Dynamic logic locking improves hardware security against attacks
Evaluating Structural and SAT Attack Resilience in Cryptographic Dynamic Logic Locking via Keystream Capping
Cryptography and Security
Summary
Hardware chips can be copied or reverse-engineered by untrusted parties, putting intellectual property at risk. The authors study a method called dynamic logic locking, which hides secret keys inside the chip's logic and changes the signals continuously to stop attackers who try to guess the key. They find that just moving the secret parts inside the chip isn't enough because attackers can still exploit too many bits revealed at once. To fix this, they limit how many bits can be reused per cycle, making key guess attacks much harder and protecting the chip better.
What this means in practice
- •For hardware security engineers: Design secure integrated circuits that resist key extraction and logic removal attacks using internal dynamic logic locking with controlled keystream reuse.
- •For semiconductor supply chain teams: Protect proprietary chip designs from reverse engineering and overproduction through enhanced logic locking and attack-resistant circuit layouts.
Authors
Nahush Tambe, Naseeruddin Lodge, Vineet Chadalavada, Fareena Saqib
Abstract
Untrusted third-party entities throughout the semiconductor supply chain expose proprietary hardware intellectual property to reverse engineering, piracy, and overproduction. While logic locking counters this threat by embedding key-dependent logic, conventional static key-gates remain vulnerable to both oracle-guided SAT attacks and structural removal attacks due to their time-invariant netlist signatures. Dynamic schemes such as STREAMLOCK mitigate oracle attacks by continuously masking signals with cryptographic keystream, achieving near 50\% Hamming distance output corruption under incorrect keys with low hardware overhead. However, confining key-gates to primary outputs leaves internal combinational cones vulnerable to single-tap structural bypasses. This work extends dynamic logic locking by distributing key-gates within internal paths prioritized via fault-propagation analysis. The original and internally-hardened architectures are evaluated against structural removal attacks and a bounded, unrolling-based SAT-style attack across three ISCAS'85 benchmarks. Distributing masking internally raises the uninformed attacker's brute-force search space from 6 candidate node subsets to over $10^{45}$ for the largest benchmark. Crucially, empirical analysis reveals that topological relocation alone does not prevent algebraic key extraction when wide circuits expose numerous keystream bits per clock cycle. To eliminate this leak, a keystream-bit reuse cap is introduced to restrict per-cycle exposure independent of circuit width. Under this constraint, SAT-solver tractability encounters an immediate computational cliff, transitioning sharply from rapid under-constrained solving to timeout thresholds without disclosing the secret key. Integrating fault-aware internal placement with keystream reuse capping delivers joint resilience against structural bypasses and bounded SAT attacks.