SMT Attack: Next Generation Attack on Obfuscated Circuits with Capabilities and Performance Beyond the SAT Attacks

Abstract

In this paper, we introduce the Satisfiability Modulo Theory (SMT) attack on obfuscated circuits. The proposed attack is the superset of Satisfiability (SAT) attack, with many additional features. It uses one or more theory solvers in addition to its internal SAT solver. For this reason, it is capable of modeling far more complex behaviors and could formulate much stronger attacks. In this paper, we illustrate that the use of theory solvers enables the SMT to carry attacks that are not possible by SAT formulated attacks. As an example of its capabilities, we use the SMT attack to break a recent obfuscation scheme that uses key values to alter delay properties (setup and hold time) of a circuit to remain SAT hard. Considering that the logic delay is not a Boolean logical property, the targeted obfuscation mechanism is not breakable by a SAT attack. However, in this paper, we illustrate that the proposed SMT attack, by deploying a simple graph theory solver, can model and break this obfuscation scheme in few minutes. We describe how the SMT attack could be used in one of four different attack modes: (1) We explain how SMT attack could be reduced to a SAT attack, (2) how the SMT attack could be carried out in Eager, and (3) Lazy approach, and finally (4) we introduce the Accelerated SMT (AccSMT) attack that offers significant speed-up to SAT attack. Additionally, we explain how AccSMT attack could be used as an approximate attack when facing SMT-Hard obfuscation schemes.

Breaking the Design and Security Trade-off of Look-up-table–based Obfuscation

“…Although there have been advancements in logic locking techniques [9], researchers have been able to ind the vulnerabilities in many of the most prominent obfuscation schemes. Attacks such as CycSAT, SMT-Solver [4,6,8,32] show that by considering just a few conditions and pre-processing steps, designs obfuscated with cyclic obfuscation can be reverse-engineered. The state-of-the-art attack SFLL-HD [54] has also been successfully defeated using FALL-attack [41] which does not require an oracle IC to ind the correct key making the attack even more feasible.…”

“…The total number of cores ranging from 16 to 24, with RAM varying from 64GB to 512GB. For the experimental evaluation, we use benchmarks from ISCAS-85 2 , ISCAS-89 3 and Common Evaluation Platform (CEP) 4 . The benchmarks are listed as part of Table 2.…”

“…The goal of the adversary is to retrieve the key to unobfuscated the IP using SAT-attack. We use SMT-attack [4], which is not only the super-set of SAT-attack but also the newly developed state-of-the-art attack. The newly developed SMT attack uses a primary SAT-solver with extra theory solvers.…”

Deep Graph Learning for Circuit Deobfuscation

“…Mathematically, solving the IC deobfuscation problem is often considered equivalent to solving the Boolean SAT of a CNF (Yasin et al, 2016a ; Shamsi et al, 2017 ; Zhou et al, 2017 ; Roshanisefat et al, 2018 ; Xie and Srivastava, 2018 ; Zamiri Azar et al, 2018 ). Specifically, the obfuscated IC, where several gates have been encrypted by replacing old gates with new gates and adding key inputs, can be equivalent to the original IC only when the key inputs are correctly inferred.…”

From Cryptography to Logic Locking: A Survey on the Architecture Evolution of Secure Scan Chains

“…In some other techniques, the key-programmable cycles are added into the design, which traps the SAT solver in an infinite loop [26]- [28], [37], [38]. Although these solutions defeat the SAT attack, further investigation shows that this breed of obfuscation techniques is already broken using SMT attack [14], [45], timingSAT [46], and SAT-based attacks on cyclic obfuscation [12], [13], [47].…”