# Can any part of Intel's (RdRand) random number generator be visually inspected?

A random number instruction RdRand, has been added to Intel's Ivy Bridge processors that (allegedly) draws upon a hardware entropy circuit. The architecture is (allegedly) something like this:-

The entire architecture and the instruction itself is highly controversial. Many people believe that the RdRand instruction has been compromised by the NSA. Is it possible to visually inspect or reverse engineer at least the physical circuit? This would be to validate its design /operation against the public documents provided by Intel themselves. I guess that the die would have to be exposed with something like a Stanley knife.

I'm focusing on the resources and expertise of someone like Imperial College, England or MIT in America. Or anyone cleverer but still in the civilian domain.

• You might want to try this question on the Information Security Stack Exchange site, there will be a higher concentration of appropriate specialists there. – Neil_UK Jun 17 '17 at 7:18
• @Neil_UK Isn't this an electronics design / chip fabrication question? I'm interested in silicon level reverse engineering. – Paul Uszak Jun 17 '17 at 8:37
• The people with the incentive to know about this, whether it's ever been done, or discussed, or factors around it, might be more prevalent on InfoSec, even if the physical chip investigation techniques are more appropriate here. There's a lot of crossover between the disciplines, and there are more ways to attempt to probe what is chip is doing than trepanning it. – Neil_UK Jun 17 '17 at 8:43
• TBH, it doesn't matter if it's compromised if used correctly, von Neumann proved that... – dandavis Jun 17 '17 at 17:46
• The question text after the diagram itself is highly opinionated and therefore is likely to garner likewise answers. This is a bit of a shame as it is a valid question in itself. – Maarten Bodewes Jun 28 '19 at 11:15

Ivy Bridge is in the 22nm node. That is an order of magnitude smaller than the visible light band, therefore impossible to view transistor level detail with an optical microscope. If someone wanted to throw money at it, the surface could be imaged by SEM or AFM. Not an expert, but SEM is destructive, and my gut tells me AFM would give better results anyway. AFM is a slow process, aka it would take forever to image the entire die with enough resolution to see the individual transistors. Even then, imaging the surface is a waste of time. I don't even want to speculate the number of layers in that die.

• Are you saying that the requisite components I want to image might be beneath other layers of circuitry? So it's actually impossible to visualise a complete modern chip of this complexity? – Paul Uszak Jun 17 '17 at 20:29
• @PaulUszak Think of a die as a few hundred layer PCB, except components can be embedded between layers. There are billions of transistors on it these days. They can't all be on one layer, let alone the interconnect between them. – Matt Young Jun 17 '17 at 20:53
• I've accepted your answer, but this leads to the obvious question of how do Intel verify construction? – Paul Uszak Jun 17 '17 at 21:02
• @PaulUszak IC testing in general is probably worth a question. We have some IC designers here. – Matt Young Jun 17 '17 at 21:12

You should definitely contact civilian experts who aren't currently under contract of some kind with defense (aka war) departments. But I don't think any will encourage the idea of using a Stanley knife to expose the die. For cheapness, more likely, something like boiling sulfuric acid. (I've used USP grade sulfuric acid in a double boiler system for liquifying rocket fuels, as it absolutely guarantees uniform temperatures at the condensation surface of the boiler and also the boiling point is roughly at $330^\circ$C and above the melting points needed for my sugar and potassium nitrate mixture but below the flash point -- very important.) My guess is that boiling sulfuric acid will make short work of the packaging and leave you with some metal lids and a clean die. (Just be careful. Boiling $H_2SO_4$ will cut through flesh to the bone like a hot knife through butter. Just imagine how I felt stepping past my wall of sand bags sitting between me and my melted rocket fuel so that I could retrieve it!)

As far as the microscopy goes, I think it is SEM or FIB. I've worked on both these systems and the Gallium ion beam current can be brought down quite low enough for imaging, I think. It has incredible resolution, too. I recall seeing SEM used for IC imaging, as well. In fact, I worked on systems that used both an SEM and a Gallium ion beam (FIB), where the FIB was doing the milling and the SEM was doing the imaging so that the operator could see what in the heck was being milled out and how well. Beautiful systems. (FEI located here in Oregon and Philips located in Einhoven and also Heerenveen.)

Regardless, I'd go to universities and see where they can direct you. Chances are, if you keep at it, you will find a few of the right people with access to the right equipment. I'm not sure what that might be. But I'd love to hear about it, later, if you get some success at it.

I have zero difficulty believing that the random number generation is compromised. It would be very bad from the security establishment (which says little about who their real motivations) point of view to allow a "good" random number generator into the wild with such wide and easy access to all. And there would be very strong motivations against loosening an easily and widely used good generator capable of complicating their lives. I'm almost sure they would act to prevent it. I wouldn't use it if I cared about secure communications.