinational delay) at the same time. WIP

I think these instructions are a complement to GF(q) arithmetic proposed by Alkim [1], which its for some Post-quantum cryptography algorithms (Kyber, NewHope). Both could merge together and be an extension of B or K extension.