Designing Stealthy Trojans with Sequential Logic

Abstract

This paper describes how a stealthy Trojan circuit can be inserted into a stream cipher module. The stream cipher utilizes several shift register-like structures to implement the keystream generator and to process the encrypted text. We demonstrate how an effective trigger can be built with the addition of just a few logic gates inserted between the shift registers and one additional flipflop. By distributing the inserted Trojan logic both temporally and over the logic design space, the malicious circuit is hard to detect by both conventional and more recent static analysis methods. The payload is designed to weaken the cipher strength, making it more susceptible to cryptanalysis by an adversary.

Blinding HT: Hiding Hardware Trojan signals traced across multiple sequential levels

“…The HTs proposed in Ref. [20] demonstrate the insertion of a few logic gates between the shift registers and an additional flip-flop to build the effective trigger. It implements a large number of small input gates to evade FANCI.…”

“…The basic strategy of the HTs in Ref. [20] is to distribute the detection of the input sequence over time. This is based on the state information stored in the encryption circuit.…”

“…Thus, these HTs can evade the detection of FANCI. The HTs proposed in [20] are mainly inserted into a stream cipher module, while the HT proposed in this article can be inserted in any circuits rather than some particular circuits.…”

Hardware Trojans in Chips: A Survey for Detection and Prevention

“…Some articles designed or considered some potential HTs from the attacker’s point of view and put forward solutions to these HTs [ 22 , 23 , 24 , 25 , 26 , 27 , 28 , 29 , 30 , 31 , 32 ]. Some researchers applied HTs to the real environment and designed a scheme to defend it [ 33 , 34 , 35 , 36 , 37 , 38 , 39 , 40 , 41 , 42 , 43 , 44 ]. Individual scholars proposed methods to reduce the effect of the HTs [ 44 , 45 ].…”