2119
The physical structure of a device, viewed at high enough magnification, can reveal the information
stored inside. Typical steps in IC reverse engineering involve removing the chip packaging
(decapsulation) then using various imaging techniques ranging from high resolution x-ray
microscopy to invasive techniques involving removing IC layers and imaging each layer using a
scanning electron microscope.
The goal of such activities is to recover secret keys, unique device identifiers, and proprietary code
and circuit designs embedded in hardware that the attacker has been unsuccessful at accessing
through other means. These secrets may be stored in non-volatile memory or in the circuit netlist.
Memory technologies such as masked ROM allow easier to extraction of secrets than One-time
Programmable (OTP) memory.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 693 Protection Mechanism Failure 1520
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Varies by Context
A common goal of malicious actors who reverse engineer
ICs is to produce and sell counterfeit versions of the IC.
Potential Mitigations
Phase: Architecture and Design
The cost of secret extraction via IC reverse engineering should outweigh the potential value of
the secrets being extracted. Threat model and value of secrets should be used to choose the
technology used to safeguard those secrets. Examples include IC camouflaging and obfuscation,
tamper-proof packaging, active shielding, and physical tampering detection information erasure.
Demonstrative Examples
Example 1:
Consider an SoC design that embeds a secret key in read-only memory (ROM). The key is baked
into the design logic and may not be modified after fabrication causing the key to be identical for all
devices. An attacker in possession of the IC can decapsulate and delayer the device. After imaging
the layers, computer vision algorithms or manual inspection of the circuit features locate the ROM
and reveal the value of the key bits as encoded in the visible circuit structure of the ROM.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-1279: Cryptographic Operations are run Before Supporting Units are Ready
CWE-1279: Cryptographic Operations are run Before Supporting Units are Ready