Can any part of Intel's (RdRand) random number generator be visually inspected?

Question

A random number instruction RdRand, has been added to Intel's Ivy Bridge processors that (allegedly) draws upon a hardware entropy circuit. The architecture is (allegedly) something like this:-

The entire architecture and the instruction itself is highly controversial. The Linux community deems it suspect. Is it possible to visually inspect or reverse engineer at least the physical circuit? This would be to validate its design /operation against the public documents provided by Intel themselves. I guess that the die would have to be exposed with something like a Stanley knife.

This is a six core Intel i7 CPU die with over 1 billion transistors across 11 layers which seems (too?) tricky to reverse engineer.

I'm focusing on the resources and expertise of someone like Imperial College, England or MIT in America. Or anyone cleverer but still in the civilian domain.

Answer 1

You should definitely contact civilian experts who aren't currently under contract of some kind with defense (aka war) departments. But I don't think any will encourage the idea of using a Stanley knife to expose the die. For cheapness, more likely, something like boiling sulfuric acid. (I've used USP grade sulfuric acid in a double boiler system for liquifying rocket fuels, as it absolutely guarantees uniform temperatures at the condensation surface of the boiler and also the boiling point is roughly at \$330^\circ\$C and above the melting points needed for my sugar and potassium nitrate mixture but below the flash point -- very important.) My guess is that boiling sulfuric acid will make short work of the packaging and leave you with some metal lids and a clean die. (Just be careful. Boiling \$H_2SO_4\$ will cut through flesh to the bone like a hot knife through butter. Just imagine how I felt stepping past my wall of sand bags sitting between me and my melted rocket fuel so that I could retrieve it!)

As far as the microscopy goes, I think it is SEM or FIB. I've worked on both these systems and the Gallium ion beam current can be brought down quite low enough for imaging, I think. It has incredible resolution, too. I recall seeing SEM used for IC imaging, as well. In fact, I worked on systems that used both an SEM and a Gallium ion beam (FIB), where the FIB was doing the milling and the SEM was doing the imaging so that the operator could see what in the heck was being milled out and how well. Beautiful systems. (FEI located here in Oregon and Philips located in Einhoven and also Heerenveen.)

Regardless, I'd go to universities and see where they can direct you. Chances are, if you keep at it, you will find a few of the right people with access to the right equipment. I'm not sure what that might be. But I'd love to hear about it, later, if you get some success at it.

I have zero difficulty believing that the random number generation is compromised. It would be very bad from the security establishment (which says little about who their real motivations) point of view to allow a "good" random number generator into the wild with such wide and easy access to all. And there would be very strong motivations against loosening an easily and widely used good generator capable of complicating their lives. I'm almost sure they would act to prevent it. I wouldn't use it if I cared about secure communications.

Answer 2

Ivy Bridge is in the 22nm node. That is an order of magnitude smaller than the visible light band, therefore impossible to view transistor level detail with an optical microscope. If someone wanted to throw money at it, the surface could be imaged by SEM or AFM. Not an expert, but SEM is destructive, and my gut tells me AFM would give better results anyway. AFM is a slow process, aka it would take forever to image the entire die with enough resolution to see the individual transistors. Even then, imaging the surface is a waste of time. I don't even want to speculate the number of layers in that die.