Vector cryptographic processing

Abstract

Apparatuses, methods, and computer program products are disclosed. Decoded instructions control the performance of data processing and a plurality of vector registers 204 store data vectors, each data vector comprising a plurality of data elements. A vector cryptographic processing instruction 200 specifies a set of destination vector registers, a set of source vector registers, and a cryptographic key vector register, and controls the data processing circuitry, for each source vector register, to: read an array of data values from the source vector register and a cryptographic key from the cryptographic key vector register; and perform cryptographic operations on the array of data values to generate a transformed array of data values. The cryptographic operations comprise: combining array elements with the cryptographic key 203; element substitution 204; non-first row cyclic shifting 205; and column mixing 206 by combining elements of a column using a linear transformation. For each source vector register, the transformed array of data values is written to a corresponding destination vector register. Source vector registers may be processed in parallel as sets of segments. Source and destination vector registers may be implicitly specified by the vector cryptographic processing instruction. Source and destination registers may be the same set and writing the transformed array destructively overwrites the source vector register. Cryptographic operations may be encryptions, decryptions, and may be in accordance with Advanced Encryption Standard AES.

Description

The present disclosure relates to data processing. In particular, the present disclosure relates to vector cryptographic processing. A data processing apparatus can be configured to perform data processing that operates on data held in various data formats. For example, single data values held in scalar registers (i.e. individual data values) may be the subject of the data processing or sets of data values held in vector registers (i.e. multiple data values) may be the subject of the data processing. The data processing may comprise cryptographic operations. In one example embodiment described herein there is an apparatus comprising: processing circuitry to perform data processing; instruction decoding circuitry to decode instructions to control the processing circuitry to perform the data processing; and a plurality of vector registers to store data vectors, each data vector comprising a plurality of data elements, wherein the instruction decoding circuitry is responsive to a vector cryptographic processing instruction specifying a set of destination vector registers, a set of source vector registers, and a cryptographic key vector register, to control the processing circuitry, for each source vector register, to: read an array of data values from the source vector register and a cryptographic key from the cryptographic key vector register, the data values forming elements of the array; perform cryptographic operations on the array of data values to generate a transformed array of data values, wherein the cryptographic operations comprise: each element of the array being combined with a corresponding portion of the cryptographic key; each element of the array being substituted by another element of the array; each non-first row of the array being shifted cyclically by a predetermined number of element positions; and in each column of the array, the elements of that column being combined using a linear transformation to generate a transformed column; and write the transformed array of data values to a corresponding destination vector register of the set of destination vector registers. In one example embodiment described herein there is a method comprising: operating processing circuitry to perform data processing; decoding instructions to control the processing circuitry to perform the data processing; and storing data vectors in a plurality of vector registers, each data vector comprising a plurality of data elements, wherein the decoding instructions comprises, in response to decoding a vector cryptographic processing instruction specifying a set of destination vector registers, a set of source vector registers, and a cryptographic key vector register, controlling the processing circuitry, for each source vector register, to: read an array of data values forming elements of the array from the source vector register and a cryptographic key from the cryptographic key vector register; perform cryptographic operations on the array of data values to generate a transformed array of data values, wherein the cryptographic operations comprise: each element of the array being combined with a corresponding portion of the cryptographic key; each element of the array being substituted by another element of the array; each non-first row of the array being shifted cyclically by a predetermined number of element positions; and in each column of the array, the elements of that column being combined using a linear transformation to generate a transformed column; and write the transformed array of data values to a corresponding destination vector register of the set of destination vector registers. In one example embodiment described herein there is a computer program for controlling a host data processing apparatus to provide an instruction execution environment, the computer program comprising: processing program logic configured to perform data processing; instruction decoding program logic configured to decode instructions to control the processing program logic to perform the data processing; and a plurality of vector data structures to store data vectors, each data vector comprising a plurality of data elements, wherein the instruction decoding program logic is responsive to a vector cryptographic processing instruction specifying a set of destination vector data structures, a set of source vector data structures, and a cryptographic key vector data structure, to control the processing program logic, for each source vector data structure, to: read an array of data values from the source vector data structure and a cryptographic key from the cryptographic key vector data structure, the data values forming elements of the array; perform cryptographic operations on the array of data values to generate a transformed array of data values, wherein the cryptographic operations comprise: each element of the array being combined with a corresponding portion of the cryptographic key; each element of the array being substituted by another element of the array; each non-first row of the array being shifted cyclically by a predetermined number of element positions; and in each column of the array, the elements of that column being combined using a linear transformation to generate a transformed column; and write the transformed array of data values to a corresponding destination vector register of the set of destination vector registers. The present invention will be described further, by way of example only, with reference to embodiments thereof as illustrated in the accompanying drawings, in which: Figure 1 schematically illustrates an apparatus that embodies the present techniques in accordance with some examples; Figure 2 schematically illustrates the execution of a vector cryptographic processing instruction in accordance with some examples; Figure 3 schematically illustrates the execution of a vector cryptographic processing instruction operating on a vector sub-divided into multiple segments in accordance with some examples; Figure 4 is a flow diagram showing a sequence of steps which are carried out when executing a vector cryptographic processing instruction in accordance with some examples; Figure 5A schematically illustrates the parallel processing of two segments in accordance with some examples; Figure 5B schematically illustrates the parallel processing of multiple arrays of data values in accordance with some examples; Figure 6 schematically illustrates a simulator implementation in accordance with some examples. Before discussing the embodiments with reference to the accompanying figures, the following description of embodiments is provided. In accordance with one example configuration there is provided an apparatus comprising: processing circuitry to perform data processing; instruction decoding circuitry to decode instructions to control the processing circuitry to perform the data processing; and a plurality of vector registers to store data vectors, each data vector comprising a plurality of data elements, wherein the instruction decoding circuitry is responsive to a vector cryptographic processing instruction specifying a set of destination vector registers, a set of source vector registers, and a cryptographic key vector register, to control the processing circuitry, for each source vector register, to: read an array of data values from the source vector register and a cryptographic key from the cryptographic key vector register, the data values forming elements of the array; perform cryptographic operations on the array of data values to generate a transformed array of data values, wherein the cryptographic operations comprise: each element of the array being combined with a corresponding portion of the cryptographic key; each element of the array being substituted by another element of the array; each non-first row of the array being shifted cyclically by a predetermined number of element positions; and in each column of the array, the elements of that column being combined using a linear transformation to generate a transformed column; and write the transformed array of data values to a corresponding destination vector register of the set of destination vector registers. In a data processing apparatus that performs vector cryptographic processing, there may be the need for the processing to perform multiple steps of cryptographic operations in order to implement one iteration (aka “round”) of a given cryptographic algorithm and for multiple such iterations to be sequentially performed in order to implement a given cryptographic specification for encryption or decryption. For example, the Advanced Encryption Standard (AES) specification for encryption / decryption is implemented over 10, 12, or 14 rounds, depending on whether the key size is 128-bit, 192-bit, or 256-bit. All but the last round perform the same operations (i.e. 9, 11, or 13 rounds depending on the key size) on an array of data values being processed, these operations comprising: combining array elements with the cryptographic key; element substitution; row-shifting; and column mixing. On the one hand, a data processing apparatus which is responsive to multiple instructions to initiate these operations has a relatively complex front-end (decode, queue structures, etc.). On the other hand, there is the desire to improve the throughput of data processing apparatuses. Increasing the vector length can have this effect, but requires the entire apparatus to be configured to handle such wider vectors. Parallelisation increases the data bandwidth, however the multiple iterations (rounds) of such cryptographic algorithms typically cannot be parallelized, due to sequential dependencies between them. However, there are no dependencies between the arrays of data values being processed and hence multiple arrays of data values (also commonly referred to as “input blocks”) can be processed in parallel. In this context, the inventors of the present techniques have provided a vector register based approach in which a vector cryptographic processing instruction specifies a set of destination vector registers, a set of source vector registers, and a cryptographic key vector register. These destination vector registers, source vector registers, and the cryptographic key vector register can generally be freely selected from amongst the vector registers available in the apparatus. In response to the instruction, processing circuitry of the apparatus, performs a set of operations on arrays of data values read from the set of source vector registers. The cryptographic operations performed on the respective array of data values taken from each source vector register of the set of source vector registers comprise: combining array elements with a cryptographic key; element substitution; row-shifting; and column mixing. The transformed array of data values so generated from each source vector register of the set of source vector registers is then written to a corresponding destination vector register of the set of destination vector registers. The provision of a single instruction that initiates multiple cryptographic operations improves code density, allows more efficient instruction cache usage, and reduces the complexity of the front-end of the data processing apparatus. It also simplifies the use of optimized compute hardware, able to combine multiple otherwise distinct operations to improve efficiency. Furthermore, the fact that the instruction causes the cryptographic operations to be performed on multiple vector registers further improves code density (by comparison with explicit, separate instructions to cause processing of the multiple vector registers). Moreover, implementations of these techniques can either operate on all targeted vector registers in parallel or crack the instructions into (in the case of a 4-register variant) two or four components in order to better suit the particular constraints prevailing. Note that the vector cryptographic processing instruction disclosed herein may operate on any number of registers. Note that whilst separate instructions to achieve the same effect could in principle be fused in the front-end, in general splitting an instruction is easier than fusing instructions. For example, fusible instructions that are located in different cache lines (due to the alignment of the underlying instruction sequence) may not be fetched together and are therefore less likely to be fused. The present techniques are not restricted to any particular length of vector register (i.e. length of the set of data values held by a vector register). Accordingly, the approaches disclosed herein may be applied to a variety of lengths of vector register. However, within a given length of vector register, in some examples the processing circuitry is controlled to process each source vector register as a set of segments, wherein the instruction decoding circuitry is configured to control the processing circuitry, for each segment of each source vector register, to read the array of data values from that segment of that source vector register. Handling the vector in segments has the consequence that the segments are essentially independent of one another (other than typically being loaded and stored together) and this presents further opportunities to enhance the processing efficiency of the apparatus. In some examples, the processing circuitry is configured to process the set of segments in parallel. Furthermore, handling the vector in segments also limits the vector width across which data involved in the cryptographic operations needs to be routed simplifying wiring requirements. Similarly, in some examples a bit-length of each segment of the set of segments is greater than a bit length of the array of data values, such that a segment comprises multiple arrays, and the processing circuitry is configured to process the multiple arrays in parallel. This further supports efficient performance of the apparatus. In some examples, the cryptographic processing is at least part of processing for a round of an iterative cryptographic algorithm and the cryptographic key is a round key generated for the round of the iterative cryptographic algorithm. In some examples, the vector cryptographic processing instruction specifies a first destination vector register of the set of destination vector registers and further destination vector registers of the set of destination vector registers are implicit. This further supports efficient code density, in that only the first destination vector register needs to be explicitly specified in the vector cryptographic processing instruction. Similarly, in some examples the vector cryptographic processing instruction specifies a first source vector register of the set of source vector registers and further source vector registers of the set of source vector registers are implicit. In some examples, the set of source vector registers and the set of destination vector registers are implicitly specified by the vector cryptographic processing instruction. Thus the vector cryptographic processing instruction might not directly specify any source or destination vector registers at all, but rather it is understood that a predetermined set of vector registers are the set of source vector registers and another predetermined set of vector registers are the set of destination vector registers. In some examples, the set of destination vector registers is a same set of vector registers as the set of source vector registers and writing the transformed array of data values to the destination vector register destructively overwrites the source vector register. This can support an efficient use of the registers of the apparatus when performing an iterative cryptographic algorithm, since then each round of the iterative cryptographic algorithm does not require an available destination vector register into which the result of that round can be written. In some examples, the vector cryptographic processing instruction is an encryption vector processing instruction, the cryptographic key is an encryption key and the cryptographic operations performed on the array of data values are encryption operations. In some examples, the vector cryptographic processing instruction is a decryption vector processing instruction, the cryptographic key is a decryption key and the cryptographic operations performed on the array of data values are decryption operations. In some examples, the cryptographic operations performed on the array of data values are in accordance with Advanced Encryption Standard (AES). In some examples, the apparatus comprises vector register storage arranged in a plurality of banks, wherein a multiplicity of the plurality of banks corresponds to a multiplicity of the set of source vector registers. This can support an efficient reading from the set of source vector registers (and writing to set of destination vector registers). Further, in some examples, for each source vector register, reading the array of data values from each source vector register comprises reading a respective array of data values from each bank of the plurality of banks. Each respective array of data values is then retrieved from an independent bank of the plurality of banks, supporting the parallelization approach. In some examples, the vector cryptographic processing instruction specifies a set of cryptographic key vector registers, wherein the instruction decoding circuitry is configured to control the processing circuitry, for each source vector register, to read the cryptographic key from a corresponding cryptographic key vector register of the set of cryptographic key vector registers. This provides further opportunities to provide specific distinct keys for use in association with the content of each source vector register. In accordance with one example configuration there is provided a method comprising: operating processing circuitry to perform data processing; decoding instructions to control the processing circuitry to perform the data processing; and storing data vectors in a plurality of vector registers, each data vector comprising a plurality of data elements, wherein the decoding instructions comprises, in response to decoding a vector cryptographic processing instruction specifying a set of destination vector registers, a set of source vector registers, and a cryptographic key vector register, controlling the processing circuitry, for each source vector register, to: read an array of data values forming elements of the array from the source vector register and a cryptographic key from the cryptographic key vector register; perform cryptographic operations on the array of data values to generate a transformed array of data values, wherein the cryptographic operations comprise: each element of the array being combined with a corresponding portion of the cryptographic key; each element of the array being substituted by another element of the array; each non-first row of the array being shifted cyclically by a predetermined number of element positions; and in each column of the array, the elements of that column being combined using a linear transformation to generate a transformed column; and write the transformed array of data values to a corresponding destination vector register of the set of destination vector registers. In accordance with one example configuration there is provided a computer program for controlling a host data processing apparatus to provide an instruction execution environment, the computer program comprising: processing program logic configured to perform data processing; instruction decoding program logic configured to decode instructions to control the processing program logic to perform the data processing; and a plurality of vector data structures to store data vectors, each data vector comprising a plurality of data elements, wherein the instruction decoding program logic is responsive to a vector cryptographic processing instruction specifying a set of destination vector data structures, a set of source vector data structures, and a cryptographic key vector data structure, to control the processing program logic, for each source vector data structure, to: read an array of data values from the source vector data structure and a cryptographic key from the cryptographic key vector data structure, the data values forming elements of the array; perform cryptographic operations on the array of data values to generate a transformed array of data values, wherein the cryptographic operations comprise: each element of the array being combined with a corresponding portion of the cryptographic key; each element of the array being substituted by another element of the array; each non-first row of the array being shifted cyclically by a predetermined number of element positions; and in each column of the array, the elements of that column being combined using a linear transformation to generate a transformed column; and write the transformed array of data values to a corresponding destination vector register of the set of destination vector registers. In accordance with one example configuration there is provided a non-transitory computer-readable storage medium storing the above defined computer program. Particular embodiments will now be described with reference to the figures. Figure 1 illustrates an example data processing apparatus. The apparatus 100 has a pipelined structure illustrated at a high-level in Figure 1 by the linked stages of fetch circuitry 101, decode circuitry 102, issue circuitry 103, and processing circuitry 104. Instructions retrieved from the memory system by the actions of fetch circuitry 101 are decoded by decode circuitry 102, generating control signals for the whole pipeline structure and in particular for the processing circuitry 104. The processing circuitry 104 comprises different execution units provided to perform different types of data processing tasks, although the execution units illustrated in the figure are all cryptographic units 105-108. The provision of multiple cryptographic units is not essential but supports the parallel processing of multiple arrays of data values. The apparatus also comprises load / store unit 109, which executes load instructions and store instructions to bring data values from the memory system into registers local to the processing circuitry 104 and to store data values from the registers into the memory system, respectively. A set of vector registers (also referred to as a “vector register file”) 110 are explicitly shown in the figure. The processing circuitry 104 also has access to a set of scalar registers that are not shown in the figure. The memory system is represented in the figure by instruction cache (1$) 111, level 1 cache (Ll$) 112, level 2 cache (L2$) 113, and main memory 114. In a manner with which one of ordinary skill in the art will be familiar, data values retrieved from the memory 114 are loaded into registers (e.g. vector registers 110) for the processing circuitry 109 to perform data processing operations thereon and modified data values are stored into the memory 114. Temporary copies of repeatedly used data values may be held in the caches 111, 112, and 113 to mitigate against the latency associated with retrieving a data value from memory 114. One particular type of instruction handled by the apparatus 100 is a vector cryptographic processing instruction, which is executed by one of the cryptographic units 105-108, accessing vectors of data values held in the vector registers 110. More detail of these instructions, as the subject of the present disclosure, is given with reference to the figures that follow. Figure 2 schematically illustrates the execution of a vector cryptographic processing instruction in accordance with some examples. The vector cryptographic processing instruction 200 in this case is either an encrypt or decrypt instruction and further is provided for the implementation of encryption / decryption in accordance with the Advanced Encryption Standard (AES). Generally (i.e. regardless of whether this is an encryption or decryption instruction and whether the cryptographic algorithm implemented is AES) the vector cryptographic processing instruction 200 has the format: INSTRUCTION [destination], [source], [key] where [destination], [source], and [key] respectively specify a set of destination vector registers, a set of source vector registers, and a cryptographic key vector register. Note that each of the set of destination vector registers and each of the set of source vector registers may not be explicitly specified. For example, the apparatus may be configured to perform the cryptographic operations for a predetermined number of vectors taken from a predetermined number of source registers and the results may be written to a predetermined number of destination registers. In such cases, the vector cryptographic processing instruction can specify only a first source and / or destination vector register and the further source and / or destination vector registers are implicit. In such cases, the vector cryptographic processing instruction can have the form: INSTRUCTION [first destination register], [first source register], [key]. Further, note that in a further example implementation no specific source and / or destination registers are specified. Instead these registers would be implicitly specified (e.g. from a known set of eight vector registers (z0-z7), z0-3 are taken as the source registers and z4-7 are taken as the output registers). The instruction is handled by decode circuitry 201, which decodes the instructions and generates corresponding control signals to cause the remainder of the data processing apparatus to perform the required operation(s). These control signals may affect many different parts of the data processing apparatus, but the illustration of Figure 2 highlights the control of at least one cryptographic processing unit 202a. An arbitrary number of further cryptographic processing units 202b, 202c may be provided and controlled by the control signals. Each of the cryptographic processing units is configured to carry out four operations, with corresponding circuitry 203, 204, 205, 206 being provided respectively to carry out: combining array elements with a cryptographic key; element substitution; row-shifting; and column mixing. The cryptographic processing units 202a, 202b, 202c have access to the set of vector registers 204 and thus, as directed by the vector cryptographic processing instruction 200 (i.e. as controlled by the control signals), they access the specified set of source vector registers and the specified cryptographic key vector register, retrieving vectors of data values from each, perform the required cryptographic operations (in the circuitry 203, 204, 205, 206) on arrays of data values provided by the source vector registers and write transformed arrays of data values back to the destination vector registers. Although the set of destination vector registers and the set of source vector registers may be distinct from one another, in some examples the transformed arrays of data values may be written back to the source vector registers, i.e. the set of destination vector registers is the set of source vector registers and the transformed arrays of data values are destructively written over the original arrays of data values in the source vector registers. Figure 3 schematically illustrates the execution of a vector cryptographic processing instruction operating on a vector sub-divided into multiple segments in accordance with some examples. The present techniques are not limited to any particular vector length, but the source vector 300 in this illustrated example is 512 bits in length. Furthermore, the system is configured to handle the vector as four separate segments 301a, 301b, 301c, 301 d each of which is then 128 bits in length. The array of data values 302 read from one source vector register 300 of the set of source vector registers is thus read from one segment 301a of that source vector 300. Thus it will be understood that each of the segments of the source vector can be processed independently (and possibly in parallel), whilst each of the source vector registers of the set of source vector registers can be processed independently (and also possibly in parallel) in response to one vector cryptographic processing instruction. For the processing of the array of data values 302, a cryptographic key (in this illustrated example a round key RK) is read from the corresponding segment 304 of the cryptographic key vector register 303. The round key RK of this example is thus also 128 bits in length. Cryptographic processing is carried out on the array of data values 302 (comprising 16 data values bo-bis). In a first operation, the array elements are combined with the cryptographic key producing the array 305 of data values C0-C15). A second operation of element substitution performed on the array elements 305 produces the array 306 of data values do-dis). A third operation of row-shifting performed on the array of data values 306 produces the array of data values 307. Finally, a fourth operation of column mixing performed on the array of data values 307 produces the array 308 of data values eo-eis). This transformed array of data values 308 is then written to the destination vector register 309. Specifically, this transformed array of data values 308, originating from segment 301a of the source vector 300 is written to the corresponding segment 310a of the four segments 310a, 310b, 310c, 310d of the destination vector register 309. Note that the operations of the cryptographic processing carried out in response to the vector cryptographic processing instruction may be ordered differently. In particular, the combination of the array elements with the cryptographic key (described as the first operation above) may take place either at the start or at the end. For example, the AES standard describes how the current round key is added as the last step. However, it can be more effective to add the previous round key at the start of the current round. Hence, the order of operations described is only one example and another example could perform the addition as the last operation. Figure 4 is a flow diagram showing a sequence of steps which are carried out when executing a vector cryptographic processing instruction in accordance with some examples. At first step the next instruction is decoded and if at step 401 this is found not to be a vector cryptographic processing instruction of the type disclosed herein, then the flow returns to step 400. However, for a vector cryptographic processing instruction the flow then proceeds to step 402, where the counter n is set to zero. At step 403 an array of data values is read from source vector register n, this being one of the set of source vector registers specified by the vector cryptographic processing instruction. At step 404 a cryptographic key is read from the cryptographic key vector register specified by the vector cryptographic processing instruction. The cryptographic processing then begins at step 405 with each element of the array being combined with a corresponding portion of the cryptographic key. At step 406 an intra-array substitution operation is performed, i.e. each element of the array is substituted by another element of the array. At step 407 row shifting is performed, wherein each non-first row of the array is shifted cyclically by a predetermined number of element positions. The final cryptographic processing step 408 performs a column mixing operation, wherein, in each column of the array, the elements of that column are combined using a linear transformation to generate a transformed column. The transformed array of data values is then written at step 409 to a corresponding destination vector register n of the set of destination vector registers. In this illustrated example the processing of content of the set of source vector registers specified by the vector cryptographic processing instruction is shown linearly, such that at step 410 if n is not 3 the flow loops back, n is incremented at step 411, and the next source vector register n of the set of source vector registers specified by the vector cryptographic processing instruction is processed. However, this linear processing is not essential, and the processing loop of steps 403-409 may be parallelised, such that the set of source vector registers specified by the vector cryptographic processing instruction is processed in parallel. Once all of the set of source vector registers has been processed, the processing of the vector cryptographic processing instruction is complete at step 412 and the flow returns to step 400. Note also that the example of four source vector registers being specified by the vector cryptographic processing instruction is only for illustration and the present techniques are not limited to any particular number of source vector registers being specified by the vector cryptographic processing instruction. Furthermore the ordering of the operations of the cryptographic processing carried out in response to the vector cryptographic processing instruction may be ordered differently (as in the case of the Figure 3 example). Thus is other examples step 404 (the addition of each element of the array with the cryptographic key) might instead follow step 408 (the column mixing step). Figure 5A schematically illustrates the parallel processing of two segments in accordance with some examples. The content of the two segments of a source vector register 600 (i.e. arrays of data values) are retrieved in parallel to be processed in parallel in parallel cryptographic operations 601, 602 with the application of a corresponding key (e.g. round key) indicated by the vector cryptographic processing instruction. The results of the parallel cryptographic operations 601, 602 (i.e. transformed arrays of data values) are written to the respective segments of the destination vector register 603. The content of the two segments of the source vector register 600 in Figure 6A could be a single array of data values in each, however could also be a set of arrays of data values in each. The latter case is shown in Figure 5B, schematically illustrating the parallel processing of multiple arrays of data values in accordance with some examples. A set of arrays of data values is retrieved from both of the two segments of the source vector register 605 and these multiple arrays of data values (A0-A7) are processed in parallel by the cryptographic operations 606 with the application of a corresponding key RKi (round key for round i) selected (not shown) by the vector cryptographic processing instruction. The results of the parallel cryptographic operations 606 (i.e. transformed arrays of data values) are written to the destination vector register 607. Figure 6 schematically illustrates a simulator implementation in accordance with some examples. Whilst the earlier described embodiments implement the present invention in terms of apparatus and methods for operating specific processing hardware supporting the techniques concerned, it is also possible to provide an instruction execution environment in accordance with the embodiments described herein which is implemented through the use of a computer program. Such computer programs are often referred to as simulators, insofar as they provide a software based implementation of a hardware architecture. Varieties of simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. Typically, a simulator implementation may run on a host processor 830, optionally running a host operating system 820, supporting the simulator program 810. In some arrangements, there may be multiple layers of simulation between the hardware and the provided instruction execution environment, and / or multiple distinct instruction execution environments provided on the same host processor. Historically, powerful processors have been required to provide simulator implementations which execute at a reasonable speed, but such an approach may be justified in certain circumstances, such as when there is a desire to run code native to another processor for compatibility or reuse reasons. For example, the simulator implementation may provide an instruction execution environment with additional functionality which is not supported by the host processor hardware, or provide an instruction execution environment typically associated with a different hardware architecture. An overview of simulation is given in “Some Efficient Architecture Simulation Techniques”, Robert Bedichek, Winter 1990 USENIX Conference, Pages 53 - 63. To the extent that embodiments have previously been described with reference to particular hardware constructs or features, in a simulated embodiment, equivalent functionality may be provided by suitable software constructs or features. For example, particular circuitry may be implemented in a simulated embodiment as computer program logic. Similarly, memory hardware, such as a register or cache, may be implemented in a simulated embodiment as a software data structure. In arrangements where one or more of the hardware elements referenced in the previously described embodiments are present on the host hardware (for example, host processor 830), some simulated embodiments may make use of the host hardware, where suitable. The simulator program 810 may be stored on a computer-readable storage medium (which may be a non-transitory medium), and provides a program interface (instruction execution environment) to the target code 800 (which may include applications, operating systems and a hypervisor) which is the same as the interface of the hardware architecture being modelled by the simulator program 810. As shown in the example of Figure 6, the simulator program 810 thus comprises (amongst many other components) instruction decoding program logic 812, processing program logic 814, and vector data structure logic 816 enabling the apparatuses described herein to be simulated. Thus, the program instructions of the target code 800 may be executed from within the instruction execution environment using the simulator program 810, so that a host computer 830 which does not actually have the hardware features of the apparatuses discussed above can emulate these features. In brief overall summary, apparatuses, methods, and computer program products are disclosed. Decoded instructions control the performance of data processing and a plurality of vector registers store data vectors, each data vector comprising a plurality of data elements. A vector cryptographic processing instruction specifies a set of destination vector registers, a set of source vector registers, and a cryptographic key vector register, and controls the data processing circuitry, for each source vector register, to: read an array of data values from the source vector register and a cryptographic key from the cryptographic key vector register; and perform cryptographic operations on the array of data values to generate a transformed array of data values. The cryptographic operations comprise: combining array elements with the cryptographic key; element substitution; row-shifting; and column mixing. For each source vector register, the transformed array of data values is written to a corresponding destination vector register. In the present application, the words “configured to...” are used to mean that an element of an apparatus has a configuration able to carry out the defined operation. In this context, a “configuration” means an arrangement or manner of interconnection of hardware or software. For example, the apparatus may have dedicated hardware which provides the defined operation, or a processor or other processing device may be programmed to perform the function. “Configured to” does not imply that the apparatus element needs to be changed in any way in order to provide the defined operation. Although illustrative embodiments of the invention have been described in detail herein with reference to the accompanying drawings, it is to be understood that the invention is not limited to those precise embodiments, and that various changes, additions and modifications can be effected therein by one skilled in the art without departing from the scope of the invention as defined by the appended claims. For example, various combinations of the features of the dependent claims could be made with the features of the independent claims without departing from the scope of the present invention.

Claims

1. Apparatus comprising:processing circuitry to perform data processing;instruction decoding circuitry to decode instructions to control the processing circuitry to perform the data processing; anda plurality of vector registers to store data vectors, each data vector comprising a plurality of data elements,wherein the instruction decoding circuitry is responsive to a vector cryptographic processing instruction specifying a set of destination vector registers, a set of source vector registers, and a cryptographic key vector register, to control the processing circuitry, for each source vector register, to:read an array of data values from the source vector register and a cryptographic key from the cryptographic key vector register, the data values forming elements of the array;perform cryptographic operations on the array of data values to generate a transformed array of data values, wherein the cryptographic operations comprise:each element of the array being combined with a corresponding portion of the cryptographic key;each element of the array being substituted by another element of the array;each non-first row of the array being shifted cyclically by a predetermined number of element positions; andin each column of the array, the elements of that column being combined using a linear transformation to generate a transformed column; andwrite the transformed array of data values to a corresponding destination vector register of the set of destination vector registers.

2. The apparatus of claim 1, wherein the processing circuitry is controlled to process each source vector register as a set of segments, wherein the instruction decoding circuitry is configured to control the processing circuitry, for each segment ofeach source vector register, to read the array of data values from that segment of that source vector register.

3. The apparatus of claim 2, wherein the processing circuitry is configured to process the set of segments in parallel.

4. The apparatus of claims 2 or claim 3, wherein a bit-length of each segment of the set of segments is greater than a bit-length of the array of data values, such that a segment comprises multiple arrays, and the processing circuitry is configured to process the multiple arrays in parallel.

5. The apparatus of any preceding claim, wherein the cryptographic processing is at least part of processing for a round of an iterative cryptographic algorithm and the cryptographic key is a round key generated for the round of the iterative cryptographic algorithm.

6. The apparatus of any preceding claim, wherein the vector cryptographic processing instruction specifies a first destination vector register of the set of destination vector registers and further destination vector registers of the set of destination vector registers are implicit.

7. The apparatus of any of claims 1-5, wherein the set of source vector registers and the set of destination vector registers are implicitly specified by the vector cryptographic processing instruction.

8. The apparatus of any preceding claim, wherein the vector cryptographic processing instruction specifies a first source vector register of the set of source vector registers and further source vector registers of the set of source vector registers are implicit.

9. The apparatus of any preceding claim, wherein the set of destination vector registers is a same set of vector registers as the set of source vector registers and writingthe transformed array of data values to the destination vector register destructively overwrites the source vector register.

10. The apparatus of any of claims 1-8, wherein the vector cryptographic processing instruction is an encryption vector processing instruction, the cryptographic key is an encryption key and the cryptographic operations performed on the array of data values are encryption operations.

11. The apparatus of any of claims 1-9, wherein the vector cryptographic processing instruction is a decryption vector processing instruction, the cryptographic key is a decryption key and the cryptographic operations performed on the array of data values are decryption operations.

12. The apparatus of any preceding claim, wherein the cryptographic operations performed on the array of data values are in accordance with Advanced Encryption Standard (AES).

13. The apparatus of any preceding claim, wherein the apparatus comprises vector register storage arranged in a plurality of banks, wherein a multiplicity of the plurality of banks corresponds to a multiplicity of the set of source vector registers.

14. The apparatus of claim 13, wherein for each source vector register, reading the array of data values from each source vector register comprises reading a respective array of data values from each bank of the plurality of banks.

15. The apparatus of any preceding claim, wherein the vector cryptographic processing instruction specifies a set of cryptographic key vector registers, wherein the instruction decoding circuitry is configured to control the processing circuitry, for each source vector register, to read the cryptographic key from a corresponding cryptographic key vector register of the set of cryptographic key vector registers.

16. A method comprising:operating processing circuitry to perform data processing;decoding instructions to control the processing circuitry to perform the data processing; andstoring data vectors in a plurality of vector registers, each data vector comprising a plurality of data elements,wherein the decoding instructions comprises, in response to decoding a vector cryptographic processing instruction specifying a set of destination vector registers, a set of source vector registers, and a cryptographic key vector register, controlling the processing circuitry, for each source vector register, to:read an array of data values forming elements of the array from the source vector register and a cryptographic key from the cryptographic key vector register;perform cryptographic operations on the array of data values to generate a transformed array of data values, wherein the cryptographic operations comprise:each element of the array being combined with a corresponding portion of the cryptographic key;each element of the array being substituted by another element of the array;each non-first row of the array being shifted cyclically by a predetermined number of element positions; andin each column of the array, the elements of that column being combined using a linear transformation to generate a transformed column; andwrite the transformed array of data values to a corresponding destination vector register of the set of destination vector registers.

17. A computer program for controlling a host data processing apparatus to provide an instruction execution environment, the computer program comprising:processing program logic configured to perform data processing;instruction decoding program logic configured to decode instructions to control the processing program logic to perform the data processing; anda plurality of vector data structures to store data vectors, each data vector comprising a plurality of data elements,wherein the instruction decoding program logic is responsive to a vector cryptographic processing instruction specifying a set of destination vector data structures, a set of source vector data structures, and a cryptographic key vector data structure, to control the processing program logic, for each source vector data structure, to:read an array of data values from the source vector data structure and a cryptographic key from the cryptographic key vector data structure, the data values forming elements of the array;perform cryptographic operations on the array of data values to generate a transformed array of data values, wherein the cryptographic operations comprise:each element of the array being combined with a corresponding portion of the cryptographic key;each element of the array being substituted by another element of the array;each non-first row of the array being shifted cyclically by a predetermined number of element positions; andin each column of the array, the elements of that column being combined using a linear transformation to generate a transformed column; andwrite the transformed array of data values to a corresponding destination vector register of the set of destination vector registers.

18. A non-transitory computer-readable storage medium storing the computer program of claim 17.

Images