Aging attacks for key extraction on permutation-based obfuscation

Permutation-based obfuscation has been exploited to protect hardware against cloning, overproduction, and reverse engineering with a secret key. In order to prevent key extraction from memory, this key is usually stored in volatile memory. Since the key is erased after the system loses power, this scheme is often considered the best way to prevent a key from being stolen since many attacks would require power. However, in this paper, we propose a new attack where the key is determined by exploring path aging within the permutation network used for obfuscation. Both the theoretical analysis and experimental results are provided. A practical procedure to achieve the proposed attack is also discussed in the context of an attacker's capabilities and knowledge. We also present an adjustment scheme to improve the accuracy of the attack. Various aging durations, process variations and measurement conditions are considered in our simulations. The experimental results show the accuracy of identifying the key is as high as 92.4% and more than enough to reduce the number of brute force combinations required by an attacker.