  We describe a lightweight RISC-V ISA extension for AES and SM4 block ciphers.
Sixteen instructions (and a subkey load) is required to implement an AES round
with the extension, instead of 80 without. An SM4 step (quarter-round) has 6.5
arithmetic instructions, a similar reduction. Perhaps even more importantly the
ISA extension helps to eliminate slow, secret-dependent table lookups and to
protect against cache timing side-channel attacks. Having only one S-box, the
extension has a minimal hardware size and is well suited for ultra-low power
applications. AES and SM4 implementations using the ISA extension also have a
much-reduced software footprint. The AES and SM4 instances can share the same
data paths but are independent in the sense that a chip designer can implement
SM4 without AES and vice versa. Full AES and SM4 assembler listings, HDL source
code for instruction's combinatorial logic, and C code for emulation is
provided to the community under a permissive open source license. The
implementation contains depth- and size-optimized joint AES and SM4 S-Box logic
based on the Boyar-Peralta construction with a shared non-linear middle layer,
demonstrating additional avenues for logic optimization. The instruction logic
has been experimentally integrated into the single-cycle execution path of the
"Pluto" RV32 core and has been tested on an FPGA system.
