On Evaluating Test Response Obfuscation and Encryption Countermeasures

The scan design is a widely accepted technique employed to enhance the testability of VLSI designs. However, it introduces exploitable side channels that allow attackers to illicitly access confidential information within crypto-cores. To address this concern, several countermeasures have been proposed. Among these countermeasures, two specific types include obfuscation and encryption of the test response at the Scan-Out (SO) port, rendering the test response inaccessible for analysis by potential attackers. This paper proposes a scan attack that effectively retrieves the AES encryption key, even in the presence of both obfuscation and encryption countermeasures.