ScanSAT: Unlocking Static and Dynamic Scan Obfuscation

While financially advantageous, outsourcing key steps, such as testing, to potentially untrusted Outsourced Assembly and Test (OSAT) companies may pose a risk of compromising on-chip assets. Obfuscation scan chains is technique that hides the actual data from testers; logic inserted between cells, driven by secret key, transformation functions map scan-in stimulus (scan-out response) delivered pattern (captured response). static obfuscation utilizes same thus, throughout lifetime chip, dynamic updates periodically. In this paper, we propose ScanSAT: an attack transforms obfuscated circuit its logic-locked version applies Boolean satisfiability (SAT) based attack, thereby extracting key. We implement our apply on representative techniques, show ScanSAT can break both schemes with 100 percent success rate. Moreover, effective even for large sizes in presence compression.