Here an example of a hardware "trojan" for Intel Ivy Bridge; The hardware RNG is broken only by modifying its circuitry doping. https://sharps.org/wp-content/u

Here an example of a hardware "trojan" for Intel Ivy Bridge; The hardware RNG is broken only by modifying its circuitry doping. https://sharps.org/wp-content/uploads/BECKER-CHES.pdf https://sharps.org/wp-content/uploads/BECKER-CHES.pdf https://en.wikipedia.org/wiki/Doping_(semiconductor) https://en.wikipedia.org/wiki/Doping_(semiconductor) In this paper we introduced a new type of sub-transistor level hardware Trojan that only requires modification of the dopant masks. No additional transistors or gates are added and no other layout mask needs to be modified. Since only changes to the metal, polysilicion or active area can be reliably detected with optical inspection, our dopant Trojans are immune to optical inspection, one of the most important Trojan detection mechanism. Also, without the ability to use optical inspection to distinguish Trojan-free from Trojan designs, it is very difficult to find a chip that can serve as a golden chip, which is needed by most post-manufacturing Trojan detection mechanisms. To demonstrate the feasibility of these Trojans in a real world scenario and to show that they can also defeat functional testing, we presented two case studies. The first case study targeted a design based on Intel’s secure RNG design. The Trojan enabled the owner of the Trojan to break any key generated by this RNG. Nevertheless, the Trojan passes the functional testing procedure recommended by Intel for its RNG design as well as the NIST random number test suite. This shows that the dopant Trojan can be used to compromise the security of a meaningful real-world target while avoiding detection by functional testing as well as Trojan detection mechanisms.