Vector cryptographic processing

Abstract

Apparatuses, methods, and computer program products are disclosed. Decoded instructions control the performance of data processing and a plurality of vector registers store data vectors, each data vector comprising a plurality of data elements. A vector cryptographic processing instruction specifies a destination vector register, a source vector register, a cryptographic key vector register, and a key index value. The instruction controls the performance of a set of operations comprising: reading an array of data values from the source vector register and a cryptographic key from a sub-portion of the cryptographic key vector register indicated by the key index value; performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; and writing the transformed array of data values to the destination vector register.

Description

The present disclosure relates to data processing. In particular, the present disclosure relates to vector cryptographic processing. A data processing apparatus can be configured to perform data processing that operates on data held in various data formats. For example, single data values held in scalar registers (i.e. individual data values) may be the subject of the data processing or sets of data values held in vector registers (i.e. multiple data values) may be the subject of the data processing. The data processing may comprise cryptographic operations. In one example embodiment described herein there is an apparatus comprising: processing circuitry to perform data processing; instruction decoding circuitry to decode instructions to control the processing circuitry to perform the data processing; and a plurality of vector registers to store data vectors, each data vector comprising a plurality of data elements, wherein the instruction decoding circuitry is responsive to a vector cryptographic processing instruction specifying a destination vector register, a source vector register, a cryptographic key vector register, and a key index value, to control the processing circuitry to perform a set of operations comprising: reading an array of data values from the source vector register and a cryptographic key from a sub-portion of the cryptographic key vector register indicated by the key index value; performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; and writing the transformed array of data values to the destination vector register. In one example embodiment described herein there is a method comprising: controlling processing circuitry to perform data processing; decoding instructions to control the processing circuitry to perform the data processing; and storing data vectors in a plurality of vector registers, each data vector comprising a plurality of data elements, wherein the decoding instructions comprises, in response to decoding a vector cryptographic processing instruction specifying a destination vector register, a source vector register, a cryptographic key vector register, and a key index value, controlling the processing circuitry to perform a set of operations comprising: reading an array of data values from the source vector register and a cryptographic key from a sub-portion of the cryptographic key vector register indicated by the key index value; performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; and writing the transformed array of data values to the destination vector register. In one example embodiment described herein there is a computer program for controlling a host data processing apparatus to provide an instruction execution environment, the computer program comprising: processing program logic configured to perform data processing; instruction decoding program logic configured to decode instructions to control the processing program logic to perform the data processing; and a plurality of vector data structures to store data vectors, each data vector comprising a plurality of data elements, wherein the instruction decoding program logic is responsive to a vector cryptographic processing instruction specifying a destination vector data structure, a source vector data structure, a cryptographic key vector data structure, and a key index value, to control the processing program logic to perform a set of operations comprising: reading an array of data values from the source vector data structure and a cryptographic key from a sub-portion of the cryptographic key vector data structure indicated by the key index value; performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; and writing the transformed array of data values to the destination vector data structure. The present invention will be described further, by way of example only, with reference to embodiments thereof as illustrated in the accompanying drawings, in which: Figure 1 schematically illustrates an apparatus that embodies the present techniques in accordance with some examples; Figure 2 schematically illustrates the execution of a vector cryptographic processing instruction in accordance with some examples; Figure 3 schematically illustrates the execution of a vector cryptographic processing instruction in accordance with some examples; Figures 4A and 4B schematically illustrate the use of different round keys for each round of a vector cryptographic processing algorithm in accordance with some examples; Figures 5A, 5B, and 5C schematically illustrate different segment lengths within a given vector length in accordance with some examples; Figure 6A schematically illustrates the parallel processing of two segments in accordance with some examples; Figure 6B schematically illustrates the parallel processing of multiple arrays of data values in accordance with some examples; Figure 7 is a flow diagram showing a sequence of steps which are carried out when executing a vector cryptographic processing instruction in accordance with some examples; and Figure 8 schematically illustrates a simulator implementation in accordance with some examples. Before discussing the embodiments with reference to the accompanying figures, the following description of embodiments is provided. In accordance with one example configuration there is provided an apparatus comprising: processing circuitry to perform data processing; instruction decoding circuitry to decode instructions to control the processing circuitry to perform the data processing; and a plurality of vector registers to store data vectors, each data vector comprising a plurality of data elements, wherein the instruction decoding circuitry is responsive to a vector cryptographic processing instruction specifying a destination vector register, a source vector register, a cryptographic key vector register, and a key index value, to control the processing circuitry to perform a set of operations comprising: reading an array of data values from the source vector register and a cryptographic key from a sub-portion of the cryptographic key vector register indicated by the key index value; performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; and writing the transformed array of data values to the destination vector register. In a data processing apparatus that performs vector cryptographic processing, there is often the need for the processing to use multiple distinct cryptographic keys. For example, a cryptographic algorithm being implemented may have a round function that is iterated multiple times inside the algorithm, where a different round key is used at each iteration. The set of round keys for these rounds, sometimes referred to as a set of subkeys, may be derived from a main cryptographic key in advance in accordance with the particular cryptographic algorithm being implemented. The storage requirements for the set of subkeys is not insignificant, in particular when they are to be held in registers local to the processing circuitry that performs the data processing operations. For example, the Advanced Encryption Standard (AES) specification for encryption / decryption requires 11, 13, or 15 round keys depending on whether the key size is 128-bit, 192-bit, or 256-bit. Thus for a data processing apparatus implementing such a cryptographic algorithm, there is a considerable requirement for available registers, not only to hold such round keys, but also to hold the data blocks that are being subjected to encryption / decryption, to hold result values, and to hold other facilitating values. One possible approach to this could be to limit the unrolling of rounds of the cryptographic algorithm (i.e. where multiple rounds are executed per clock cycle). Another possible approach could be to load each round key immediately prior to it being used. However, the former approach underutilizes apparatuses that are capable of completing independent operations / instructions in parallel and the latter approach incurs the latency of the loading. In this context the present techniques provide a vector register based approach in which a cryptographic key vector register holds multiple keys and a particular key (as required by the current stage of cryptographic processing) is selected from a sub-portion of the cryptographic key vector register that is indicated by a key index value. A dedicated vector cryptographic processing instruction is provided that specifies a destination vector register, a source vector register, a cryptographic key vector register, and a key index value. The processing circuitry of the apparatus is then controlled to perform a set of operations, wherein an array of data values is read from the source vector register and a cryptographic key is read from a sub-portion of the cryptographic key vector register as indicated by the key index value. Then, cryptographic processing is performed on the array of data values using the cryptographic key to generate a transformed array of data values, which is written to the destination vector register. Accordingly, multiple cryptographic keys are stored in the cryptographic key vector register and are selected in turn as required by the key index value. The key index value may be specified in a variety of ways by the vector cryptographic processing instruction, but in some examples the key index value is an immediate value provided by the vector cryptographic processing instruction. The multiple cryptographic keys stored in the cryptographic key vector register, and from which a current cryptographic key is selected by the key index value, may be provided in a range of contexts and be used in a variety of ways, but in some examples the cryptographic processing is at least part of processing for a round of an iterative cryptographic algorithm and the cryptographic key is a round key generated for the round of the iterative cryptographic algorithm. Thus in some examples the cryptographic key vector register holds multiple cryptographic keys in multiple subportions and each sub-portion of the multiple sub-portions holds a different round key for a different round of the iterative cryptographic algorithm. The present techniques are not restricted to any particular length of vector register (i.e. length of the set of data values held by a vector register). Accordingly, the approaches disclosed herein may be applied to a variety of lengths of vector register. However within a given length of vector register, in some examples the processing circuitry is configured to process the source vector register as a set of segments, wherein the instruction decoding circuitry is configured to control the processing circuitry, for each segment of the source vector register, to read the array of data values from that segment of the source vector register and to read the cryptographic key from the subportion of a corresponding segment of the cryptographic key vector register. This supports a vector-length agnostic approach whereby the key index value is indicative of a sub-portion of a segment of the cryptographic key vector register and therefore, in terms of the use of the key index value to indicate of a sub-portion of the segment, the vector length is then immaterial and could for example be the same as the segment length or could equally be greater than the segment length. Handling the vector in segments also has the consequence that the segments are essentially independent of one another (other than typically being loaded and stored together) and this presents further opportunities to enhance the processing efficiency of the apparatus. In some examples, the processing circuitry is configured to process the set of segments in parallel. Furthermore, handling the vector in segments also limits the width of the portion of the vector across which a given key needs to be routed, avoiding overly complex wiring requirements were a key to need to be passed from one side to another of a wide vector. Similarly, in some examples a bit-length of each segment of the set of segments is greater than a bit length of the array of data values, such that a segment comprises multiple arrays, and the processing circuitry is configured to process the multiple arrays in parallel. This further supports efficient performance of the apparatus. In some examples, the sub-portion of the cryptographic key vector register from which the cryptographic key is read is a sub-portion of a segment of the set of segments. In some examples, a set of cryptographic keys held in respective sub-portions of that segment of the cryptographic key vector register is repeated across all segments of the cryptographic key vector register. This further supports the processing of multiple arrays in parallel, whereby for example in a given round of a cryptographic algorithm the same round key for that round can be applied to multiple arrays of data values from respective segments. In some examples, the destination vector register is a same vector register as the source vector register and writing the transformed array of data values to the destination vector register destructively overwrites the source vector register. This can support an efficient use of the registers of the apparatus when performing an iterative cryptographic algorithm, since then each round of the iterative cryptographic algorithm does not require an available destination vector register into which the result of that round can be written. In some examples, the vector cryptographic processing instruction is an encryption vector processing instruction, the cryptographic key is an encryption key and the cryptographic processing performed on the array of data values is an encryption operation. In some examples, the vector cryptographic processing instruction is a decryption vector processing instruction, the cryptographic key is a decryption key and the cryptographic processing performed on the array of data values is a decryption operation. In some examples, the cryptographic processing performed on the array of data values further comprises a column mixing operation. For example, a column mixing operation forms part of a processing round according to the Advanced Encryption Standard (AES) specification for encryption / decryption. The vector cryptographic processing instruction can thus be arranged in some examples to perform some or all of the operations required to implement a processing round when performing cryptographic processing. Accordingly, in some examples the cryptographic processing performed on the array of data values is in accordance with Advanced Encryption Standard (AES). In some examples, the cryptographic processing performed on the array of data values is part of an encryption algorithm comprising authentication. For example, the AES algorithm may be extended to be implemented as the AES Galois Counter Mode (AES-GCM). In some examples, the vector cryptographic processing instruction specifies a set of destination vector registers and a set of source vector registers, and wherein the set of operations are performed for each source vector of the set of source vector registers and comprise writing a respective transformed array of data values to a respective destination vector register. Accordingly, the performance of the apparatus for its cryptographic processing is enhanced, whilst retaining an efficient code density, i.e. that multiple vector cryptographic processing instructions are not needed to cause multiple sets of cryptographic operations to be performed, but rather these are all initiated by a single vector cryptographic processing instruction. In some examples, the vector cryptographic processing instruction specifies a first destination vector register of the set of destination vector registers and further destination vector registers of the set of destination vector registers are implicit. This further supports efficient code density, in that only the first destination vector register needs to be explicitly specified in the vector cryptographic processing instruction. Similarly, in some examples the vector cryptographic processing instruction specifies a first source vector register of the set of source vector registers and further source vector registers of the set of source vector registers are implicit. In accordance with one example configuration there is provided a method comprising: controlling processing circuitry to perform data processing; decoding instructions to control the processing circuitry to perform the data processing; and storing data vectors in a plurality of vector registers, each data vector comprising a plurality of data elements, wherein the decoding instructions comprises, in response to decoding a vector cryptographic processing instruction specifying a destination vector register, a source vector register, a cryptographic key vector register, and a key index value, controlling the processing circuitry to perform a set of operations comprising: reading an array of data values from the source vector register and a cryptographic key from a sub-portion of the cryptographic key vector register indicated by the key index value; performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; and writing the transformed array of data values to the destination vector register. In accordance with one example configuration there is provided a computer program for controlling a host data processing apparatus to provide an instruction execution environment, the computer program comprising: processing program logic configured to perform data processing; instruction decoding program logic configured to decode instructions to control the processing program logic to perform the data processing; and a plurality of vector data structures to store data vectors, each data vector comprising a plurality of data elements, wherein the instruction decoding program logic is responsive to a vector cryptographic processing instruction specifying a destination vector data structure, a source vector data structure, a cryptographic key vector data structure, and a key index value, to control the processing program logic to perform a set of operations comprising: reading an array of data values from the source vector data structure and a cryptographic key from a sub-portion of the cryptographic key vector data structure indicated by the key index value; performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; and writing the transformed array of data values to the destination vector data structure. Particular embodiments will now be described with reference to the figures. Figure 1 illustrates a data processing apparatus 100 in accordance with one embodiment. The apparatus 100 has a pipelined structure illustrated at a high-level in Figure 1 by the linked stages of fetch circuitry 101, decode circuitry 102, issue circuitry 103, and processing circuitry 104. Instructions retrieved from the memory system by the actions of fetch circuitry 101 are decoded by decode circuitry 102, generating control signals for the whole pipeline structure and in particular for the processing circuitry 104. The processing circuitry 104 comprises different execution units provided to perform different types of data processing tasks, illustrated in the figure by cryptographic unit 105, ALUs 106 and 107, and floating point (FP) unit 108. The apparatus also comprises load / store unit 109, which executes load instructions and store instructions to bring data values from the memory system into registers local to the processing circuitry 104 and to store data values from the registers into the memory system, respectively. A set of vector registers 110 are explicitly shown in the figure. The processing circuitry 104 also has access to a set of scalar registers that are not shown in the figure. The memory system is represented in the figure by instruction cache (1$) 111, level 1 cache (Ll$) 112, level 2 cache (L2$) 113, and memory 114. In a manner with which one of ordinary skill in the art will be familiar, data values retrieved from the memory 114 are loaded into registers (e.g. vector registers 110) for the processing circuitry 109 to perform data processing operations thereon and modified data values are stored into the memory 114. Temporary copies of repeatedly used data values may be held in the caches 111, 112, and 113 to mitigate against the latency associated with retrieving a data value from memory 114. One particular type of instruction handled by the apparatus 100 is a vector cryptographic processing instruction, which is executed by the cryptographic unit 105, accessing vectors of data values held in the vector registers 110. More detail of these instructions, as the subject of the present disclosure, is given with reference to the figures that follow. Figure 2 schematically illustrates the execution of a vector cryptographic processing instruction in accordance with some examples. The vector cryptographic processing instruction 200 has the format: INSTRUCTION [destination], [source], [key], [index] where [destination], [source], and [key] respectively specify a destination vector register, a source vector register, and a cryptographic key vector register. Further, [index] could specify a register that holds a key index value, but in many examples [index] is an immediate value specified in the instruction encoding. Execution of the vector cryptographic processing instruction causes an array of data values 202 to be read from the source vector register 201. The array of data values 202 are typically retrieved as a sequential set of data values (e.g. bytes) from the source vector register 201, wherein the illustrates 4x4 array format is implicit. Execution of the vector cryptographic processing instruction also causes the cryptographic key vector register 203 to be accessed, from which a cryptographic key (Ki in the example shown) is selected from a sub-portion of the vector register, where this sub-portion is indicated by the key index value [index], A cryptographic operation 204 is then performed using the cryptographic key on the array of data values 202 to generate a transformed array of data values 205. The transformed array of data values 205 is written into the destination vector register 206. Note that although the source vector register 201 and the destination vector register 206 are illustrated as distinct from one another in Figure 2, in some examples these may be the same vector register, such that writing the transformed array of data values 205 to the (source / destination) vector register destructively overwrites original array of data values 202 therein. In such cases [destination] and [source] are the same in the instruction encoding or alternatively an encoding of the instruction which only allow as for this circular operation could also be provided as: INSTRUCTION [source / destination], [key], [index]. The vector cryptographic processing instruction can also specify a set of destination vector registers and a set of source vector registers, such that the cryptographic operations are performed for each source vector of the set of source vector registers and the respective transformed array of data values is written to a respective destination vector register. In such cases the vector cryptographic processing instruction can have the form: INSTRUCTION [set of destination registers], [set of source registers], [key], [index] However either or both of the set of destination registers and the set of source registers need not be explicitly specified. For example, the apparatus may be configured to perform the cryptographic operations for a predetermined number of vector taken from a predetermined number of source registers and the results may be written to a predetermined number of destination registers. In such cases, the vector cryptographic processing instruction can specify only a first source and / or destination vector register and further source and / or destination vector registers are implicit. In such cases the vector cryptographic processing instruction can have the form: INSTRUCTION [first destination register], [first source register], [key], [index] Figure 3 schematically illustrates the execution of a vector cryptographic processing instruction in accordance with some examples, which is similar to that shown in Figure 2. The vector cryptographic processing instruction 300 has the same format: INSTRUCTION [destination], [source], [key], [index]. Execution of the vector cryptographic processing instruction causes an array of data values 302 to be read from the source vector register 301, although in this example source vector register 301 is handled as a set of (four) segments. In the example shown, the array of data values 302 is read from the left-most segment of the source vector register 301. As in the case of Figure 2, execution of the vector cryptographic processing instruction also causes a cryptographic key vector register 303 to be accessed, from which a cryptographic key (KI in the example shown) is selected from a sub-portion of the vector register, where this sub-portion is indicated by the key index value [index]. The cryptographic operation 304 is then performed using the cryptographic key on the array of data values 302 to generate the transformed array of data values 305, which is written into the corresponding segment of the destination vector register 206. As in the case of Figure 2, the source vector register 301 and the destination vector register 306 may be the same vector register. The handling of the source and destination vector registers in segments means here means that on the one hand, segments of a predetermined length can be employed regardless of the vector length (i.e. the configuration is “vector length agnostic”), and on the other hand if so supported the segments could be processed in parallel, enhancing the throughput of the apparatus. Figures 4A and 4B schematically illustrate the use of different round keys for each round of a vector cryptographic processing algorithm in accordance with some examples. The selection of a cryptographic key from a sub-portion of a cryptographic key vector register indicated by the key index value may support various configurations of the use of cryptographic keys. In some examples such as that shown in Figures 4A and 4B however, the multiple keys stored in the multiple sub-portions of the cryptographic key vector register can correspond to the different round keys for each round of a vector cryptographic processing algorithm. Accordingly Figures 4A and 4B show four round keys RKo - RK3 being held in the cryptographic key vector register 400, whereby at round 0 of the algorithm the round key RKo is selected and is used in the cryptographic operation acting on four separate arrays of data values A0-A3 taken from the source vector register 401. Subsequently, at round 1 of the algorithm the round key RK1 is selected and is used in the cryptographic operation acting on the four separate arrays of data values Ao-A3 taken from the source vector register 401. Figures 5A, 5B, and 5C schematically illustrate different segment lengths within a given vector length in accordance with some examples. In the example of Figure 5 A the segment length is half of the vector length. The two segments within the vector length are thus handled independently of one another. Furthermore, in this example the segment length is four times the key length. To give just one example set of bit sizes matching the Figure 5 A configuration, with 128-bit keys, the segment length is then 512 bits, and the vector length is 1024 bits. The arrays of data values taken from the source vector register 501 are also each 128-bit (16 bytes). The index is thus a 2-bit value, enabling the selection of one of the four keys within a segment of the cryptographic key register 500. In the example of Figure 5B the segment length is the same as the vector length. Furthermore, in this example the segment length is twice the key length. To give just one example set of bit sizes matching the Figure 5 A configuration, with 128-bit keys, the segment length and the vector length are then 256 bits. The arrays of data values taken from the source vector register 503 are also each 128-bit (16 bytes). The index is thus a 1 -bit value, enabling the selection of one of the two keys within the one segment of the cryptographic key register 502. In the example of Figure 5C the segment length is a quarter of the vector length. The four segments within the vector length are thus handled independently of one another. Furthermore, in this example the segment length is twice the key length. To give just one example set of bit sizes matching the Figure 5C configuration, with 128-bit keys, the segment length is then 256 bits, and the vector length is 1024 bits. The arrays of data values taken from the source vector register 505 are also each 128-bit (16 bytes). The index is thus a 1-bit value, enabling the selection of one of the two keys within a segment of the cryptographic key register 504. The examples of Figures 5A, 5B, and 5C illustrate that the vector cryptographic processing instructions disclosed herein are vector length agnostic and hence program code can be written which works for any vector length that is greater than the minimum. The restriction of the set of selectable keys to the segment length also constrains the size of the index value, meaning that only a limited number of encoding bits are required to provide this value as an immediate. Figure 6A schematically illustrates the parallel processing of two segments in accordance with some examples. The content of the two segments of the source vector register 600 (i.e. arrays of data values) are retrieved in parallel to be processed in parallel in parallel cryptographic operations 601, 602 with the application of a corresponding key (e.g. round key) selected (not shown) by the index value indicated by the vector cryptographic processing instruction. The results of the parallel cryptographic operations 601, 602 (i.e. transformed arrays of data values) are written to the respective segments of the destination vector register 603. The content of the two segments of the source vector register 600 in Figure 6A could be a single array of data values in each, however could also be a set of arrays of data values in each. The latter case is shown in Figure 6B, schematically illustrating the parallel processing of multiple arrays of data values in accordance with some examples. A set of arrays of data values is retrieved from both of the two segments of the source vector register 605 and these multiple arrays of data values (A0-A7) are processed in parallel by the cryptographic operations 606 with the application of a corresponding key RKi (round key for round i) selected (not shown) by the index value indicated by the vector cryptographic processing instruction. The results of the parallel cryptographic operations 606 (i.e. transformed arrays of data values) are written to the destination vector register 607. Figure 7 is a flow diagram showing a sequence of steps which are carried out when executing a vector cryptographic processing instruction in accordance with some examples. The flow begins at step 700 at which a vector cryptographic processing instruction is decoded. In response to this, at step 701 an array of data values is read from the source vector register specified by the vector cryptographic processing instruction. Also, at step 702, a cryptographic key is read from a sub-portion of the cryptographic key vector register specified by the vector cryptographic processing instruction, where the sub-portion is indicated by a key index value specified by the vector cryptographic processing instruction. Then at step 703 cryptographic processing is performed on the array of data values using the cryptographic key to generate a transformed array of data values. Finally at step 704 the transformed array of data values is written to the destination vector register specified by the vector cryptographic processing instruction. Figure 8 schematically illustrates a simulator implementation in accordance with some examples. Whilst the earlier described embodiments implement the present invention in terms of apparatus and methods for operating specific processing hardware supporting the techniques concerned, it is also possible to provide an instruction execution environment in accordance with the embodiments described herein which is implemented through the use of a computer program. Such computer programs are often referred to as simulators, insofar as they provide a software based implementation of a hardware architecture. Varieties of simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. Typically, a simulator implementation may run on a host processor 830, optionally running a host operating system 820, supporting the simulator program 810. In some arrangements, there may be multiple layers of simulation between the hardware and the provided instruction execution environment, and / or multiple distinct instruction execution environments provided on the same host processor. Historically, powerful processors have been required to provide simulator implementations which execute at a reasonable speed, but such an approach may be justified in certain circumstances, such as when there is a desire to run code native to another processor for compatibility or reuse reasons. For example, the simulator implementation may provide an instruction execution environment with additional functionality which is not supported by the host processor hardware, or provide an instruction execution environment typically associated with a different hardware architecture. An overview of simulation is given in “Some Efficient Architecture Simulation Techniques”, Robert Bedichek, Winter 1990 USENIX Conference, Pages 53 - 63. To the extent that embodiments have previously been described with reference to particular hardware constructs or features, in a simulated embodiment, equivalent functionality may be provided by suitable software constructs or features. For example, particular circuitry may be implemented in a simulated embodiment as computer program logic. Similarly, memory hardware, such as a register or cache, may be implemented in a simulated embodiment as a software data structure. In arrangements where one or more of the hardware elements referenced in the previously described embodiments are present on the host hardware (for example, host processor 830), some simulated embodiments may make use of the host hardware, where suitable. The simulator program 810 may be stored on a computer-readable storage medium (which may be a non-transitory medium), and provides a program interface (instruction execution environment) to the target code 800 (which may include applications, operating systems and a hypervisor) which is the same as the interface of the hardware architecture being modelled by the simulator program 810. As shown in the example of Figure 8, the simulator program 810 thus comprises (amongst many other components) instruction decoding program logic 812, processing program logic 814, and vector data structure logic 816 enabling the apparatuses described herein to be simulated. Thus, the program instructions of the target code 800 may be executed from within the instruction execution environment using the simulator program 810, so that a host computer 830 which does not actually have the hardware features of the apparatuses discussed above can emulate these features. In brief overall summary, apparatuses, methods, and computer program products are disclosed. Decoded instructions control the performance of data processing and a plurality of vector registers store data vectors, each data vector comprising a plurality of data elements. A vector cryptographic processing instruction specifies a destination vector register, a source vector register, a cryptographic key vector register, and a key index value. The instruction controls the performance of a set of operations comprising: reading an array of data values from the source vector register and a cryptographic key from a sub-portion of the cryptographic key vector register indicated by the key index value; performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; and writing the transformed array of data values to the destination vector register. In the present application, the words “configured to...” are used to mean that an element of an apparatus has a configuration able to carry out the defined operation. In this context, a “configuration” means an arrangement or manner of interconnection of hardware or software. For example, the apparatus may have dedicated hardware which provides the defined operation, or a processor or other processing device may be programmed to perform the function. “Configured to” does not imply that the apparatus element needs to be changed in any way in order to provide the defined operation. Although illustrative embodiments of the invention have been described in detail herein with reference to the accompanying drawings, it is to be understood that the invention is not limited to those precise embodiments, and that various changes, additions and modifications can be effected therein by one skilled in the art without departing from the scope of the invention as defined by the appended claims. For example, various combinations of the features of the dependent claims could be made with the features of the independent claims without departing from the scope of the present invention.

Claims

1. Apparatus comprising:processing circuitry to perform data processing;instruction decoding circuitry to decode instructions to control the processing circuitry to perform the data processing; anda plurality of vector registers to store data vectors, each data vector comprising a plurality of data elements,wherein the instruction decoding circuitry is responsive to a vector cryptographic processing instruction specifying a destination vector register, a source vector register, a cryptographic key vector register, and a key index value, to control the processing circuitry to perform a set of operations comprising:reading an array of data values from the source vector register and a cryptographic key from a sub-portion of the cryptographic key vector register indicated by the key index value;performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; andwriting the transformed array of data values to the destination vector register.

2. The apparatus of claim 1, wherein the cryptographic processing is at least part of processing for a round of an iterative cryptographic algorithm and the cryptographic key is a round key generated for the round of the iterative cryptographic algorithm.

3. The apparatus of claim 2, wherein the cryptographic key vector register holds multiple cryptographic keys in multiple sub-portions and each sub-portion of the multiple sub-portions holds a different round key for a different round of the iterative cryptographic algorithm.

4. The apparatus of any of claims 1-3, wherein the processing circuitry is configured to process the source vector register as a set of segments, wherein the instruction decoding circuitry is configured to control the processing circuitry, for each segment of the source vector register, to read the array of data values from that segmentof the source vector register and to read the cryptographic key from the sub-portion of s corresponding segment of the cryptographic key vector register.

5. The apparatus of claim 4, wherein the processing circuitry is configured to process the set of segments in parallel.

6. The apparatus of claim 4 or claim 5, wherein a bit-length of each segment of the set of segments is greater than a bit length of the array of data values, such that a segment comprises multiple arrays, and the processing circuitry is configured to process the multiple arrays in parallel.

7. The apparatus of any of claims 4-6, wherein the sub-portion of the cryptographic key vector register from which the cryptographic key is read is a sub-portion of a segment of the set of segments.

8. The apparatus of claim 4-7, wherein a set of cryptographic keys held in respective sub-portions of that segment of the cryptographic key vector register is repeated across all segments of the cryptographic key vector register.

9. The apparatus of any preceding claim, wherein the destination vector register is a same vector register as the source vector register and writing the transformed array of data values to the destination vector register destructively overwrites the source vector register.

10. The apparatus of any of claims 1-9, wherein the vector cryptographic processing instruction is an encryption vector processing instruction, the cryptographic key is an encryption key and the cryptographic processing performed on the array of data values is an encryption operation.

11. The apparatus of any of claims 1-9, wherein the vector cryptographic processing instruction is a decryption vector processing instruction, the cryptographic key is adecryption key and the cryptographic processing performed on the array of data values is a decryption operation.

12. The apparatus of any of claims 1-9, wherein the cryptographic processing performed on the array of data values further comprises a column mixing operation.

13. The apparatus of any preceding claim, wherein the cryptographic processing performed on the array of data values is in accordance with Advanced Encryption Standard (AES).

14. The apparatus of any preceding claim, wherein the cryptographic processing performed on the array of data values is part of an encryption algorithm comprising authentication.

15. The apparatus of any preceding claim, wherein the vector cryptographic processing instruction specifies a set of destination vector registers and a set of source vector registers, and wherein the set of operations are performed for each source vector of the set of source vector registers and comprise writing a respective transformed array of data values to a respective destination vector register.

16. The apparatus of claim 15, wherein the vector cryptographic processing instruction specifies a first destination vector register of the set of destination vector registers and further destination vector registers of the set of destination vector registers are implicit.

17. The apparatus of any of claims 15 and 16, wherein the vector cryptographic processing instruction specifies a first source vector register of the set of source vector registers and further source vector registers of the set of source vector registers are implicit.

18. A method comprising:controlling processing circuitry to perform data processing;decoding instructions to control the processing circuitry to perform the data processing; andstoring data vectors in a plurality of vector registers, each data vector comprising a plurality of data elements,wherein the decoding instructions comprises, in response to decoding a vector cryptographic processing instruction specifying a destination vector register, a source vector register, a cryptographic key vector register, and a key index value, controlling the processing circuitry to perform a set of operations comprising:reading an array of data values from the source vector register and a cryptographic key from a sub-portion of the cryptographic key vector register indicated by the key index value;performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; andwriting the transformed array of data values to the destination vector register.

20. A non-transitory computer readable medium storing a computer program for controlling a host data processing apparatus to provide an instruction execution environment, the computer program comprising:processing program logic configured to perform data processing;instruction decoding program logic configured to decode instructions to control the processing program logic to perform the data processing; anda plurality of vector data structures to store data vectors, each data vector comprising a plurality of data elements,wherein the instruction decoding program logic is responsive to a vector cryptographic processing instruction specifying a destination vector data structure, a source vector data structure, a cryptographic key vector data structure, and a key index value, to control the processing program logic to perform a set of operations comprising:reading an array of data values from the source vector data structure and a cryptographic key from a sub-portion of the cryptographic key vector data structure indicated by the key index value;performing cryptographic processing on the array of data values using the cryptographic key to generate a transformed array of data values; andwriting the transformed array of data values to the destination vector data structure.510

Images