The accessibility to the internal IP cores of Systems on Chip (SoC) provided by the testing infrastructures is a serious security threat. It has been known for many years that the scan chains can be exploited to retrieve secret keys of cryptoprocessors. Encryption of the scan chain content is one of the proposed techniques to overtake this threat. Many proposals are based on stream ciphers, due to their moderate area cost compared to that of block ciphers. Stream ciphers encrypt data serially with a keystream generated from an Initialization Vector (IV) and a secret key. Stream ciphers have a crucial limitation concerning the encryption of different data with the same keystream, called two times pad. Not enough caution in the IV and secret key management has been exercised in previous proposed works. In this paper, we show how the existing implementations can be exploited to perform a scan attack bypassing the encryption of the scan data. We also present a new implementation of scan chain encryption with a stream cipher, based on the IV generation by a True Random Number Generator (TRNG). Finally, we show that this new implementation is robust against the aforementioned attack.

The growth in complexity of Integrated Circuits (IC) is supported, amongst other factors, by the development of standardized test infrastructures. The feasibility of both end-ofmanufacturing and in-field tests heavily depends on the presence of these infrastructures that give detailed access to the IC. The standard test infrastructures are referred as IEEE Std. 1149.1 (JTAG), IEEE Std. 1500 and IEEE Std. 1687 (IJTAG). The security issues arising from the presence of these infrastructures have been fully exposed in the last two decades. This led to the publication of several practical attacks showing how a non-protected test infrastructure can end into the jeopardizing of the entire system. As a consequence, many countermeasures have been proposed. In this survey, we provide: (i) a taxonomy of the attacks that can be performed exploiting the standard test infrastructures; (ii) a taxonomy of countermeasures inspired by the kind of security primitives that are granted in each case.

Table 1. HADES requirements for secure testing Property Requirement Comments Secure access Mutual authentication protocol Possibly Challengeresponse Confidentiality Symmetric encryption 1 bit per cycle (avg) ; Random IV against replay attacks Integrity Hashing algorithm Collision resistant, possibly shared with other processes Interfaces Standard compliance Wrappers if needed (AMBA, I2C, CAN, …) Key management Updatable Multiple keys No fixed single global key Group management Attacker model Skilled attacker