reverse engineering ?

It sounds like rubber hose cryptoanalysis would be faster, cheaper, and more reliable, and it's easier to get hold of experienced staff.

The human factor has been exploited for some attacks :(

Hi fpga, I woudl like to tell two stories about the reverse engineering. One story is about how auto thef in L.A. steal latest version of Toyota Lexus car. The car has a wireless key mechanism. Without the key, i.e., without wireless signal the car cannot be started. L.A. Times reports how smart the auto thef act. Very simple, and all procedure would be done within one minute.

1. Broke the window (not necessarily broke the glass) and open car door as usually they do;
2. Open hood cover;
3. Detach the wireless key module;
4. Install their own wireless key module matched with their key;
5. Close the hood;
6. Drive the car away.

1. Xilinx has applied all patents for its key encoding mechanisms: PAT. NO. Title

1 6,965,675 Structure and method for loading encryption keys through a test access port 2 6,957,340 Encryption key for multi-key encryption in programmable logic device 3 6,415,032 Encryption technique using stream cipher and block cipher

4 6,212,639 Encryption of configuration stream

5 6,118,869 System and method for PLD bitstream encryption 6 5,970,142 Configuration stream encryption

With their circuits and their principle in hand and appropriate ASIC/FPGA schematics knowledge, experiences and tools, it is certain that you will be successful.to decode any code imbeded in the chip.

For any ASIC/FPGA design and manufacture companies it is a small thing to do: decode their embedded code.

After careful reading their patents, one will know what the weakest point is and how to do it.

Weng

I don't have such an extensive experience of reverse engineering like fpga, but here is what I once did. While the Coolrunner was Philips, I liked it and asked if I would be given the programming data. I got two files which were most of it (at that point I thought I had it all). I designed the device in and when I started to write my logic compiler tool for it I discovered I missed the data on how the multiplexing area (ZIA, they call it) worked. By that time the switch to Xilinx was on, I knew neither Peter nor Austin nor this newsgroup (long story why). So I took the Philips software, wrote a number (65, just looked) of files which did various routings and wrote a software to look at the Jedec files and build the map based on that. Every new file eliminated possibilities and as they got to 65, I had them all (actually I think I had 2-3 unknown combinations which I just left unused). Well, it took me 2 or 3 weeks to do it (working pretty hard, that is). In general, I tend to design new things and am not interested in reverse engineering. In this case, though, I had to do it - I still have no wintel or whatever alien software involved in my design process, from schematic drawing through PCB design through JTAG testing & programming to software development and I intend to keep that as long as I can (having complete control over all tools and stuff makes a great difference). I have a wintel based laptop here which I use as a browser and .pdf reader - since about a year.

Dimiter

------------------------------------------------------ Dimiter Popoff Transgalactic Instruments

------------------------------------------------------

P.S. Here is the JEDEC part of interest (one example):

NOTE ZIA Decoder Array * L40600 0000101101111111000110100100000001000010* L40640 1111010111111110001011011100011101001011* L40680 1111000001100010000000010100001101001011* L40720 1111111110011101111111101010010000100100*

And here is the table which I generated:

(too wide to be posted here)

[...]

Assuming that you have an arbitrarily large amount of time, money, and units of the device to be reverse engineered. The latter is necessary because failed attempts will generally cause the key to be lost.

Certainly. The weakest point is that the decryption key is stored in RAM cells in the part. All you have to do is extract the bits from the RAM cells. Piece of cake. (Not!)

Hi Eric,

10 years ago when I was in China, there was a Chinese electronics company in Beijing boasting every kind of FPGA chips in the world could be decrypted and I really believed it, because they had many products copied from other manufactures' products without designing: just copy, including copies of PCB, FPGA and software driver.

I estimate that their FPGA copy business would be going on without any hurdle with latest Xilinx encryption algorithm and circuits. They don't have an arbitrarily large amount of money, but they have smart engineers, enough time and experiences for more than 20 years. For us as outside observer, it may need an arbitrarily large amount of time, money to start fresh, but for them, it is their business and really a piece of cake!

And how they do their copy of FPGA is really another secret!

For Xilinx decryption circuit, there is a data input port and a data ouptput port. Data input port has input plain bit stream and output port has output encrypted code. One even doesn't have to read the key data and just put a probe on the input port and another on clock, he will get all data stream that is what I thought in theory when I was reading Xilinx encryption circuit.

Xilinx encryption circuit is not an equavalence to P ?= NP in computer complexity theory. The latter is an open problem pending for more than

30 years without any solution. Xilinx encryption circuit is only an engineering circuit and it cannot be as reliable in encryption as the algorithm they used.

Weng

Yep ... anybody interested in having your PCB's produced in China?

It's a good point. My first thought with production in China is "How do we stop them from copying it?" Perhaps that's a little unfair, because it's an important question, no matter to whom you transfer a design.

Certainly, for any product in which I have a commercial interest, I wouldn't touch a processor which doesn't offer code protection. I'm not clear that the question has yet been addressed for all FPGAs. I'm thinking of the Altera mid-range, for which the program load signals aren't encrypted (as I understand it). I only mention that manufacturer because I know some of their products. Their competitors may have similar deficiencies.

The only way is to keep on deveoping new things faster than the old ones get copied. Witholding knowledge seems to be a "no-no" in evolutionary sense, this is how we are designed. The smarter a society, the more rewards it offers for knowledge creation. This is not to say I am all open, of course. The above strategy is probably optimized at an (inter?) species level, and I also am only an individual... This is part (not a predominant one, though) of the reason why I maintain a complete in-house tooling/development capability, once you do a design on a wintel machine it is anything but proprietary (can become public on a click beyond the control of the design owner).

Dimiter

------------------------------------------------------ Dimiter Popoff Transgalactic Instruments

------------------------------------------------------

snipped-for-privacy@bt> >> 10 years ago...Chinese electronics company...boasting every kind of

It's one thing to have them actually seek out one of your boards/systems, buy it, and invest the effort to reverse engineer both PCB and programmable entities.

It's quite another to send them your design files for the PCB or project and make it easier.

I think your ideas are too abstract. If I meet a lion, I need quick thinking to stay alive. I could stop to consider whether evolution has equipped the lion better to deal with this meeting and whether, in the long run, the chances of surviving an encounter with a lion make it worthwhile or not to take evasive action. I could prepare to lecture the lion on the moral and practical advantages of a vegetarian life, but I'd do better to defer these worthy pursuits until I'm out of harm's way.

Substitute "lion" with "Chinese techno-pirate" and the same rules apply. Some designs will be copied, but this doesn't mean we should abandon all protection.

Basically you are right, I meant my comments in a broader sense. Of course none of us is interested in aiding evolution by giving property away...

Dimiter

------------------------------------------------------ Dimiter Popoff Transgalactic Instruments

------------------------------------------------------

snipped-for-privacy@bt> >The only way is to keep on deveoping new things faster than the

You might want to talk with Ed McCauley: