DynUnlock: Unlocking Scan Chains Obfuscated using Dynamic Keys

Limaye, Nimisha; Sinanoglu, Ozgur

doi:10.23919/date48585.2020.9116197

Cited by 24 publications

(12 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…DOS [74] and Dyn-EFF [35], are in the better condition. However, recent studies on the possibility of recovering PRNG/LFSR structure describe in both scanSAT [21] and DynUnlock [77] reveals the vulnerability of these solutions.…”

Section: Discussion and Opportunitiesmentioning

confidence: 99%

“…So, if the adversary could recover the seed of the PRNG, the generated key sequence would be revealed. Hence, similar to the ScanSAT, a new attack called DynUnlock [77] introduces a similar approach to show how it is possible to find the seed of the PRNG in EFF-Dyn.…”

Section: E Dynunlock Attack: Breaking Dynamic Encrypt Flip-flopmentioning

confidence: 99%

“…Once modeling is complete the combinational obfuscated counterpart circuit, with seed bits acting as primary key inputs, is fed to a SAT solver, which provides a DIP and its corresponding output pattern. In [77], the authors carry out the attack for just one capture cycle. To recover more bits, they restart the LFSR circuit and obtain a new DIP and its corresponding output This work is licensed under a Creative Commons Attribution 4.0 License.…”

Section: E Dynunlock Attack: Breaking Dynamic Encrypt Flip-flopmentioning

confidence: 99%

“…Based on the overall architecture of these techniques demonstrated in Figs. 19,21,22, and 23, it seems that the 1wSC in the kt-DFS has two storage units and has a larger footprint compared to the other techniques. However, all other techniques also require two FFs per each key bit.…”

Section: E Kt-dfs: Key-trapped Design For Securitymentioning

confidence: 99%

See 3 more Smart Citations

From Cryptography to Logic Locking: A Survey on the Architecture Evolution of Secure Scan Chains

et al. 2021

View full text Add to dashboard Cite

The availability of access to Integrated Circuits' scan chain is an inevitable requirement of modern ICs for testability/debugging purposes. However, leaving access to the scan chain OPEN resulted in numerous security threats on ICs. It raises challenging concerns particularly when the secret asset, like secret information, is placed within the chip, such as the keys of cryptographic algorithms, or similarly logic obfuscation key. So, to combat these threats, numerous secure scan chain architectures have been proposed in the literature to prevent any unauthorized access to the scan chain. They also keep the availability of the scan chain for testability/debugging. In this paper, we first show why a secure scan chain architecture is required when security primitives, like logic obfuscation, are in place. Then, we provide a holistic overview of all secure scan chain architectures starting from preliminary methods introduced when cryptography is in place and the adversary threat model is very limited. It is then followed by newer and more advanced methods introduced when logic obfuscation is in place and the adversary threat model is much stronger. Hence, we have more concentration on the architecture proposed more recently on logic obfuscation. We evaluate all secure scan chain architectures in terms of security and resiliency, testability/debugging time and complexity, and area/power/delay overhead.

show abstract

Section: Discussion and Opportunitiesmentioning

confidence: 99%

Section: E Dynunlock Attack: Breaking Dynamic Encrypt Flip-flopmentioning

confidence: 99%

Section: E Dynunlock Attack: Breaking Dynamic Encrypt Flip-flopmentioning

confidence: 99%

Section: E Kt-dfs: Key-trapped Design For Securitymentioning

confidence: 99%

See 2 more Smart Citations

From Cryptography to Logic Locking: A Survey on the Architecture Evolution of Secure Scan Chains

et al. 2021

View full text Add to dashboard Cite

show abstract

“…While DisORC demonstrates resilience against oracle-guided attacks, it is only applied at the gate-level for a locked netlist. Scan locking techniques [18], [19], [20] which insert key-driven logic on scan paths are also shown to be vulnerable to modeling-based attacks [21], [22].…”

Section: B Functional Mode Isolationmentioning

confidence: 99%