Open Source IC Design and Hardware Reverse Engineering Or: How I Learned to Stop...
summary
Open source RISC‑V designs make full reverse engineering trivial enough to turn a months‑long attack into days: a test chip contains four hardware trojans (NTT tweak in a PQ accelerator, secret‑key side‑channel leak, DOS kill switch, loop modification) and is recovered by SEM imaging, stitching and netlist extraction. Using Yosys and Qflow versus a professional flow shows a 20,000‑gate difference between layouts; logic locking is broken by the public oracle, so only heavy customization or slowed foundry flow raises the bar.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:53A RISC-V Chip with Hardware Trojans
- 2:13Full Hardware Reverse Engineering Process
- 3:27Open-Source (ASIC) Design is here to stay
- 4:23Hardware Reverse Engineering Goals
- 5:54Life of a Chip
- 6:33Hardware Trojan Insertion Points
- 7:33Reverse Engineering Process for Foundry
- 8:24Netlist Abstraction Problems
- 9:23Netlist Abstraction Methods
- 14:36Commercial Design vs Open Source Design Open Source
- 19:30Key Take Aways
related talks
01h 46mTutorial: Introduction to Reverse Engineering
45mIntegrated Circuit Offensive Security
06mAn Exploratory Study of Hardware Reverse Engineering — Technical and Cognitive Process
32mSecSi Product Development
27mReverse Engineering Custom ASICs By Exploiting Supply-Chain Leaks
42mEscaping The Sandbox: Side Channel Shenanigans On Our DIY Chip
49mOpen Source Tools of the Hardware Hacking Trade
33mBreaking Into Chips By Reading The Datasheet