UF/FICS Hardware De-obfuscation Competition

The objective of this competition was to extract the secure key to recovering the original (pre-obfuscation) design. The secure key consists of dynamically obfuscated scan-chain (DOSC) seed and the random logic locking key bits. Since, the DOSC architecture is resilient to oracle-guided attack (e.g., SAT attacks), our team adopted the oracle-less attack where both the different keys were targeted individually. First, the random locking keys were recovered through our proposed topology-guided attack (TGA) presented in ASHES’2019. This attack relies on identifying and constructing unit functions with a hypothesis key to be searched in the entire netlist to find its replica as Boolean functions are repeated multiple instances in the netlist. Next, the DOSC architecture was attacked through the scan reset attack. The key bits were captured in the scan flip flops before resetting to zero for one clock cycle when the reset is applied to the circuit. These bits can be extracted out through the scan-out port and can be traced back through the LFSR equations to determine the seed.

Competition Page