Same threat model with black hats. Here's a recent example from high-security field that's remarkably simple but stops tons of attacks: http://www.cc.gatech.ed

Same threat model with black hats. Here's a recent example from high-security field that's remarkably simple but stops tons of attacks: http://www.cc.gatech.edu/grads/c/csong43/oakland16-hdfi.pdf http://www.cc.gatech.edu/grads/c/csong43/oakland16-hdfi.pdf Its related work & extension page has a ton of references to other things showing just how much work it is to stop regular black hats in systems without verified software. Nation states just do more of the same stuff. Edmison's has a nice survey & design for when you don't trust anything outside the SOC: https://theses.lib.vt.edu/theses/available/etd-10112006-204811/unrestricted/edmison_joshua_dissertation.pdf https://theses.lib.vt.edu/theses/available/etd-10112006-2048... NSA targets those levels, too. At that point, your bases are covered so long as the fab receives and doesn't alter your design. Plus the complex tooling works...