VSM4KEY4

VSM4KEY4 computes four of SM4’s 32 round keys. SM4 derives them from the 128-bit key MK in a chain much like its rounds: the four key words are first XORed with fixed words FK[0] to FK[3], giving K[0] to K[3], and then

K[i+4] = K[i] ^ T'(K[i+1] ^ K[i+2] ^ K[i+3] ^ CK[i])

for i from 0 to 31, where K[i+4] is round key rk[i]. T’ passes each byte through the same S-box as the rounds of VSM4RNDS4, but then XORs the word only with itself rotated left by 13 and 23 bits. VSM4KEY4 takes K[i] to K[i+3] in its second operand and CK[i] to CK[i+3] in its third, a register or memory, and writes the next four, rk[i] to rk[i+3], to the first.

What software supplies#

• FK, before the first instruction. The XOR with FK is one VPXOR of the key with a constant.
• The 32 constants CK[i], four per instruction. They are fixed (byte j of CK[i] is (4i + j) times 7, modulo 256), but VSM4KEY4 does not generate them, as VSM3RNDS2 generates SM3’s; they come from a table of eight 16-byte rows, and the third operand can read each row from memory.
• Byte order. SM4 numbers bytes from the most significant, so a key loaded from memory is byte-swapped in each word first.

Eight VSM4KEY4s give all 32 round keys, each one’s result being the next one’s second operand, and each result is also directly the third operand of one VSM4RNDS4. Decryption uses the same keys in reverse order, rk[31] first, which takes reversing the dwords of each result and the order of the eight registers.

Wider forms#

Each 128-bit lane works alone, so the YMM form, and the EVEX form on ZMM, expand two or four keys at once; with the same key in every lane they compute the same schedule twice or four times over. The VEX forms need the SM4 extension (CPUID leaf 7, subleaf 1, EAX bit 2) and AVX, the EVEX forms AVX10 as well. Zen 5 has neither, and all ten of its recorded cases raised #UD. GCC 14 and Clang 23 provide _mm_sm4key4_epi32(k, ck) and the 256-bit form with -msm4.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cpuid_leaf(7, 1)[0] >> 2 & 1:
    fault(UD)                    # CPUID: no SM4
for i in range(VL // 128):  # each lane:
    a = ymm2.d[4 * i]      # the expansion's
    b = ymm2.d[4 * i + 1]  # four words,
    c = ymm2.d[4 * i + 2]  # the first in
    d = ymm2.d[4 * i + 3]  # dword 0
    for j in range(4):     # src3: four CK
        x = b ^ c ^ d ^ src3.d[4 * i + j]
        x = a ^ sm4_l_key(sm4_sub_word(x))
        ymm1.d[4 * i + j] = x  # the next
        a = b
        b = c
        c = d
        d = x
# ymm1 is zeroed from bit VL up

if not cpuid_leaf(7, 1)[0] >> 2 & 1:
    fault(UD)                    # CPUID: no SM4
if not cpuid_leaf(7, 1)[3] >> 19 & 1:
    fault(UD)                    # CPUID: no AVX10
for i in range(VL // 128):  # each lane:
    a = zmm2.d[4 * i]      # the expansion's
    b = zmm2.d[4 * i + 1]  # four words,
    c = zmm2.d[4 * i + 2]  # the first in
    d = zmm2.d[4 * i + 3]  # dword 0
    for j in range(4):     # src3: four CK
        x = b ^ c ^ d ^ src3.d[4 * i + j]
        x = a ^ sm4_l_key(sm4_sub_word(x))
        zmm1.d[4 * i + j] = x  # the next
        a = b
        b = c
        c = d
        d = x
# zmm1 is zeroed from bit VL up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

VEX forms

avx-type-6

EVEX forms

AVX512-E6

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VSM4KEY4, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SM4 instructions

• VSM4RNDS4