3 ms·

It would be much easier to do this at an earlier stage - before the design is handed off to the foundry. Modifying masks for even trivial changes is very diffic

It would be much easier to do this at an earlier stage - before the design is handed off to the foundry. Modifying masks for even trivial changes is very difficult and that's assuming knowledge of the circuit (which your malicious code probably won't have). Plus I imagine the verification tools would spot the difference, flagging it as an imperfection which would then attract scrutiny. I think this is extremely unlikely.

0x0 8y ago
Well, stuxnet was written with knowledge of a very specific SCADA setup. Not so farfetched to think a targeted trojan would be written with knowledge of the circuit.
- toast0 8y ago
  Editing circuits is hard enough with complete information. If the intent is to add an exciting extra feature, that seems rather difficult to do via malware. If you're trying to just sabotage a bit, that's more likely -- maybe expose for slightly less time and things are less reliable, etc. Like others said though, it's probably easier to mess with the designs before they go to the Fab.
  - phendrenad2 8y ago
    What if they do have complete information? If you had spies working at all levels, you could create your own parallel version of the end result all the way down to the silicon level. Then, you would actually do the modification at the silicon level, to make the backdoor hardest to find.
    - delfinom 8y ago
      At that point you just insert a spook into the foundry as an employee and have them swap the files. No need to waste time or uncertainty.
MertsA 8y ago
Some backdoors can be almost impossible to detect with any kind of traditional wafer inspection tools. E.g., it might be possible to transparently cripple something like Intel's RdRand instruction by changing only the doping on some of the gates inside the hardware RNG circuit. It would look completely identical under the best microscope and looking at the output wouldn't give you a good indication of whether or not you had a broken RNG or a good one. The design of Intel's RNG involved passing the output of the RNG through some whitening and IIRC AES so it might look completely random and pass every statistical test but the hardware entropy source might only realistically have 10 bits per second of real entropy. I still think it's unlikely that someone would go through the effort to insert a super secret backdoor by surreptitiously modifying the masks but there are some interesting techniques that can make finding a backdoor almost impossible if you don't already know about it.
- kingosticks 8y ago
  Sounds like the really cool "Stealthy Dopant-Level Hardware Trojans" paper from a few years ago. I'd forgotten about that, well worth a read for those interested. However, you must remember that as well as precise knowledge of the circuit, anyone other than an insider has close to zero chance of getting a doping change correct. Even an insider's chances are very low. And then your high-level testing is in place too. It's not common to have circuits where BIST can't give you full confidence but it happens; for things like the RNG here, also due to test tool limitations etc. So you must be doing both both general and highly targeted post-manufacturing testing also. The extent of that testing may depend on your market.

0x0 8y ago

Well, stuxnet was written with knowledge of a very specific SCADA setup. Not so farfetched to think a targeted trojan would be written with knowledge of the circuit.

toast0 8y ago
Editing circuits is hard enough with complete information. If the intent is to add an exciting extra feature, that seems rather difficult to do via malware. If you're trying to just sabotage a bit, that's more likely -- maybe expose for slightly less time and things are less reliable, etc. Like others said though, it's probably easier to mess with the designs before they go to the Fab.
- phendrenad2 8y ago
  What if they do have complete information? If you had spies working at all levels, you could create your own parallel version of the end result all the way down to the silicon level. Then, you would actually do the modification at the silicon level, to make the backdoor hardest to find.
  - delfinom 8y ago
    At that point you just insert a spook into the foundry as an employee and have them swap the files. No need to waste time or uncertainty.

MertsA 8y ago

Some backdoors can be almost impossible to detect with any kind of traditional wafer inspection tools. E.g., it might be possible to transparently cripple something like Intel's RdRand instruction by changing only the doping on some of the gates inside the hardware RNG circuit. It would look completely identical under the best microscope and looking at the output wouldn't give you a good indication of whether or not you had a broken RNG or a good one. The design of Intel's RNG involved passing the output of the RNG through some whitening and IIRC AES so it might look completely random and pass every statistical test but the hardware entropy source might only realistically have 10 bits per second of real entropy. I still think it's unlikely that someone would go through the effort to insert a super secret backdoor by surreptitiously modifying the masks but there are some interesting techniques that can make finding a backdoor almost impossible if you don't already know about it.

kingosticks 8y ago
Sounds like the really cool "Stealthy Dopant-Level Hardware Trojans" paper from a few years ago. I'd forgotten about that, well worth a read for those interested. However, you must remember that as well as precise knowledge of the circuit, anyone other than an insider has close to zero chance of getting a doping change correct. Even an insider's chances are very low. And then your high-level testing is in place too. It's not common to have circuits where BIST can't give you full confidence but it happens; for things like the RNG here, also due to test tool limitations etc. So you must be doing both both general and highly targeted post-manufacturing testing also. The extent of that testing may depend on your market.