china has no problem destructively reverse engineering chips. they aren't validating them, they are copying them. and the destructive method may be time consuming, but surely for China it's cheaper?
this technique would be more like CMM validation of a part after manufacturing. very, very useful but with a different goal in mind.
Plus aren't many chips made in China? My impression after watching BigClive tear apart stuff was that a lot of Chinese clones use their own chips, and many chips are custom and seem to only exist between Chinese manufacturers (like custom USB charging chips, led chips for flashlights, etc.)
In order to manufacture these chips you need the schematics. It's the same thing as having the source code and the deployment/compilation instructions: You don't need anything else.
Physical Unclonable Functions were supposed to address this.
I wouldn't expect them to hold a state actor at bay for more than a little while, but at least with a PUF in place overproduction isn't as simple as "just make more."
Strictly speaking, for manufacturing you need the layout for the chip, but extracting a schematic from a given layout is an automated process and used for verification. You create a layout from a given schematic and later check, whether the layout implements that schematic.
And one should not overlook that a lot of cutting edge chip design is done in China. Just think of all the chips by Huawei. On top of that, the direct layout information is more relevant for reengineering than copying.
As a suffix 'tych' (pronounced 'tic') refers to multiple related/connected things ... tables, leaves, panels, works ... (diptych, triptych, polyptych). EG 'triptych' "derives from the Greek adjective τρίπτυχον 'triptukhon' ('three-fold')".
> Some of that information can be regained by making some assumptions about what you’re looking at, explains Aeppli. For example, we know that real interconnects can’t have certain shapes.
This sounds like the beginnings of the silicon obfuscation strategy: hiding things in silicon that lie below these assumptions
> Five individual logic cells were functionally disconnected from the rest— with no pathways that would allow them to influence the output— yet when the researcher disabled any one of them the chip lost its ability to discriminate the tones. Furthermore, the final program did not work reliably when it was loaded onto other FPGAs of the same type.
Note the last sentence of your quote. Device-to-device variability and production yield are opposites. I can't imagine how techniques that exploit variability between devices (with no mention of temperature, lifetime drift, etc) could be reliable.
Maybe not the best example, but this was on FPGA. When making custom chips, you can make all sorts of tuning, including consistent hardly noticeable drifts from spec.
The article says they only image the metal layers, so I guess you can do anything as long as you don't visibly change the metal layers.
Maybe! I've got some experience with tomographic algorithms, and what they're referring to is correcting for the "missing wedge" in the Radon and/or Fourier transforms - the measurements that tomography produces - of the chip (https://images.app.goo.gl/HWPX2LKBsDd7eeBe6). There has been lots of interest in statistical or data-driven algorithms to reconstruct missing measurement areas from the existing ones. It sounds like a key technology here was better algorithms to accommodate a larger missing wedge, so they didn't have to tilt the chip to extreme angles when getting projections.
It's possible you could fool the algorithm in some way, but you'd have pretty weird and severe constraints on the shapes of your hidden parts to hide their presence from low-angle projections. They're probably not actually hand-crafting geometric assumptions about chip structures or anything like that.
Before 1984 there was no copyright on the contents of chips, it was completely legal to create masks from a competitor's chips and sell them - people used to create on-chip structures designed to fool the optical processes that were used to do this
Agreed. Also I hope it brings the end of the Apple security-by-obscurity methods that allowed that one iPhone to be cracked by a third party hacker. If you know what's in the hardware a 4-6 digit PIN is fine for deterring casual onlookers but is never enough entropy to secure data.
People should learn to use real passwords if they want their data secure.
Perhaps... one of the capabilities is to dope gates with different materials so the transistor layout stays the same but the behavior is modified. Unless the system could detect the actual elemental differences you might get a false sense of security just confirming the transistor layout.
attach photographic plate to lead plate, attach PCB to photographic plate, mail to collaborator across a jurisdiction with X-ray postal inspection, collaborator develops photographic plate, 50% success rate depending on face down or face up, scan image and send result.
Dare I bring up the Bloomberg article without causing a shitstorm? I remember reading around that time a (I think) presentation on how to trick / hide against x-ray tomography etc but I can't find the link to the source if anyone has it?
I recently had an IPMI on on of my Supermicro servers and it was super funny to hear the conspiracy theory from the SuperMicro support that it was not working because maybe the Chinese were worming through a backdoor that was hidden on the machine.
I'm quite sure that the issue was just a faulty IPMI as I've seen it happen before with older units but I had a good laugh.
I'm a believer in Murphy's law where whatever can happen will happen. Supply chain attacks are quite possible, would be very fruitful and therefore must be happening. But will we ever get the truth from the big vendors? I don't think it will happen any time soon but with this x-ray technology, it will be way easier to detect them.
I have no expertise on this subject, but here goes. First, I don't think the technique can see electrical charges, which is how any chip stores volatile state. Second, if such chips rely on security by obscurity -- and judging from the NDAs typically required to get any official information about them, I'd say it's part of their defense in depth -- then that security would now be weaker. Finally, this technique would arguably enhance security if independent labs were now able to verify that a chip is devoid of back doors and implementation errors.
Personally I was thinking of being able to recreate some discrete chips with breadboards.
Then again MOSIS has prices down to a few thousand/square millimeter. Since current gen stuff is so much smaller, that's probably <$100 for the more complex chips from the 70s, & 80s.
The best I think we'll get is some Amiga/Commodore build it yourself kits That weren't possible before because of out-of-production chips.
+1.
My personal choice: MAX038 (no relation with the 8038), way better than any similar analog wave generators but discontinued long ago and never upgraded.
I know there are cheap DDS chips, but they require filters and control logic. This one goes from 100 KHz to 20MHz with just a bunch of parts.
Be careful of those sold online however as they're all fakes; this chip was killed well over a decade ago. I'm not aware of any clones yet, though I would welcome them if on par quality wise with the original.
Interesting chip. It's quite literally almost an entire standard function generator on one chip, with a bandwidth far exceeding some similar chips.
Whether it's actually better than those from the 80s, I'm not sure. Both HP and Philips used to use ASICs -- pretty much just matched diode arrays -- for their sine shaping, and that's about the most critical part in this kind of generator.
I wonder what the implications of this could be for the emulation community...maybe someone more knowledgable about this stuff can enlighten me: would something like this be useful in creating more-accurate emulators?
57 comments
[ 0.29 ms ] story [ 105 ms ] threadthis technique would be more like CMM validation of a part after manufacturing. very, very useful but with a different goal in mind.
I wouldn't expect them to hold a state actor at bay for more than a little while, but at least with a PUF in place overproduction isn't as simple as "just make more."
I worked at intel in the 90s, and they put malformed cpus in key chains.
But what will be interesting to see will be is when they build a library of Devices where they can quickly ID Trojans
'Ptychography' was coined by crystallographers in 1972. Wikipedia has more on the origin. https://en.wikipedia.org/wiki/Ptychography
This sounds like the beginnings of the silicon obfuscation strategy: hiding things in silicon that lie below these assumptions
> Five individual logic cells were functionally disconnected from the rest— with no pathways that would allow them to influence the output— yet when the researcher disabled any one of them the chip lost its ability to discriminate the tones. Furthermore, the final program did not work reliably when it was loaded onto other FPGAs of the same type.
https://www.damninteresting.com/on-the-origin-of-circuits/
The article says they only image the metal layers, so I guess you can do anything as long as you don't visibly change the metal layers.
It's possible you could fool the algorithm in some way, but you'd have pretty weird and severe constraints on the shapes of your hidden parts to hide their presence from low-angle projections. They're probably not actually hand-crafting geometric assumptions about chip structures or anything like that.
[1] http://www.underhanded-c.org/
People should learn to use real passwords if they want their data secure.
Its possible that Intel / other chip manufacturers / board manufacturers would pay for just to improve confidence in their supply chain.
At some point this is a few millions a year, and a nice tick box in the pitch deck.
I'm quite sure that the issue was just a faulty IPMI as I've seen it happen before with older units but I had a good laugh.
I'm a believer in Murphy's law where whatever can happen will happen. Supply chain attacks are quite possible, would be very fruitful and therefore must be happening. But will we ever get the truth from the big vendors? I don't think it will happen any time soon but with this x-ray technology, it will be way easier to detect them.
This, combined with stuff like RISC-V is very good news and big progress towards making a secure (read backdoor-free) hardware platform.
Gotta love the Swiss !
Then again MOSIS has prices down to a few thousand/square millimeter. Since current gen stuff is so much smaller, that's probably <$100 for the more complex chips from the 70s, & 80s.
The best I think we'll get is some Amiga/Commodore build it yourself kits That weren't possible before because of out-of-production chips.
I know there are cheap DDS chips, but they require filters and control logic. This one goes from 100 KHz to 20MHz with just a bunch of parts. Be careful of those sold online however as they're all fakes; this chip was killed well over a decade ago. I'm not aware of any clones yet, though I would welcome them if on par quality wise with the original.
https://datasheets.maximintegrated.com/en/ds/MAX038.pdf
Whether it's actually better than those from the 80s, I'm not sure. Both HP and Philips used to use ASICs -- pretty much just matched diode arrays -- for their sine shaping, and that's about the most critical part in this kind of generator.