View source for List of x86 cryptographic instructions

{{short description|none}}
{{X86 instruction listings}}
Instructions that have been added to the [[x86]] [[instruction set]] in order to assist efficient calculation of [[cryptographic primitive]]s, such as e.g. [[Advanced Encryption Standard|AES]] encryption, [[Secure Hash Algorithms|SHA]] hash calculation and [[Cryptographically secure pseudorandom number generator|random number generation]].

== Intel AES instructions ==
{{Main|AES instruction set}}
6 new instructions.
{| class="wikitable sortable"
! Instruction
! Encoding
! Description
! Added in
|-
| <code>AESENC xmm1,xmm2/m128</code>
| <code>66 0F 38 DC /r</code>
| Perform one round of an [[Advanced Encryption Standard|AES]] encryption flow.<br/>Performs the {{code|SubBytes}}, {{code|ShiftRows}}, {{code|MixColumns}} and {{code|AddRoundKey}} steps of an AES encryption round, in that order.{{efn|name=aes_subbytes|1=The {{code|SubBytes}} and {{code|ShiftRows}} steps of an AES encryption round may be performed in either order - the result of the instruction is the same either way.<ref name="intel_aesni">Intel, [https://www.intel.com/content/dam/develop/external/us/en/documents/aes-wp-2012-09-22-v01-165683.pdf Advanced Encryption Standard (AES) New Instructions Set], order no. 323641-001, rev 3.01, Sep 2012, pages 16-17. [https://web.archive.org/web/20220120062358/https://www.intel.com/content/dam/develop/external/us/en/documents/aes-wp-2012-09-22-v01-165683.pdf Archived] on 19 Jan 2022.</ref> (Intel documentation describes the {{code|ShiftRows}} step as being performed first, while AMD documentation describes {{code|SubBytes}} as being performed first.) This also applies to the {{code|InvShiftRows}}/{{code|InvSubBytes}} steps of an AES decryption round.}}<br/>The first source argument provides a 128-bit data-block to perform an encryption round on, the second source argument provides a round key for the {{code|AddRoundKey}} stage.
| rowspan=6 |
{{glossary}}{{term|AES-NI}}{{defn|Intel [[Westmere (microarchitecture)|Westmere]],<br/>Intel [[Silvermont]],<br/>AMD [[Bulldozer (microarchitecture)|Bulldozer]],<br/>AMD [[Jaguar (microarchitecture)|Jaguar]],<br/>{{nowrap|[[VIA Nano]] QuadCore C4000}}}}{{term|VAES}}{{defn|Intel [[Ice Lake (microprocessor)|Ice Lake]],<br/>Intel [[Rocket Lake]],<br/>AMD [[Zen 3]]}}{{glossary end}}
|-
| <code>AESENCLAST xmm1,xmm2/m128</code>
| <code>66 0F 38 DD /r</code>
| Perform the last round of an AES encryption flow.<br/>Performs the {{code|SubBytes}}, {{code|ShiftRows}} and {{code|AddRoundKey}} steps of an AES encryption round, in that order.{{efn|name=aes_subbytes}}
|-
| <code>AESDEC xmm1,xmm2/m128</code>
| <code>66 0F 38 DE /r</code>
| Perform one round of an AES decryption flow.<br/>Performs the {{code|InvShiftRows}}, {{code|InvSubBytes}}, {{code|InvMixColumns}} and {{code|AddRoundKey}} steps of an AES decryption round, in that order.{{efn|name=aes_subbytes}}{{efn|name=aesdec_oddity|1=For the intended AES decode flow under AES-NI (a series of <code>AESDEC</code> instructions followed by an <code>AESDECLAST</code>), the <code>AESDEC</code> instruction performs the {{code|InvMixColumns}} and {{code|AddRoundKey}} steps in the opposite order of what the AES specification (FIPS 197) indicates.<br/>As a result of this, the AES round key provided as the second source argument to <code>AESDEC</code> cannot just be taken from the [[Rijndael key schedule]] directly, but instead has to be postprocessed by performing an {{code|InvMixColumn}} on the round key after the key schedule and before it's used with <code>AESDEC</code><ref name="intel_aesni"/> (this can be done with the <code>AESIMC</code> instruction or by doing an {{nowrap|<code>AESENCLAST</code>+<code>AESDEC</code>}} sequence with the round key set to 0.)<br/>This issue is specific to <code>(V)AESDEC</code> and does not apply to round keys used with the <code>AESENC</code>, <code>AESENCLAST</code> or <code>AESDECLAST</code> instructions.}}  
|-
| <code>AESDECLAST xmm1,xmm2/m128</code>
| <code>66 0F 38 DF /r</code>
| Perform the last round of an AES decryption flow.<br/>Performs the {{code|InvShiftRows}}, {{code|InvSubBytes}} and {{code|AddRoundKey}} steps of an AES decryption round, in that order.{{efn|name=aes_subbytes}}
|-
| {{nowrap|<code>AESKEYGENASSIST xmm1,xmm2/m128,imm8</code>}}
| {{nowrap|<code>66 0F 3A DF /r ib</code>}}
| Assist in AES round key generation. The operation performed is:
<pre>
temp[127: 0] := SubBytes( src[127:0] )  // AES SubBytes step
dest[ 31: 0] := temp[63:32]
dest[ 63:32] := rotate_left( temp[63:32], 8 ) XOR RCON
dest[ 95:64] := temp[127:96]
dest[127:96] := rotate_left( temp[127:96], 8 ) XOR RCON
</pre>
where RCON is the instruction's imm8 argument zero-extended to 32 bits.
|-
| <code>AESIMC xmm1,xmm2/m128</code>
| <code>66 0F 38 DB /r</code>
| Perform the {{code|InvMixColumns}} step of an AES decryption round on one 128-bit block.<br/>Mainly used to help prepare an AES key for use with the <code>AESDEC</code> instruction.{{efn|name=aesdec_oddity}}
|}
{{notelist}}

== CLMUL instructions ==
{{Main|CLMUL instruction set}}
{| class="wikitable sortable"
! Instruction !! Opcode !! Description
|-
| {{nowrap|<code>PCLMULQDQ xmm1,xmm2,imm8</code>}} || {{nowrap|<code>66 0F 3A 44 /r ib</code>}}
| Perform a carry-less multiplication of two 64-bit polynomials over the finite field ''GF''(2<sup>''k''</sup>).
|-
| <code>PCLMULLQLQDQ xmm1,xmm2/m128</code> || {{nowrap|<code>66 0F 3A 44 /r 00</code>}}
| Multiply the low halves of the two 128-bit operands.
|-
| <code>PCLMULHQLQDQ xmm1,xmm2/m128</code> || <code>66 0F 3A 44 /r 01</code>
| Multiply the high half of the destination register by the low half of the source operand.
|-
| <code>PCLMULLQHQDQ xmm1,xmm2/m128</code> || <code>66 0F 3A 44 /r 10</code>
| Multiply the low half of the destination register by the high half of the source operand.
|-
| <code>PCLMULHQHQDQ xmm1,xmm2/m128</code> || <code>66 0F 3A 44 /r 11</code>
| Multiply the high halves of the two 128-bit operands.
|}

== RDRAND and RDSEED ==
{{Main|RDRAND}}

{| class="wikitable sortable"
! Instruction
! Encoding
! Description
! Added in
|-
| <code>RDRAND r16</code><br /><code>RDRAND r32</code>
| <code>NFx 0F C7 /6</code>
| rowspan="2" | Return a random number that has been generated with a [[CSPRNG]] (Cryptographically Secure Pseudo-Random Number Generator) compliant with {{nowrap|[https://csrc.nist.gov/pubs/sp/800/90/a/r1/final NIST SP 800-90A].}}{{efn|name="rdrand_retry"|The <code>RDRAND</code> and <code>RDSEED</code> instructions may fail to obtain and return a random number if the CPU's random number generators cannot keep up with the issuing of these instructions – if this happens, then software may retry the instructions (although the number of retries should be limited, in order to ensure forward progress<ref>Intel, [https://www.intel.com/content/dam/develop/external/us/en/documents/drng-software-implementation-guide-2-1-185467.pdf Digital Random Number Generator (DRNG) Software Implementation Guide] rev 2.1, oct 17, 2018, sections 5.2 and 5.3. [https://web.archive.org/web/20211119132426/https://www.intel.com/content/dam/develop/external/us/en/documents/drng-software-implementation-guide-2-1-185467.pdf Archived] on nov 19, 2021.</ref>). The instructions set <code>[[FLAGS register|EFLAGS]].CF</code> to 1 if a random number was successfully obtained and 0 otherwise. For <code>RDSEED</code>, failure to obtain a random number will also set the instruction's destination register to 0.}}
| rowspan="2" | [[Ivy Bridge (microarchitecture)|Ivy Bridge]],<br />[[Silvermont]],<br />[[Excavator (microarchitecture)|Excavator]],<br />[[Puma (microarchitecture)|Puma]],<br />[[Zhaoxin|ZhangJiang]],<br />{{nowrap|[[Xeon Phi|Knights Landing]],}}
|-
| {{nowrap|<code>RDRAND r64</code>}}
| {{nowrap|<code>NFx REX.W 0F C7 /6</code>}}
|-
| <code>RDSEED r16</code><br /><code>RDSEED r32</code>
| <code>NFx 0F C7 /7</code>
| rowspan="2" | Return a random number that has been generated with a [[Hardware random number generator|HRNG/TRNG]] (Hardware/"True" Random Number Generator) compliant with {{nowrap|[https://csrc.nist.gov/pubs/sp/800/90/b/final NIST SP 800-90B] and [https://csrc.nist.gov/pubs/sp/800/90/c/3pd C].}}{{efn|name="rdrand_retry"}}
| rowspan="2" | [[Broadwell (microarchitecture)|Broadwell]],<br />[[Zhaoxin|ZhangJiang]],<br />{{nowrap|[[Xeon Phi|Knights Landing]],}}<br />[[Zen (first generation)|Zen 1]],<br />[[Gracemont (microarchitecture)|Gracemont]]
|-
| {{nowrap|<code>RDSEED r64</code>}}
| {{nowrap|<code>NFx REX.W 0F C7 /7</code>}}
|}
{{notelist}}

== Intel SHA and SM3 instructions ==
{{Main|Intel SHA extensions}}
These instructions provide support for cryptographic hash functions such as SHA-1, SHA-256, SHA-512 and SM3. Each of these hash functions works on fixed-size data blocks, where the processing of each data-block mostly consists of two major phases:
* First expand the data-block using a ''message schedule'' (that is specific to each hash function)
* Then perform a series of ''rounds'' of a compression function to combine the expanded data into a hash ''state''.
For each of the supported hash functions, separate instructions are provided to help compute the message schedule and to help perform the compression function rounds.
{| class="wikitable sortable"
! Hash function extension
! Instructions
! Encoding{{efn|Under Intel APX, none of the SHA-NI/SHA512/SM3 instructions can be encoded with the EVEX prefix - this prevents the use of the <code>r16-r31</code> and <code>xmm16-xmm31</code> registers with these instructions.}}
! Description
! Added in
|-
| rowspan=8 | {{glossary}}{{term|SHA-NI}}{{defn|Secure Hash Algorithm: [[SHA-1]] and [[SHA-256]]}}{{glossary end}}
| {{nowrap|<code>SHA1RNDS4 xmm1,xmm2/m128,imm8</code>}}
| {{nowrap|<code>NP 0F 3A CC /r ib</code>}}
| Perform Four Rounds of SHA-1 Operation
| rowspan=8 | [[Goldmont]],<br/>[[Zen (first generation)|Zen 1]],<br/>{{nowrap|[[Cannon Lake (microprocessor)|Cannon Lake]],}}<br/>[[Zhaoxin|LuJiaZui]],<br/>[[Rocket Lake]]
|-
| <code>SHA1NEXTE xmm1,xmm2/m128</code>
| <code>NP 0F 38 C8 /r</code>
| Calculate SHA-1 State Variable E after Four Rounds
|-
| <code>SHA1MSG1 xmm1,xmm2/m128</code>
| <code>NP 0F 38 C9 /r</code>
| Perform an Intermediate Calculation for the Next Four SHA-1 Message Dwords
|-
| <code>SHA1MSG2 xmm1,xmm2/m128</code>
| <code>NP 0F 38 CA /r</code>
| Perform a Final Calculation for the Next Four SHA-1 Message Dwords
|-
! colspan=3 |
|-
| <code>SHA256RNDS2 xmm1,xmm2/m128,<XMM0></code>
| <code>NP 0F 38 CB /r</code>
| Perform Two Rounds of SHA256 Operation
|-
| <code>SHA256MSG1 xmm1,xmm2/m128</code>
| <code>NP 0F 38 CC /r</code>
| Perform an Intermediate Calculation for the Next Four SHA-256 Message Dwords
|-
| <code>SHA256MSG2 xmm1,xmm2/m128</code>
| <code>NP 0F 38 CD /r</code>
| Perform a Final Calculation for the Next Four SHA-256 Message Dwords
|-
! colspan=5 |
|-
| rowspan=3 | {{glossary}}{{term|SHA512}}{{defn|Secure Hash Algorithm: [[SHA-512]]}}{{glossary end}}
| <code>VSHA512RNDS2 ymm1,ymm2,xmm3</code>
| {{small|<code>VEX.256.F2.0F38.W0 CB /r</code>}}
| Perform Two Rounds of SHA-512 operation
| rowspan=3 | [[Lunar Lake]],<br/>[[Arrow Lake (microprocessor)|Arrow Lake]]
|-
| <code>VSHA512MSG1 ymm1,xmm2</code>
| {{small|<code>VEX.256.F2.0F38.W0 CC /r</code>}}
| Perform an Intermediate Calculation for the Next Four SHA-512 Message Qwords
|-
| <code>VSHA512MSG2 ymm1,ymm2</code>
| {{small|<code>VEX.256.F2.0F38.W0 CD /r</code>}}
| Perform a Final Calculation for the Next Four SHA-512 Message Qwords
|-
! colspan=5 |
|-
| rowspan=3 | {{glossary}}{{term|SM3}}{{defn|[[SM3 (hash function)|ShangMi 3]] hash function}}{{glossary end}}
| {{nowrap|<code>VSM3RNDS2 xmm1,xmm2,xmm3/m128,imm8</code>}}
| {{nowrap|{{small|<code>VEX.128.66.0F3A.W0 DE /r ib</code>}}}}
| Perform Two Rounds of SM3 Operation
| rowspan=3 | [[Lunar Lake]],<br/>[[Arrow Lake (microprocessor)|Arrow Lake]]
|-
| <code>VSM3MSG1 xmm1,xmm2,xmm3/m128</code>
| {{small|<code>VEX.128.NP.0F38.W0 DA /r</code>}}
| Perform Initial Calculation for the Next Four SM3 Message Words
|-
| <code>VSM3MSG2 xmm1,xmm2,xmm3/m128</code>
| {{small|<code>VEX.128.66.0F38-W0 DA /r</code>}}
| Perform Final Calculation for the Next Four SM3 Message Words
|}
{{notelist}}

== Intel Key Locker instructions ==
These instructions, available in [[Tiger Lake]] and later Intel processors, are designed to enable encryption/decryption with an AES key without having access to any unencrypted copies of the key during the actual encryption/decryption process.
{| class="wikitable sortable"
! Key Locker subset
! Instruction
! Encoding{{efn|Under Intel APX, none of the Key Locker instructions can be encoded with the EVEX prefix - this prevents the use of the <code>r16-r31</code> and <code>xmm16-xmm31</code> registers with these instructions.}}
! colspan=2 | Description
|-
| {{glossary}}{{term|KL}}{{defn|Key Locker common instructions.}}{{glossary end}}
| <code>LOADIWKEY xmm1,xmm2</code>
| {{nowrap|<code>F3 0F 38 DC /r</code>}}
| colspan=2 | Load internal wrapping key ("IWKey") from xmm1, xmm2 and <code>XMM0</code>.

The two explicit operands (which must be register operands) specify a 256-bit encryption key. The implicit operand in <code>XMM0</code> specifies a 128-bit integrity key. <code>EAX</code> contains flags controlling operation of instruction.{{efn|text=The flags available for the <code>LOADIWKEY</code> instruction in the EAX register are:
{{(!}} class="wikitable sortable"
! Bits !! Flags
{{!}}-
{{!}} 0 {{!!}} 1=Do not permit the wrapping key to be backed up to platform-scoped storage
{{!}}-
{{!}} 4:1 {{!!}} KeySource field. The following values are supported:
* 0: use key input operands directly
* 1: XOR the key input operands with 384 bits from hardware RNG
{{!}}-
{{!}} 31:5 {{!!}} {{n/a|align="left"|Reserved, must be set to 0}}
{{!)}}
}}
After being loaded, the IWKey cannot be directly read from software, but is used for the key wrapping done by <code>ENCODEKEY128/256</code> and checked by the Key Locker encode/decode instructions.

<code>LOADIWKEY</code> is privileged and can run in Ring 0 only.
|-
! colspan=5 |
|-
| rowspan=7 | {{glossary}}{{term|AESKLE}}{{defn|AES Key Locker instructions.}}{{glossary end}}

| <code>ENCODEKEY128 r32,r32</code>
| <code>F3 0F 38 FA /r</code>
| Wrap a 128-bit AES key from <code>XMM0</code> into a 384-bit key handle - and output this handle to <code>XMM0-2</code>.
| rowspan=2 | Source operand specifies handle restrictions to build into the handle.{{efn|text=The handle restrictions available for the explicit source argument to <code>ENCODEKEY128</code> and <code>ENCODEKEY256</code> are:
{{(!}} class="wikitable sortable"
! Bits !! Flags
{{!}}-
{{!}} 0 {{!!}} CPL0-only restriction
{{!}}-
{{!}} 1 {{!!}} No-encrypt restriction
{{!}}-
{{!}} 2 {{!!}} No-decrypt restriction
{{!}}-
{{!}} 31:3 {{!!}} {{n/a|align="left"|Reserved, must be set to 0}}
{{!)}}
}}

Destination operand is initialized with information about the source and attributes of the key (this matches the value that was provided in EAX for the most recent invocation of <code>LOADIWKEY</code>)

These instructions may also modify <code>XMM4-6</code> (zeroed out in existing implementations, but this should not be relied on).
|-
| <code>ENCODEKEY256 r32,r32</code>
| <code>F3 0F 3A FB /r</code>
| Wrap a 256-bit AES key from <code>XMM1:XMM0</code> into a 512-bit key handle - and output this handle to <code>XMM0-3</code>.
|-
! colspan=4 |
|-
| <code>AESENC128KL xmm,m384</code>
| <code>F3 0F 38 DC /r</code>
| colspan=2 | Encrypt xmm using 128-bit AES key indicated by handle at <code>m384</code> and store result in xmm.{{efn|name=aes_kl_check|text=All of the AES Key Locker encode/decode instructions will check whether the handle is valid for the current IWKey and encode/decode data only if the handle is valid. These instructions will set the ZF flag to indicate whether the provided handle was valid (ZF=0) or not (ZF=1).}}
|-
| {{nowrap|<code>AESDEC128KL xmm,m384</code>}}
| <code>F3 0F 38 DD /r</code>
| colspan=2 | Decrypt xmm using 128-bit AES key indicated by handle at <code>m384</code> and store result in xmm.{{efn|name=aes_kl_check}}
|-
| <code>AESENC256KL xmm,m512</code>
| <code>F3 0F 38 DE /r</code>
| colspan=2 | Encrypt xmm using 256-bit AES key indicated by handle at <code>m512</code> and store result in xmm.{{efn|name=aes_kl_check}}
|-
| <code>AESDEC256KL xmm,m512</code>
| <code>F3 0F 38 DF /r</code>
| colspan=2 | Decrypt xmm using 256-bit AES key indicated by handle at <code>m512</code> and store result in xmm.{{efn|name=aes_kl_check}}
|-
! colspan=5 |
|-
| rowspan=4 | {{glossary}}{{term|AESKLE+WIDE_KL}}{{defn|AES Wide Key Locker instructions.<p>Perform encryption or decryption for eight 128-bit AES blocks at once.</p>}}{{glossary end}} 
| <code>AESENCWIDE128KL m384</code>
| <code>F3 0F 38 D8 /0</code>
| colspan=2 | Encrypt <code>XMM0-7</code> using 128-bit AES key indicated by handle at <code>m384</code> and store each resultant block back to its corresponding register.{{efn|name=aes_kl_check}}
|-
| {{nowrap|<code>AESDECWIDE128KL m384</code>}}
| <code>F3 0F 38 D8 /1</code>
| colspan=2 | Decrypt <code>XMM0-7</code> using 128-bit AES key indicated by handle at <code>m384</code> and store each resultant block back to its corresponding register.{{efn|name=aes_kl_check}}
|-
| <code>AESENCWIDE256KL m512</code>
| <code>F3 0F 38 D8 /2</code>
| colspan=2 | Encrypt <code>XMM0-7</code> using 256-bit AES key indicated by handle at <code>m512</code> and store each resultant block back to its corresponding register.{{efn|name=aes_kl_check}}
|-
| <code>AESDECWIDE256KL m512</code>
| <code>F3 0F 38 D8 /3</code>
| colspan=2 | Decrypt <code>XMM0-7</code> using 256-bit AES key indicated by handle at <code>m512</code> and store each resultant block back to its corresponding register.{{efn|name=aes_kl_check}}
|}
{{notelist}}

== VIA/Zhaoxin PadLock instructions ==
{{Main|VIA PadLock}}
The VIA/Zhaoxin PadLock instructions are instructions designed to apply cryptographic primitives in bulk, similar to the 8086 repeated string instructions. As such, unless otherwise specified, they take, as applicable, pointers to source data in ES:rSI and destination data in ES:rDI, and a data-size or count in rCX. Like the old string instructions, they are all designed to be interruptible.<ref name="padlock_consolidated">VIA, [https://web.archive.org/web/20100526054140/http://linux.via.com.tw/support/beginDownload.action?eleid=181&fid=261 PadLock Programming Guide], rev 1.66, 4 Aug 2005. Archived from the [http://linux.via.com.tw/support/beginDownload.action?eleid=181&fid=261 original] on 26 May 2010.</ref><ref name="zhaoxin_padlock" />
{| class="wikitable sortable"
! PadLock subset !! Instruction mnemonics{{efn|text=For instruction mnemonics that are listed with a hyphen, different VIA PadLock documents differ with respect to whether the instruction names have a hyphen or not (e.g. version 1.0 of the ACE programming guide uses the hyphens,<ref name="padlock_ace">VIA, [https://web.archive.org/web/20040917033315/http://www.via.com.tw/en/downloads/whitepapers/initiatives/padlock/ace_prog_guide.pdf Nehemiah Advanced Cryptography Engine Programming Guide], v1.0, 2004. Archived from the [http://www.via.com.tw/en/downloads/whitepapers/initiatives/padlock/ace_prog_guide.pdf original] on 17 Sep 2004.</ref> while v1.66 does not.<ref name="padlock_consolidated"/>) and assemblers may accept instruction mnemonics with or without the hyphen - e.g. [[GNU Binutils]] rev 2.17 and later accepts both.<br/>Some assemblers may also consider the <code>REP</code> prefix optional for instructions other than <code>XSTORE</code> - with such assemblers, the PadLock instructions will be assembled with one <code>F3</code> (<code>REP</code>) prefix byte regardless of whether the assembly instruction is written with <code>REP</code> or not. (The <code>F3</code> prefix is mandatory for all PadLock instructions except <code>XSTORE</code>.)}} !! Encoding !! Description !! Added in
|-
! colspan="5" |
|-
| rowspan="4" | {{glossary}}{{term|RNG}}{{defn|Random Number Generation.}}{{glossary end}}
| <code>XSTORE</code>,<br/><code>XSTORE-RNG</code>
| {{nowrap|<code>NFx 0F A7 C0</code>}}
| rowspan="4" | Store random bytes to ES:[rDI], and increment ES:rDI accordingly. <code>XSTORE</code> will store currently-available bytes, which may be from 0 to 8 bytes. <code>REP XSTORE</code> and <code>REP XRNG2</code> will write the number of random bytes specified by rCX, waiting for the random number generator when needed.{{efn|On some processors that support PadLock, the {{nowrap|<code>REP XSTORE</code>}} instruction (but not {{nowrap|<code>REP XRNG2</code>}}) may write not just the number of bytes specified in ECX, but up to 7 additional bytes as well.<ref>VIA, [https://web.archive.org/web/20040917024652/http://www.via.com.tw/en/downloads/whitepapers/initiatives/padlock/rng_prog_guide.pdf Nehemiah Random Number Generator Programming Guide], v1.0, 2003, page 9. Archived from the [http://www.via.com.tw/en/downloads/whitepapers/initiatives/padlock/rng_prog_guide.pdf original] on 17 Sep 2004.</ref>}} EDX specifies a "quality factor".{{efn|text=For the {{nowrap|<code>REP XRNG2</code>}} instruction, bits 1:0 of EDX are used to indicate whether the instruction should return hardware random numbers directly (EDX[1:0]==0) or return postprocessed numbers (EDX[1:0] ≠ 0).}}
| rowspan="2" | [[VIA C3|Nehemiah]]<br />{{nowrap|(stepping 3)}}
|-
| <code>REP XSTORE</code>,<br/>{{nowrap|<code>REP XSTORE-RNG</code>}}
| {{nowrap|<code>F3 0F A7 C0</code>}}
|-
! colspan="2" | !!
|-
| <code>REP XRNG2</code>
| <code>F3 0F A7 F8</code>
| [[Zhaoxin|ZhangJiang]]{{efn|name=zx_padlock|1=As of 2024, the {{nowrap|<code>REP XRNG2</code>}}, {{nowrap|<code>REP XSHA384</code>}}, {{nowrap|<code>REP XSHA512</code>}}, {{nowrap|<code>REP MONTMUL2</code>}} and {{nowrap|<code>REP XMODEXP</code>}} instructions exist as documented instructions only on Zhaoxin processors.<ref name="zhaoxin_padlock">Binutils mailing list, [https://marc.info/?l=binutils&m=173406021717771&w=2 (PATCH v1) x86: Support ZHAOXIN padlock instructions], 13 Dec 2024, see "padlock instruction set reference.pdf" attachment for Zhaoxin-provided documentation of the PadLock instructions. [https://web.archive.org/web/20241219213052/https://marc.info/?l=binutils&m=173406021717771&w=2 Archived] on 19 Dec 2024; attachment [https://web.archive.org/web/20241219212325/https://marc.info/?l=binutils&m=173406021717771&q=p3 archived] on 19 Dec 2024.</ref><br/>A VIA-provided OpenSSL patch from 2011<ref>openssl-dev mailing list, [https://marc.info/?l=openssl-dev&m=130767391615291&w=2 (PATCH) Update PadLock engine for VIA C7 and Nano CPUs], 10 Jun 2011. [https://web.archive.org/web/20220130225231/https://marc.info/?l=openssl-dev&m=130767391615291&w=2 Archived] on 30 Jan 2022.</ref> indicates that these instructions were present on the [[VIA Nano]], however VIA has not published documentation for these instructions.}}
|-
! colspan="5" |
|-
| rowspan="4" | {{glossary}}{{term|ACE}}{{defn|Advanced Cryptography Engine.}}{{glossary end}}
| <code>REP XCRYPT-ECB</code>
| <code>F3 0F A7 C8</code>
| rowspan="6" | Encrypt/Decrypt data, using the [[Advanced Encryption Standard|AES]] cipher in various [[Block cipher mode of operation|block modes]] (ECB, CBC, CFB, OFB and CTR, respectively). rCX contains the number of 16-byte blocks to encrypt/decrypt, rBX contains a pointer to an encryption key, ES:rAX a pointer to an initialization vector for block modes that need it, and ES:rDX a pointer to a control word.{{efn|text=The control word for <code>REP XCRYPT*</code> is a 16-byte (128-bit) data structure with the following layout:
{{(!}} class="wikitable sortable"
! Bits !! Usage
{{!}}-
{{!}} 3:0 {{!!}} AES round count
{{!}}-
{{!}} 4 {{!!}} Digest mode enable (ACE2 only)
{{!}}-
{{!}} 5 {{!!}} 1=allow data that are not 16-byte aligned (ACE2 only)
{{!}}-
{{!}} 6 {{!!}} Cipher: 0=AES, 1=undefined
{{!}}-
{{!}} 7 {{!!}} [[AES key schedule|Key schedule]]: 0=compute (128-bit key only), 1=load from memory
{{!}}-
{{!}} 8 {{!!}} 0=normal, 1=intermediate-result
{{!}}-
{{!}} 9 {{!!}} 0=encrypt, 1=decrypt
{{!}}-
{{!}} 11:10 {{!!}} Key size: {{nowrap|1=00=128-bit,}} {{nowrap|1=01=192-bit,}} {{nowrap|1=10=256-bit,}} 11=reserved
{{!}}-
{{!}} 127:12 {{!!}} Reserved, must be set to 0
{{!)}}If bit 5 is set in order to allow unaligned data, then the <code>REP XCRYPT*</code> instructions will use the 112 bytes directly after the control word as a scratchpad memory area for data realignment.}}
| rowspan="4" | [[VIA C3|Nehemiah]]<br />{{nowrap|(stepping 8)}}
|-
| {{nowrap|<code>REP XCRYPT-CBC</code>}}
| <code>F3 0F A7 D0</code>
|-
| <code>REP XCRYPT-CFB</code>
| <code>F3 0F A7 E0</code>
|-
| <code>REP XCRYPT-OFB</code>
| <code>F3 0F A7 E8</code>
|-
! colspan="3" | !!
|-
| {{glossary}}{{term|ACE2{{efn|text=In addition to the new {{nowrap|<code>REP XCRYPT-CTR</code>}} instruction, ACE2 also adds extra features to the other <code>REP XCRYPT</code> instructions: a digest mode for the CBC and CFB instructions, and the ability to use input/output data that are not 16-byte aligned for the non-ECB instructions.}}}}{{glossary end}}
| <code>REP XCRYPT-CTR</code>
| <code>F3 0F A7 D8</code>
| {{nowrap|[[VIA C7|C7 "Esther"]]<ref>Michal Ludvig, [https://www.linuxjournal.com/article/8042 VIA PadLock—Wicked Fast Encryption], ''Linux Journal'', Apr 6, 2005. [https://web.archive.org/web/20050620010837/http://www.linuxjournal.com/article/8042 Archived] on Jun 20, 2005.</ref>}}
|-
! colspan="5" |
|-
| rowspan="5" | {{glossary}}{{term|PHE}}{{defn|Hash Engine.}}{{glossary end}}
| <code>REP XSHA1</code>
| <code>F3 0F A6 C8</code>
| rowspan="2" | Compute a cryptographic hash (using the [[SHA-1]] and [[SHA-256]] functions, respectively). ES:rSI points to data to compute a hash for, ES:rDI points to a message digest and rCX specifies the number of bytes. rAX should be set to 0 at the start of a calculation.{{efn|text=On [[VIA Nano]] and later processors, setting rAX to an all-1s value for the <code>REP XSHA*</code> instructions will enable an alternate operation mode, where rCX specifies the number of 64-byte blocks, and where the standard FIPS-180-2 length extension procedure at the end of the hash calculation is omitted. This makes for a variant more suitable for data streaming than the original EAX=0 variant.<ref>Stack Overflow, [https://stackoverflow.com/questions/21526677/streaming-sha-calculation-using-vias-padlock-hashing-engine Streaming SHA calculation using VIA's Padlock Hashing Engine?], Aug 11, 2014. [https://web.archive.org/web/20190614041905/https://stackoverflow.com/questions/21526677/streaming-sha-calculation-using-vias-padlock-hashing-engine Archived] on Jun 14, 2019.<br />The PadLock SDK (v3.1) referenced in the Stack Overflow answer can be downloaded from the [https://www.cryptopp.com/wiki/VIA_Padlock Crypto++ wiki] (accessed on Aug 11, 2023) or the [https://web.archive.org/web/20161023000717/https://www.cryptopp.com/w/images/3/3a/PadlockSDK_3.1_Release_20090121.zip Wayback Machine].</ref> This functionality also exists for <code>CCS_HASH</code>.<br />&nbsp;}}
| rowspan="2" | [[VIA C7|Esther]]
|-
| <code>REP XSHA256</code>
| <code>F3 0F A6 D0</code>
|-
! colspan="4" |
|-
| <code>REP XSHA384</code>
| <code>F3 0F A6 D8</code>
| rowspan="2" | Perform computation of a SHA-384/SHA-512 cryptographic hash. ES:rSI points to a series of 128-byte data chunks to perform hash computation for, ES:rDI points to a 64-byte digest to update, and ECX specifies the number of chunks to process.{{efn|The per-chunk calculation is identical for SHA-384 and SHA-512 - as a result of this, the {{nowrap|<code>REP XSHA384</code>}} and {{nowrap|<code>REP XSHA512</code>}} instructions perform identical operations.}}
| rowspan="2" | [[Zhaoxin|ZhangJiang]]{{efn|name=zx_padlock}}
|-
| <code>REP XSHA512</code>
| <code>F3 0F A6 E0</code>

|-
! colspan="5" |
|-
| rowspan="4" | {{glossary}}{{term|PMM}}{{defn|Montgomery/Modular Multiplication.}}{{glossary end}}
| <code>REP MONTMUL</code>
| {{nowrap|<code>F3 0F A6 C0</code>{{efn|The <code>REP MONTMUL</code> instruction is only supported with an AddressSize of 32 bits - for this reason, the address-size override prefix (<code>67h</code>) is required in 16-bit and 64-bit modes, but disallowed in 32-bit mode.}}}}
| Perform [[Montgomery modular multiplication|Montgomery Multiplication]]. Takes an operand width in ECX (given as a number of bits – must be in range 256..32768 and divisible by 128) and pointer to a data structure in ES:ESI.{{efn|text=The data structure to <code>REP MONTMUL</code> contains six 32-bit elements, where the first one is a negated [[modular inverse]] of the bottom 32 bits of the modulus and the remaining 5 are pointers to various memory buffers (each of which uses the ES segment and must be 16-byte aligned):
{{(!}} class="wikitable sortable"
! Offset !! Data item
{{!}}-
{{!}} 0 {{!!}} Negated modular inverse
{{!}}-
{{!}} 4 {{!!}} Pointer to first multiplicand
{{!}}-
{{!}} 8 {{!!}} Pointer to second multiplicand
{{!}}-
{{!}} 12 {{!!}} Pointer to result buffer
{{!}}-
{{!}} 16 {{!!}} Pointer to modulus
{{!}}-
{{!}} 20 {{!!}} Pointer to 32-byte scratchpad
{{!)}} }}
When starting a new Montgomery Multiplication, EAX and the result buffer in memory must be filled with all-0s before executing the <code>REP MONTMUL</code> instruction. (Nonzero values are used to help resume the calculation if the instruction was interrupted.)
| [[VIA C7|Esther]]
|-
! colspan="4" |
|-
| <code>REP MONTMUL2</code>
| <code>F3 0F A6 F0</code>
| rowspan="2" | Perform modular multiplication/exponentiation. Takes pointers (all using the ES: segment) to bignum integers {{tmath|A, B, M, R}} in registers rAX, rBX, rDX, rDI, respectively, where {{tmath|A}} and {{tmath|B}} are input numbers, {{tmath|M}} is a modulus,{{efn|For <code>REP MONTMUL2</code> and <code>REP XMODEXP</code>, the modulus {{tmath|M}} is required to be greater than both {{tmath|A}} and {{tmath|B}}, and is also required to be odd. The instructions will produce a #GP exception if this is not the case.}} and {{tmath|R}} will be overwritten with the result. The operation performed is:
* <code>REP MONTMUL2</code>: <math>R:=\left(A * B\right)\text{ mod }M</math>
* <code>REP XMODEXP</code>: <math>R:=\left(A^{B}\right)\text{ mod }M</math>
ECX provides the size of the bignums, in number of bits (256..32768, must be divisble by 128), and ES:rSI provides a pointer to a scratchpad area to use during the calculation.{{efn|1=Given a bignum size of N bits, the scratchpad memory area pointed to by ES:rSI for the {{nowrap|<code>REP MONTMUL2</code>}} and {{nowrap|<code>REP XMODEXP</code>}} must have a size of at least <math>3 * (N/8) + 40</math> bytes (e.g. for a 2048-bit bignum size, the scratchpad must be at least 808 bytes). Also, before starting either of these instructions, the 8 first bytes of this scratchpad must be zeroed out and the bignum size given in ECX must also be written as a 64-bit integer to the next 8 bytes.}}
| rowspan="2" | [[Zhaoxin|ZhangJiang]]{{efn|name=zx_padlock}}
|-
| <code>REP XMODEXP</code>
| <code>F3 0F A6 F8</code>
|-
! colspan="5" |
|-
| rowspan="3" | {{glossary}}{{term|GMI<ref name="zhaoxin_gmi">Zhaoxin, [https://www.zhaoxin.com/prodshow_view.aspx?id=483&nid=31&typeid=63&IsActiveTarget=True Core Technology | Instructions for the use of accelerated instructions for national encryption algorithm based on Zhaoxin processor] (in Chinese), 8 Aug 2020. [https://web.archive.org/web/20220105165938/https://www.zhaoxin.com/prodshow_view.aspx?id=483&nid=31&typeid=63&IsActiveTarget=True Archived] on Jan 5, 2022.</ref><ref name="zhaoxin_gmi2">Zhaoxin, [https://github.com/ZXOpenSource/OpenSSL-ZX-GMI/blob/63e8835e1854042ac949a04eb87c604cb1d7d5ea/GMI%20User%20Manual%20V1.0.pdf GMI User Manual v1.0] (in Chinese), 23 May 2016. [https://web.archive.org/web/20220228071045/https://raw.githubusercontent.com/ZXOpenSource/OpenSSL-ZX-GMI/master/GMI%20User%20Manual%20V1.0.pdf Archived] on Feb 28, 2022.</ref><ref name="zhaoxin_gmi3">Zhaoxin, [https://www.zhaoxin.com/prodshow_view.aspx?nid=31&typeid=63&id=477 Research on hardware acceleration and application of national cryptographic algorithms based on Zhaoxin CPU] (in Chinese), 3 Sep 2019. [https://web.archive.org/web/20200811210543/https://www.zhaoxin.com/prodshow_view.aspx?nid=31&typeid=63&id=477 Archived] on 11 Aug 2020.</ref>}}{{defn|Chinese national cryptographic algorithms. ([[Zhaoxin]] only.)}}{{glossary end}}
| <code>CCS_HASH</code>,<br/><code>CCS_SM3</code>{{efn|name=zhaoxin_multi|text=The CCS instructions are listed with different mnemonics in different Zhaoxin sources - e.g. the <code>CCS_SM3</code>/<code>CCS_SM4</code> mnemomics are used in a 2019 article,<ref name="zhaoxin_gmi3"/> while <code>CCS_HASH</code>/<code>CCS_ENCRYPT</code> are used in a 2020 article.<ref name="zhaoxin_gmi"/>}}
| <code>F3 0F A6 E8</code>
| Compute [[SM3 (hash function)|SM3]] hash, similar to the <code>REP XSHA*</code> instructions. The rBX register is used to specify hash function (<code>20h</code> for SM3 being the only documented value).
| rowspan="2" | [[Zhaoxin|ZhangJiang]]
|-
| <code>CCS_ENCRYPT</code>,<br/><code>CCS_SM4</code>{{efn|name=zhaoxin_multi}}
| <code>F3 0F A7 F0</code>
| Encrypt/Decrypt data, using the [[SM4 (cipher)|SM4]] cipher in various [[Block cipher mode of operation|block modes]]. rCX contains the number of 16-byte blocks to encrypt/decrypt, rBX contains a pointer to an encryption key, rDX a pointer to an initialization vector for block modes that need it, and rAX contains a control word.{{efn|text=The <code>CCS_ENCRYPT</code> control word in rAX has the following format:
{{(!}} class="wikitable sortable"
! Bits !! Usage
{{!}}-
{{!}} 0 {{!!}} 0=Encrypt, 1=Decrypt
{{!}}-
{{!}} 5:1 {{!!}} Must be 10000b for SM4.
{{!}}-
{{!}} 6 {{!!}} ECB [[Block cipher mode of operation|block mode]]
{{!}}-
{{!}} 7 {{!!}} CBC block mode
{{!}}-
{{!}} 8 {{!!}} CFB block mode
{{!}}-
{{!}} 9 {{!!}} OFB block mode
{{!}}-
{{!}} 10 {{!!}} CTR block mode
{{!}}-
{{!}} 11 {{!!}} Digest enable
{{!)}}
Remaining bits in rAX must be set to all-0s.

Of bits 10:6 in rAX (block mode selection), exactly one bit must be set, or else behavior is undefined.}}
|-
| <code>SM2</code><ref>Binutils mailing list, [https://marc.info/?l=binutils&m=172887210304790&w=2 (PATCH v1) x86: Support ZHAOXIN GMI instructions], 14 Oct 2024, see "ZX_GMI_Reference.docx" attachment for Zhaoxin-provided documentation of the <code>SM2</code> instruction. [https://web.archive.org/web/20241109111246/https://marc.info/?l=binutils&m=172887210304790&w=2 Archived] on 9 Nov 2024; attachment [https://web.archive.org/web/20241109111332/https://marc.info/?l=binutils&m=172887210304790&q=p3 archived] on 9 Nov 2024.</ref>
| <code>F2 0F A6 C0</code>
| Perform [[SM9 (cryptography standard)|SM2]] (public key cryptographic algorithm) function. The function to perform is specified in bits 5:0 of EDX{{efn|text=The supported functions in bits 5:0 of EDX for the <code>SM2</code> instruction are:
{{(!}} class="wikitable sortable"
! Value !! Meaning
{{!}}-
{{!}} 0x01 {{!!}} Encryption
{{!}}-
{{!}} 0x02 {{!!}} Decryption
{{!}}-
{{!}} 0x04 {{!!}} Signature
{{!}}-
{{!}} 0x08 {{!!}} Verify signature
{{!}}-
{{!}} 0x10 {{!!}} Key exchange 1
{{!}}-
{{!}} 0x11 {{!!}} Key exchange 2 without hash
{{!}}-
{{!}} 0x12 {{!!}} Key exchange 3 without hash
{{!}}-
{{!}} 0x15 {{!!}} Key exchange 2 with hash
{{!}}-
{{!}} 0x16 {{!!}} Key exchange 3 with hash
{{!}}-
{{!}} 0x20 {{!!}} Preprocess1 to calculate hash value Z of user’s identification
{{!}}-
{{!}} 0x21 {{!!}} Preprocess2 to calculate hash value e of hash value Z and message M
{{!)}}

}} - depending on function, rAX/rBX/rCX/rSI/rDI may provide additional input arguments. The instruction returns a status bit in EDX bit 6 (0=success, 1=failure) - depending on function, rAX, rCX and rDI may be modified as well.
| [[Zhaoxin|KX-6000G]]
|}

== Footnotes ==
{{notelist|22em}}

== References ==
{{reflist}}

[[Category:x86 instructions]]