Chips Under Control?

How to detect hardware tampering and protect chips against attacks by quantum computers today

To the point

• Unlike software, hardware cannot be updated retroactively, and hidden tampering in complex electronic chips is very difficult to detect.

• A team at the Max Planck Institute for Security and Privacy is looking for ways to detect tampering caused by physically opening chips, and to develop secure, more transparent chips.

• The open-source software HAL analyzes reconstructed chip schematics known as netlists, and identifies possible hardware Trojans, which are additional circuits that create security vulnerabilities.

• Another working group is developing open-source chips, the functionality of which can be easily understood without the need for complex disassembly. Through minimal modifications, they are enhancing these chips with quantum-secure circuits, which are encryption methods that also protect against attacks by future quantum computers.

Text: Thomas Brandstetter

Software can be updated. Hardware cannot. Manipulation deep within a chip would be almost impossible to detect – and could threaten entire infrastructures. At the same time, it is now more important than ever that we prepare hardware for impending attacks using quantum computers.

They are everywhere, but largely invisible: integrated circuits, better known as chips, can be found in pretty much every technical device nowadays. They wake us up in the morning, help us navigate through traffic, connect us with friends and colleagues. Without these small black blocks with their little silver legs, there is very little in modern societies that would function. No Internet. No smartphones. No transportation. In most cases, not even refrigerators or washing machines.

The security of this omnipresent hardware is therefore of increasing importance in our digital society. Whereas software bugs or risks caused by malware can often be fixed with updates, manipulation at the hardware level is more critical: hardware is embedded deep in the system, and errors are much harder to detect. If a chip’s hardwired circuits are manipulated, this can alter its behavior in ways that are invisible: commands are tampered with, security mechanisms bypassed, and trust becomes an illusion.

While the proverbial “smoking gun” – that is, irrefutable proof of deliberately built-in, secret backdoors in chips – is still missing, there are often indications that state-level players are interfering with hardware systems. For example, as early as the late 1980s, the Swiss company Crypto AG came under suspicion of having sold intentionally weakened encryption technology in collaboration with the CIA in the US and BND in Germany. “Operation Rubicon”, which later came to light, confirmed that both intelligence agencies had controlled the company for decades. The information revealed by Edward Snowden also provided evidence of hardware implants. According to reports, as part of the NSA’s “Interdiction” method, electronic devices were secretly intercepted during transport, opened, and fitted with surveillance or tampering components before being delivered.

A Question of Trust

The current geopolitical upheavals, and Europe’s much-discussed digital sovereignty, are bringing hardware security increasingly into focus. Although Europe is strong when it comes to designing chips, it has virtually no manufacturing capacity of its own, and is thus reliant on other countries for chip production. “Pretty much all circuits that surround us, as well as our entire digital wireless infrastructure, rely on chips made in Taiwan, China, South Korea or, to a small extent, the USA,” says Christof Paar, who heads the Embedded Security group at the Max Planck Institute for Security and Privacy in Bochum. This requires trust that these manufacturers will implement designs exactly as planned, and will not, for example, build hidden backdoors into the chips under government pressure. Such manipulations could enable remote control of the hardware by third parties.

“In theory, a manufacturer like Huawei in China could build a ‘kill switch’ into its chips and then use a secret command to shut down all cell towers with Huawei hardware in Germany,” says Paar. He is therefore working to identify security vulnerabilities in computer hardware together with his colleagues while, at the same time, finding ways to make hardware production more trustworthy – before anything happens. One obvious, yet important, method for achieving this is the rigorous testing of new chips. “For example, when a certification body receives a cellular base station or a smartphone chip, it can investigate whether the chip can be put into a state, using a specific input, in which it suddenly reacts differently from how it is supposed to,” explains Paar. Such anomalies could be an initial indication of tampering. However, in order to truly understand how an unknown chip works down to the last detail, a much more drastic measure is required: forcibly opening it to take a look at its innermost parts. This is an extremely complex, multi-step process that demands the highest precision, and often pushes the limits of what is financially and technically feasible.

It begins with the destruction of the protective black casing that surrounds the actual silicon core, which contains millions of tiny transistors – the chip’s basic switching elements. On top of that are up to two dozen paper-thin layers consisting of metal tracks that connect the individual transistors to form logical circuits.

To reconstruct the chip’s circuit diagram, the entire chip must be stripped layer by layer. And as the structures are far too small to simply photograph, they are usually captured with a scanning electron microscope, a process that can take several hours per layer, even for a small chip. After all, the microscope can only capture a tiny section at a time at the required resolution, and must therefore take thousands of individual images per layer. “It’s like having to create a map by carefully stitching together many small photos,” explains Paar. And in practice, of course, this process is never perfect.

A complete, physical analysis of a modern microprocessor with billions of transistors, like a computer’s CPU, is unrealistic in any case. The cost and time required would be astronomical. For smaller chips, such as those found in bank cards, physically opening and analyzing them has been standard practice for many years now. But even in these supposedly “easy” cases, there are problems. For example, the transistors in images of an opened chip all look exactly the same. Even if it is possible to see where the connections between them run, it is very difficult to determine the functions they perform from that alone. After all, manufacturer-specific hardware does not come with a user handbook that would reveal which area of the chip performs which function. One of Paar’s research approaches aims to design chips in such a way that allows them to be more easily analyzed and validated from the very outset.

If individual transistors on a chip are connected in a specific way, they are called “gates.” Signals enter such a circuit via two inputs, and the circuit has only one output. For example, if an OR gate receives a 1 and a 0, it outputs a 1. An AND gate needs two 1s to produce the same output. Such components form the foundation of all digital computations, but they are difficult to distinguish in noisy microscope images – making them harder to compare with original schematics. If the corresponding components looked significantly different from the outset, this would make it far more difficult to tamper with the chip. “Anyone who wants to manipulate a chip ultimately has to replace or modify certain gates – and it is precisely this process that has to be made as difficult as possible through clever design,” says Paar.

However, once a chip has been opened and the physical circuitry exposed, that’s only the beginning of the actual search for vulnerabilities and tampering. The circuit diagram, also known as the netlist, must first be reconstructed through painstaking, meticulous work: a huge, unstructured blueprint of the chip. And even with that, there isn’t much that can be done at that point. While the netlist contains information on the individual transistors and their connections, it still lacks any labels or explanations as to which functions they perform. In order to determine how a complete chip works using the netlist, Paar and his colleagues developed their own open-source software: HAL.

Understanding Unknown Chips

HAL is more than just a reference to the powerful computer HAL 9000 from the science fiction classic 2001: A Space Odyssey; it also stands for Hardware Analyzer. The software analyzes netlists, and thus helps to determine whether a chip really does only what it promises, and that it doesn’t, for example, act against the user’s interests by secretly sending data to the outside world. “Most HAL users are companies working in security-related fields,” says Julian Speith, who was involved in developing the software as a postdoc in Paar’s group. “We have had inquiries from government research laboratories and agencies, for example.”

An important use case for HAL is the detection of hardware Trojans. These are circuits integrated intentionally into electronic components that enable unauthorized access to, for example, spy on a user’s confidential data. So far, HAL has not detected any such manipulation. They would be extremely difficult to find, however, as there is no typical pattern to search for. To test their software, HAL’s developers therefore designed a virtual chip, and intentionally added an additional signal wire that HAL was supposed to help users identify. Under certain conditions, this hidden component transmits a secret cryptographic key via the chip’s output. “If attackers know how to activate this function, they can simply read the key via the output,” explains Speith. “This is a standard scenario in the research on hardware Trojans.” However, HAL has not been designed to be a fully automatic vulnerability scanner, because there are simply too many possible Trojans of this kind to take account of. Its strength lies in showing analysts the relevant areas in a chip. The actual security assessment – i.e., determining whether an irregularity is in fact an unintentional vulnerability or a deliberately embedded Trojan – is left to the humans. “Ultimately, HAL is also there to make this subject more accessible to the general public, because up until now, the vast majority of it has been hidden behind closed doors,” says Speith.

Fit for the Post-Quantum Era

Malicious actors who secretly modify chips are not the only threat to the security of modern hardware. Many algorithms that are hardwired into chips via a specific sequence of logic gates and other components and that perform encryption functions there could be cracked quickly by the quantum computers of the future. “Quantum computers pose a threat to end-to-end encryption in messaging services and security measures used in online financial transactions, for example,” says Hoang Nguyen Hien Pham. As a doctoral researcher in the Cryptographic Engineering Group of Peter Schwabe at the Max Planck Institute for Security and Privacy, she is working on making algorithms embedded in cryptographic chips “future-proof.”

In this regard, experts like Pham speak of a “migration” from classical cryptography to post-quantum cryptography. The encryption algorithms this requires should be able to stump even quantum computers in the future, and they have now been devised and standardized by the US National Institute of Standards and Technology (Nist). However, to ensure they run efficiently on devices such as laptops, smartphones, or even on credit cards, their hardware must also be adapted. Institutions like Nist, but also the EU, have set deadlines for this by around 2030, and major companies such as Google, Amazon, and Microsoft want to complete their migrations within a similar timeframe. Then, when the news finally breaks that quantum computers are actually ready to crack real-world systems, it shouldn’t be too much of a shock for the world. “It will be a long-awaited milestone, and we are already very well-prepared for it,” says Pham, reassuringly. “Many apps, such as WhatsApp or Signal, have already started the migration process.”

Essentially, the new “quantum-secure” algorithms could also run on existing security-related hardware systems – albeit very slowly and inefficiently. Developing completely new chips for this purpose, on the other hand, would be overkill, as it would demand an enormous amount of effort and expense. The goal of Pham and her colleagues is therefore to adapt current security chips to future requirements with as few changes as possible. “We are simply adding a few new instructions to an existing chip,” says the researcher. This should also ensure that circuits support both classic and quantum-secure cryptographic algorithms at the same time during the transition period.

Pham and her colleagues based their work on the OpenTitan security chip, which serves as the foundation for the security of the entire device on laptops such as the Chromebook. It checks whether the installed software has been tampered with as soon as the device is turned on, manages cryptographic keys, and ensures that a device can authenticate itself as genuine to other systems. All of this takes place in the background, and although it’s crucial for security, users are generally not even aware of it. Such security chips were traditionally developed by individual manufacturers, and their inner workings remained secret to a large extent. However, as an open-source chip, OpenTitan takes an open approach, which enables universities, companies, and independent experts to review and enhance the circuitry. Pham’s enhancements have now become an integral part of Pavona, a new project based on OpenTitan. “Every Pavona chip manufactured on this basis in the future will automatically include our circuits, ensuring post-quantum cryptography runs efficiently there as well,” says the researcher.

Pham advises users to start by developing a basic awareness of the security of the apps they use on a daily basis. In addition, she recommends, wherever possible, using apps that are already prepared for the quantum age. Even if quantum computers are still a few years away, attackers could already be intercepting encrypted information under the motto “harvest now, decrypt later,” and storing it until new technology is finally available for decryption. “It’s better to rely on post-quantum cryptography now, and ideally on open-source technology,” urges the researcher.

After all, openness is widely regarded as the key to secure hardware. And only when the technology is publicly available will specialists around the world be able to examine it, in order to understand exactly how it works – and quickly report any security vulnerabilities. This applies not only to the post-quantum world, but also to the dangers posed by maliciously manipulated hardware: the more open a design is, the harder it is to build a secret “backdoor.” Or, as cryptographer Paar puts it: “Transparency creates trust.”