Cryptography is everywhere — TLS, disk encryption, secure boot, signatures — and doing it in pure software is both slow and dangerously prone to side-channel leaks. RISC-V addresses this with dedicated cryptography extensions: scalar crypto (the Zk family) and a vector crypto extension. This guide explains what they add and why they matter for security.
Why Crypto Needs Hardware Help
Two problems with software-only cryptography:
- Speed — algorithms like AES and SHA are computationally heavy; software implementations are far slower than dedicated instructions.
- Side channels — naive software can leak key bits through timing: if the runtime depends on secret data (e.g. table lookups whose cache behavior varies), an attacker can infer the key. Writing constant-time crypto by hand is notoriously hard.
Hardware crypto instructions solve both: they are fast and specified to run in constant time, closing timing side channels by design. This complements the broader RISC-V security and isolation story.
Scalar Cryptography: The Zk Family
The scalar crypto extensions add instructions usable on the normal integer registers. They are grouped under the Zk umbrella, with focused sub-extensions:
- Zkne / Zknd — AES encryption and decryption rounds
- Zknh — SHA-2 and SHA-3 hash acceleration
- Zkr — a standardized entropy source for generating true random numbers (seeds for keys)
- Zbkb / Zbkc / Zbkx — bit-manipulation and carry-less multiply helpers that crypto code leans on
- Zk / Zkn / Zks — convenience bundles that pull the above together
So a chip advertising Zk gives you a complete scalar crypto toolkit. As extensions, these are modular: a tiny embedded part can add just AES, while a larger SoC takes the full set.
The Entropy Source (Zkr)
Good cryptography needs good randomness, and software cannot manufacture true entropy. Zkr standardizes access to a hardware entropy source via a CSR, so operating systems and libraries have a portable, vendor-neutral way to seed their random-number generators. A standardized interface here is a big deal — it means the same kernel code gets quality entropy across different RISC-V hardware.
Vector Cryptography
For bulk cryptographic work — encrypting large volumes of data, as a server or storage system does — RISC-V adds a vector crypto extension built on the Vector extension (RVV). It processes many blocks in parallel using the vector unit, delivering far higher throughput than scalar instructions. This is what you want for line-rate disk encryption, VPN gateways, and TLS termination at scale.
A Conceptual Example
Without crypto instructions, an AES round is dozens of table lookups and XORs in software. With the scalar extension it collapses to a handful of dedicated instructions:
# Conceptual: one AES encryption round step using the scalar crypto extension
aes64es a0, a0, a1 # AES final-round encrypt step (illustrative)
aes64esm a0, a0, a1 # AES middle-round encrypt with MixColumns
# ... far fewer instructions, constant-time, no secret-dependent table lookupsThe result is faster and free of the cache-timing side channels that plague table-driven software AES.
Where This Matters
Hardware crypto touches nearly every serious use of RISC-V:
- Secure boot and roots of trust — verifying firmware signatures (think OpenTitan-style designs from lowRISC).
- Confidential computing — fast memory/VM encryption for protected workloads.
- TLS and networking — encrypting traffic at scale on servers and gateways.
- IoT — even tiny embedded devices can do real crypto without a huge performance hit.
- Post-quantum readiness — bit-manipulation and vector primitives help accelerate emerging PQC algorithms.
A Word on Profiles
As with all RISC-V capabilities, the question “is it present?” is answered by profiles and platform specs. Security-conscious platforms increasingly require the crypto extensions, so software can rely on them rather than carrying slow fallbacks. Always check your target’s extension list before assuming hardware AES is available.
The Bottom Line
RISC-V brings cryptography into the hardware with two complementary tools: the scalar Zk family (AES, SHA-2/3, a standardized entropy source, and bit-manipulation helpers) and a vector crypto extension for high-throughput bulk encryption. Beyond raw speed, these instructions are constant-time by design, eliminating a whole class of timing side channels that bedevil software crypto. From secure boot on a microcontroller to line-rate encryption on a server, RISC-V crypto extensions make strong, fast, side-channel-resistant cryptography a first-class hardware feature.
Part of my RISC-V series. See also RISC-V security & confidential computing and extensions explained.
