Abstract:Hardware Trojans have drawn the attention of academia, industry and government agencies. Effective detection mechanisms and countermeasures against such malicious designs can only be developed when there is a deep understanding of how hardware Trojans can be built in practice, in particular Trojans specifically designed to avoid detection. In this work, we present a mechanism to introduce an extremely stealthy hardware Trojan into cryptographic primitives equipped with provably-secure first-order side-channel countermeasures. Once the Trojan is triggered, the malicious design exhibits exploitable side-channel leakage, leading to successful key recovery attacks. Generally, such a Trojan requires neither addition nor removal of any logic which makes it extremely hard to detect. On ASICs, it can be inserted by subtle manipulations at the sub-transistor level and on FPGAs by changing the routing of particular signals, leading to \textbf{zero} logic overhead. The underlying concept is based on modifying a securely-masked hardware implementation in such a way that running the device at a particular clock frequency violates one of its essential properties, leading to exploitable leakage. We apply our technique to a Threshold Implementation of the PRESENT block cipher realized in two different CMOS technologies, and show that triggering the Trojan makes the ASIC prototypes vulnerable.

A General Hardware Trojan Technique Targeted on Lightweight Cryptography with Bit-Serial Structure

A Secure Scan Method for Crypto Chips

Optimized Lightweight Hardware Trojan-Based Fault Attack on DES

Low-cost Design of Stealthy Hardware Trojan for Bit-Level Fault Attacks on Block Ciphers

Side-Channel Hardware Trojan for Provably-Secure SCA-Protected Implementations

On Trojan Side Channel Design and Identification.

Stealthy Hardware Trojan Based Algebraic Fault Analysis of HIGHT Block Cipher.

Optimal Model Search for Hardware-Trojan-based Bit-Level Fault Attacks on Block Ciphers

Hardware Trojans in Chips: A Survey for Detection and Prevention

A Novel Hardware Trojan Design Based on One-Hot Code

Analysis on Key-leakage Hardware Trojan of SM4 Algorithm

A signature based architecture for Trojan detection

Key‐leakage Hardware Trojan with Super Concealment Based on the Fault Injection for Block Cipher of SM4

Analog hardware trojan design and detection in OFDM based wireless cryptographic ICs

A Hardware Trojan Detection Technique Based on Rapid Trigger and Reducing Resource Consumption

Experiences in Hardware Trojan design and implementation

A Novel Trojan Side Channel for Attacking Masking

A security method of hardware Trojan detection using path tracking algorithm

Design and Insertion of Hardware Trojan Based on Finite State Machine

Hardware Trojan design based on combination probability and non-rare events

Stealthy Trojan Detection Based on Feature Analysis of Circuit Structure