This is a spin of from my question on security.se. To give more context:

If I have a threat model where

  • the adversary

    • wants to corrupt computation or steal information
    • does not want to be noticed at all (or at least until I made sensitive computation)
    • knows the software I use
    • does lie about and modify higher hardware such as CPUs before handing it out
    • can not access the hardware directly later
  • I

    • want to compute correctly and secretly (or and at least prevent theft of sensitive information)
    • want to exchange information with the outside
    • have access to mathematically verified software (and additionally have access to clean hardware for Bootstrapping only)
    • can check lower hardware such as wires for manipulation and can repair or rewire
    • can not check higher hardware for manipulation

In brackets (...) are some weakened circumstances.

Manipulation of hardware by malicious manufacturers is problematic attack vector in the chain of trust. My idea is to use simple verifiable parts to control the smart complex parts (e.g. compare output of confused CPUs). You can read it if you are interested. It is my main question. It links to the spin-offs and is updated.


Before the edit of the question I thought that it is simple to make an corrupt IC act intelligently (e.g. a corrupt XOR gate could output 0 at certain times. That says the input is the same. This could be triggered after it sees a certain pattern.) But user The Photon explains that you would need on the order 10x as many gates as you need for just the XOR and that would be visible in the midst of 2 or 3 gates. But there seem to be different opinions by other users. It would be useful if I could use IC for a design.

After many edits the question is now specific: It asks about designs that can be used to make it difficult to subvert IC (or transistors or diodes) for a malicious manufacturer undetected. State of the art methods would be good information.

Please consider answering for the method: In what ways could the malicious manufacturer hide a modification? How can you detect that?

  • 1
    \$\begingroup\$ @ThreePhaseEel - I am sorry if I offended you. First I can proof that I am not a spamer. Click on the link to my question on security.stackexchange.com/questions/144442/…. It was well received there. Secondly I am genuinely interested in this. I want to improve the answer so it is on-topic. For example I do not know what "set off the spam alarm". And I saw my question as "a specific electronics design problem" (on-topic). Please help a new user to be useful to the community. \$\endgroup\$ – Gabriel Schulz Dec 8 '16 at 1:53
  • 1
    \$\begingroup\$ The transistors aren't particularly easy to see. But the metal connecting them is pretty obvious, when it's on the scale of this kind of part. \$\endgroup\$ – The Photon Dec 8 '16 at 2:48
  • 2
    \$\begingroup\$ It's a lot easier to hide 100 gates amidst 100,000,000 gates, than it is to hide 100 gates in the midst of 2 or 3 gates. \$\endgroup\$ – The Photon Dec 8 '16 at 2:55
  • 1
    \$\begingroup\$ I think this is a reasonable question and will have a go at an answer tomorrow. \$\endgroup\$ – pjc50 Dec 9 '16 at 22:35
  • 3
    \$\begingroup\$ The people trying to close this are ignorant and do not design ics as a job, yet fancy themselves as ic designers. Yes this is a big problem, especially with ics designed overseas. It is called designed for trust, or DFT. Typically ring oscillators or heat transducers are used to verify that no malicious hardware has been squeezed into your filler space (since doing so will necessarily either increase power or increase nodal capacitance). \$\endgroup\$ – jbord39 Dec 10 '16 at 7:27