Crypto Trojan

Imagine the following scenario: a security critical system (e.g. key card) was designed with an AES encryption circuit. The personalized 128 bit key should under no circumstances be accessible by the user. However, somewhere in the production process a hardware trojan was inserted into the chip.

The Crypto Trojan example project provides an AES128 encryption netlist with more than 10000 gates that has been tampered with. The purpose is to demonstrate the HAL analysis tools finding the trojan and learning how it gets activated.

When opening the project be warned that rendering the entire netlist (e.g. by double click on the top module) will take a long time. It might be interesting though to have a look at the overwhelming number of gates but it doesn't reveal the functionality of the circuit nor whether something is wrong with it.

The first tool that is needed is the dataflow. Please go to the plugin manager page an make sure dataflow was activated. If not enable it and restart HAL.

There are two ways to invoke the dataflow analysis:

GUI: Open the dataflow setting form in main menu > Plugins > dataflow. Set the expected register with to 128, select an existing output directory an set the ckeck at create graph.

Script: Run the python script find_128bit_aes_register.py