GF-Flush: A GF(2) Algebraic Attack on Dynamically Secured Scan Chains
Dake Chen, Chunxiao Lin, Peter A. Beerel · 2021
Scan chains provide increased controllability and observability for testing digital circuits. The increased testability, however, can also be a source of information leakage for sensitive designs. The state-of-the-art defenses to secure scan chains apply dynamic keys to pseudo-randomly invert the scan vectors. In this paper, we pinpoint an algebraic vulnerability of these dynamic defenses that involves creating and solving a system of linear equations over the finite field GF(2). In particular, we propose a novel GF(2)-based flush attack that breaks even the most rigorous version of state-of-the-art dynamic defenses. Our experimental results demonstrate that our attack recovers the key as long as 500 bits in less than 7 seconds. Our attack times are, on average, over 4300x faster than state-of-the-art SAT based attacks on the same defenses and circumvent any obfuscation on the combinational logic portions of the design. We then demonstrate how our attacks can be extended to scan chains compressed with Multiple- Input Signature Registers (MISRs).