4 ms·

>> " Open source hardware can be manufactured cheaply (about 3 cents per processor) audited for NSA backdoors or vendor backdoors or decade-old exploitable firm

by nxzero 10y ago

>> " Open source hardware can be manufactured cheaply (about 3 cents per processor) audited for NSA backdoors or vendor backdoors or decade-old exploitable firmware bugs, and built without hidden extra processors in things like storage devices and USB controllers easily repurposed into spyware." Anyone familiar with J-Core able to expand on the how an audit would be done end-to-end? Seems like it would be much harder to do in practice than in theory.

stephen_g 10y ago
You can audit the code, compile, synthesise, place and route the design, tape out masks, send it to a fab, decap a few of the chips you get back and look at it under a microscope. You should be able to compare that to the masks to verify the design hasn't been tampered with. It's harder to audit ASICs that other people have had fabricated without having the exact same standard cell libraries, tooling versions (optimisations change over time), knowing what optimisation settings they used, etc. to be able to prove the masks came from the same code.
- brianwawok 10y ago
  Is spot checking good enough? Wouldnt you need to follow every trace?
  - olympus 10y ago
    In hardware, implementing a backdoor that provides a reasonable level of functionality is probably going to cause a visible change to the layout/routing, kind of like a software backdoor is going to change the hash. I say probably because it's possible that advanced actors like the USA and China have developed tools that add features (backdoors) while making the visual layout look very similar. Then you would probably only find the backdoors by "fuzzing" the chip like you would a piece of software.
    - ashitlerferad 10y ago
      There are hardware backdoors that require only dopant-level changes, see the second comment here: https://lwn.net/Articles/688751/ https://lwn.net/Articles/688751/
      - digi_owl 10y ago
        It feels like trying to fend of anything but automated drive-by attacks online will be a fools errand.
    - jevinskie 10y ago
      You can do it with a single gate and a handful of passive parts. http://ieee-security.org/TC/SP2016/papers/0824a018.pdf http://ieee-security.org/TC/SP2016/papers/0824a018.pdf
  - kevin_thibedeau 10y ago
    The masks can be converted back into a netlist and then a formal Logic Equivalence Checker can verify correspondence with the original HDL.
    - analognoise 10y ago
      That won't protect against the dopant level attacks, but you could have an automated test run to ascertain dopant levels on chips that you decapped - if you want to take paranoia to the absolute limits. That would take serious time and money to setup computer controlled micropositioners and expensive source measurement units, etc. Iirc, there was a group from the CCC working on using image recognition algorithms to extract netlists from decapped chips. I'll have to look that up...
- DigitalJack 10y ago
  The weak link there is the masks. It's rare for the company creating the design to make the masks unless they are their own foundry. And many foundries themselves outsource masks due to equipment costs.
coderdude 10y ago
Expound, not expand. This is how "begs the question" got a brand new meaning.
ChuckMcM 10y ago
Generate masks, look at them and validate that they only implement the circuits your VHDL synthesizes. Make a wafer and validate that the silicon is the same as the masks. Get your wafer diced and hand carry it to Malaysia to have it put into packages for you. Pretty time consuming though. You might be able to get away with a strict characterization of the diced chips to give yourself a very high likelyhood that different die were not substituted at the packaging step. You could also decap a random selection of chips coming back from the factory to validate they used your die rather than a different one.

by nxzero 10y ago

stephen_g 10y ago

You can audit the code, compile, synthesise, place and route the design, tape out masks, send it to a fab, decap a few of the chips you get back and look at it under a microscope. You should be able to compare that to the masks to verify the design hasn't been tampered with. It's harder to audit ASICs that other people have had fabricated without having the exact same standard cell libraries, tooling versions (optimisations change over time), knowing what optimisation settings they used, etc. to be able to prove the masks came from the same code.

brianwawok 10y ago
Is spot checking good enough? Wouldnt you need to follow every trace?
- olympus 10y ago
  In hardware, implementing a backdoor that provides a reasonable level of functionality is probably going to cause a visible change to the layout/routing, kind of like a software backdoor is going to change the hash. I say probably because it's possible that advanced actors like the USA and China have developed tools that add features (backdoors) while making the visual layout look very similar. Then you would probably only find the backdoors by "fuzzing" the chip like you would a piece of software.
  - ashitlerferad 10y ago
    There are hardware backdoors that require only dopant-level changes, see the second comment here: https://lwn.net/Articles/688751/ https://lwn.net/Articles/688751/
    - digi_owl 10y ago
      It feels like trying to fend of anything but automated drive-by attacks online will be a fools errand.
  - jevinskie 10y ago
    You can do it with a single gate and a handful of passive parts. http://ieee-security.org/TC/SP2016/papers/0824a018.pdf http://ieee-security.org/TC/SP2016/papers/0824a018.pdf
- kevin_thibedeau 10y ago
  The masks can be converted back into a netlist and then a formal Logic Equivalence Checker can verify correspondence with the original HDL.
  - analognoise 10y ago
    That won't protect against the dopant level attacks, but you could have an automated test run to ascertain dopant levels on chips that you decapped - if you want to take paranoia to the absolute limits. That would take serious time and money to setup computer controlled micropositioners and expensive source measurement units, etc. Iirc, there was a group from the CCC working on using image recognition algorithms to extract netlists from decapped chips. I'll have to look that up...
DigitalJack 10y ago
The weak link there is the masks. It's rare for the company creating the design to make the masks unless they are their own foundry. And many foundries themselves outsource masks due to equipment costs.

coderdude 10y ago

Expound, not expand. This is how "begs the question" got a brand new meaning.

ChuckMcM 10y ago

Generate masks, look at them and validate that they only implement the circuits your VHDL synthesizes. Make a wafer and validate that the silicon is the same as the masks. Get your wafer diced and hand carry it to Malaysia to have it put into packages for you. Pretty time consuming though. You might be able to get away with a strict characterization of the diced chips to give yourself a very high likelyhood that different die were not substituted at the packaging step. You could also decap a random selection of chips coming back from the factory to validate they used your die rather than a different one.