[147079] in cryptography@c2.net mail archive
[Cryptography] Stealthy Dopant-Level Hardware Trojans
daemon@ATHENA.MIT.EDU (Eugen Leitl)
Fri Sep 13 11:42:41 2013
X-Original-To: cryptography@metzdowd.com
Date: Fri, 13 Sep 2013 11:49:24 +0200
From: Eugen Leitl <eugen@leitl.org>
To: cypherpunks@al-qaeda.net, cryptography@randombit.net,
Cryptography List <cryptography@metzdowd.com>
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com
--===============2966211886709735695==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="F2rc8GbISOVMOZuT"
Content-Disposition: inline
--F2rc8GbISOVMOZuT
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
http://people.umass.edu/gbecker/BeckerChes13.pdf
Stealthy Dopant-Level Hardware Trojans ?
Georg T. Becker1
, Francesco Regazzoni2
, Christof Paar1,3 , and Wayne P. Burleson1
1University of Massachusetts Amherst, USA
2TU Delft, The Netherlands and ALaRI - University of Lugano, Switzerland
3Horst ortz Institut for IT-Security, Ruhr-Universiat Bochum, Germany
Abstract.=20
In recent years, hardware Trojans have drawn the attention of governments a=
nd
industry as well as the scientific community. One of the main concerns is
that integrated circuits, e.g., for military or critical infrastructure
applications, could be maliciously manipulated during the manufacturing
process, which often takes place abroad. However, since there have been no
reported hardware Trojans in practice yet, little is known about how such a
Trojan would look like, and how dicult it would be in practice to implement
one.
In this paper we propose an extremely stealthy approach for implementing
hardware Trojans below the gate level, and we evaluate their impact on the
security of the target device. Instead of adding additional circuitry to the
target design, we insert our hardware Trojans by changing the dopant polari=
ty
of existing transistors. Since the modified circuit appears legitimate on a=
ll
wiring layers (including all metal and polysilicon), our family of Trojans =
is
resistant to most detection techniques, including fine-grain optical
inspection and checking against "golden chips". We demonstrate the
ectiveness of our approach by inserting Trojans into two designs | a digital
post-processing derived from Intel's cryptographically secure RNG design us=
ed
in the Ivy Bridge processors and a side-channel resistant SBox implementati=
on
and by exploring their detectability and their ects on security.
Keywords: Hardware Trojans, malicious hardware, layout modifications, Trojan
side-channel
--F2rc8GbISOVMOZuT
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJSMt+kAAoJEPRuNImsiU7FENYQAI3nerLFMnXnOsF+eqw2wkDW
iEmYf2IFQN7cNBF9v12Sr8XCdhBYOe8ODqL2izsPSKGMn02bZRGSZ1ch0r9j1jWD
X9DazRdHqR/Xsi9fyUemq/+jaUPSH+Ue4kPqdS1b0Ss55PfFUH4db1FZs3BTQQRN
99RhEoNiukZp9PjiWmnnjFIfaS8GKfzEevPsPvY3vHDCX8GyG4qaYODiY/BFUeCt
Z3rEiIXjeamPZ9pPHIqAlzYXpP5r0QPPw1ip6d476pJQ5sj7CZw4GgUJ6nyLbUzd
O2WuWfyFVHmWTdCK1fsR919kMAfB17fHkkKBlPyc0i272iKZWtpv1/V1o6VB0uCz
Vn7V0ijrU7jCCf2ZiWUjenSkAEzPbbZ9wk31J31xjBKgUpGUmlmx8yAQTx/+xnjk
XjkXlmBVjPog9bIJri0ZqmdCyoeblK+uTXoNXXLonRWdwEuorpAxZ8LuJKoRm/QR
Ze0oDYIk9QGgNu950wkiVC6BZngukdUxstTT+0LO0pkK3HfR3WNRvXH5vW7EyvSr
sbmDr6KpwL/bYGuNsbBFHlTr4cKjbk6EKuuTn8pqPRHcpR9IZ5UVWXFZ/YxfP3YM
TbIds1qcl6TsGE+gP/5/UzRPjz3EQo8UnvJxwAyS1MHxAFQtT6so3l6C5h7iWo1c
GB7VFl07mdyaxUj0tKvw
=+VKd
-----END PGP SIGNATURE-----
--F2rc8GbISOVMOZuT--
--===============2966211886709735695==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
--===============2966211886709735695==--
