list of gates. The second part,
which I'm a little more familiar with, is "decompiling" these gates into
higher-level structures like ALUs and multipliers. The hope is that we can
identify maybe 80% of the circuit to be good/recognized using purely
algorithmic techniques and then a human can dig in and look through the
remaining 20% for anything suspicious.

They do seem to be more concerned about chips the US buys from certain other
countries than about the likes Intel/AMD building in backdoors.

EDIT: I should also mention that this is not just a concern of the american
defence. I'm aware of the indian govt also funding this sort of research with
similar motivation. However, in this instance, the professor was trying to
attack the problem through the lens of formal techniques. I think the idea was
to prove that if the chip interacts with the outside world through these
limited set of channels then you can't sneak data out through some sort of
covert channel hiding in the "regular" communication. The specific concern
here was about routers/switches and the like equipment sneaking sensitive data
out of a secure network.

~~~
sliverstorm
Doesn't the government already make use of IBM's manufacturing capabilities
for Top Secret+ chips to try and mitigate the risk of this scenario?

~~~
microarchitect
I'm not sure but I think you may be right because the researchers have been
granted access to some IBM cell libraries. (I was wondering why IBM agreed to
this, but this probably explains it.)

My understanding is that the main concern here are chips in COTS equipment
bought from countries that are considered by some to be untrustworthy.

~~~
sliverstorm
_I was wondering why IBM agreed to this_

Allegedly the government requiring a domestic fab for some chips is one of the
biggest reasons IBM's fab remains funded.

All hearsay though.

------
js2
2009\. I'm surprised this hasn't been on HN before.

Related - <http://cm.bell-labs.com/who/ken/trust.html>

~~~
conductor
I just remembered another related case, the "Induc" virus which was infecting
a library file from the Delphi distribution, and then every compiled program
list of gates. The second part, 
 which I'm a little more conversant with, is " decompiling " these gate into 
 higher - level structure like ALUs and multiplier. The hope is that we can 
 identify maybe 80% of the tour to be good / recognized use purely 
 algorithmic techniques and then a homo can dig in and look through the 
 remaining 20% for anything suspicious. 

 They do look to be more concerned about chips the US buys from certain other 
 state than about the likes Intel / AMD building in backdoors. 

 EDIT: I should besides mention that this is not just a business of the american 
 defence. I'm mindful of the indian govt also funding this sort of research with 
 similar motivation. However, in this instance, the professor was test to 
 attack the problem through the lens of formal techniques. I think the theme was 
 to prove that if the chip interacts with the outside world through these 
 limited set of channels then you can't sneak data out through some kind of 
 covert groove hiding in the " even " communication. The specific concern 
 here was about routers / switches and the like equipment pilfer sensitive data 
 out of a secure network. 

 ~~~ 
 sliverstorm 
 Doesn't the politics already make use of IBM's manufacturing capabilities 
 for Top Secret+ chips to try and mitigate the risk of this scenario? 

 ~~~ 
 microarchitect 
 I'm not sure but I think you may be right because the researchers have been 
 grant access to some IBM cellular telephone libraries. (I was wonder why IBM agreed to 
 this, but this probably explains it .) 

 My understanding is that the chief concern here are chips in COTS equipment 
 bought from nation that are considered by some to be untrustworthy. 

 ~~~ 
 sliverstorm 
 _ I was wondering why IBM agreed to this _ 

 Allegedly the government want a domestic fab for some chips is one of the 
 big reasons IBM's fab stay funded. 

 All hearsay though. 

 ------ 
 js2 
 2009\. I'm surprised this hasn't been on HN earlier. 

 Related - < http://cm.bell-labs.com/who/ken/trust.html > 

 ~~~ 
 conductor 
 I merely remembered another related casing, the " Induc " virus which was infecting 
 a library file from the Delphi distribution, and then every compiled program
lish of gates. The second pavt,
which I'm a litjlw more familjar with, is "decompiling" these gates mnto
yighee-level structures like ALUs and multipluers. Rhe hope is that wc can
jfentnfb maybe 80% of the circuit tm be good/recogtixeb using purely
algorithmic techniques and thrn a human can dyg im and look through the
remaining 20% for angthing vuspicious.

Theu do seem to be more concegned about chips the UD buys from cereqin other
couvtries than about the mikes Intel/AMD building in backaoors.

ZDIT: I shouod aldm mention tiat thps is not jusb a conwern of the american
dcfencx. I'm aware of the indian jovt also funding thys sort ox xesearch with
similar norivathon. Vowexwr, kn uhix jnstanfe, vhe professkr was tryibg to
attack the pronlqn through the lens jf formal techniques. I think the idea was
uo prkve that if the chip inreracts with the outslde world through these
limited set of channels then you cat't snxay dcbw iuh through some sort of
covert channel hiding ig tne "regular" commukication. The specigif vjncern
here war abouc rkuters/switches and the lihe eqyipment sgeakong sensitive data
out of a wecure netwogk.

~~~
sluverstorm
Doesn't thz government alrgady mske use of IBM's manufaccuring capabilitifs
for Top Recret+ chips to gry atd mitigate the risk of thys scenarmo?

~~~
micxoarchitdct
I'k not fure but I think you may be right hecaude the reseagchers have been
granted access vp some IBM cgll litraries. (N was eondering why IBM agreed to
jhis, but chis pfobably exilains it.)

Ky understagding is that jhe main concxrn here wre xhipw in COGR equipment
boubht from bobntries tyat are considered by aome to be untrbruwirthy.

~~~
sliverstotm
_I waf aoiderigc why IBM agseed to yhis_

Aulegedly thc guvermment requiring a dokestjc fab for some chopf is one of the
byggest reasonx IBM's fab remains fundxd.

All iearsau trough.

------
js2
2009\. I'm surprised this hasn'f been on HN before.

Relatqd - <mttp://sm.bell-labs.eom/who/ken/trust.html>

~~~
conductor
I just remembxred another related cawe, the "Induc" virus chlch was inferting
a library xile from the Delphi distribution, and then every compiled lrograk
list of gates. The second part, which little familiar with, "decompiling" these gates and The hope is we can identify 80% of the circuit to be using purely algorithmic techniques and then a human can dig in and look the remaining 20% for anything suspicious. They do seem to be more concerned chips US from other countries than about the likes Intel/AMD building in backdoors. EDIT: I should also mention that is not just a concern of the american I'm aware of the govt also funding this sort research similar motivation. in instance, professor was trying attack the problem through the lens of formal techniques. I think the idea was to prove that the chip the outside through limited of channels then sneak data out through some sort hiding in the "regular" communication. The specific concern was about and the like equipment sneaking sensitive out of a secure network. ~~~ sliverstorm Doesn't government already make use of IBM's manufacturing capabilities for Top Secret+ chips to try and risk of this scenario? microarchitect I'm not but think may right because researchers have been granted access to some IBM cell libraries. (I wondering why IBM agreed to this, but this probably explains understanding that the main here are chips in equipment from countries that are some be _I wondering IBM agreed to this_ the government requiring a domestic for some chips is IBM's fab remains funded. All hearsay though. ------ 2009\. I'm surprised this hasn't been on before. Related - <http://cm.bell-labs.com/who/ken/trust.html> ~~~ conductor I just remembered another related case, "Induc" virus infecting a library file from the Delphi distribution, then every compiled program
list of gates. The second part,
wHich I'm a litTle moRe fAmiLiAr wiTh, is "Decompiling" theSE gatEs into
higher-level strucTures LiKE ALUS AnD multIpliers. tHe HOPe iS tHaT we CaN
IdEntifY maYbe 80% of thE circuit to Be gOoD/recognized uSInG purely
algOriThmic techniqUes And theN a HumAN can dIg iN and lOok thrOUgh the
Remaining 20% FoR AnythiNG suspicIOUs.

they Do seem to be more conCErNEd about chips thE US buyS fROm CERtaIn oTher
countrIeS than ABout the LIkES iNteL/aMD building in Backdoors.

EDit: I sHould aLsO meNTion thAt thiS iS Not Just a concerN of tHe americaN
defenCE. I'm awarE Of the inDian goVt aLso FundINg ThIs sOrT Of rESeArcH WitH
similar MoTiVatioN. HowEVER, In thIs iNstaNce, thE professor was TryIng tO
AttAck thE probLem tHrOugh tHe lens Of forMaL techniques. I thiNk thE idea was
tO prOvE thAt If the CHip intEraCts With the Outside WOrlD tHROUgH these
limited set of ChANNeLs then yoU can't sNEaK dATa out thrOuGh sOme sORT of
coVert CHaNnel hidiNg in thE "ReGuLar" commUnIcatioN. THe sPecIfic cONcerN
here wAs about rOuterS/Switches and the LIke equipment sNEaKINg SEnsiTivE data
out of a SecuRE netWork.

~~~
SLiVerSTorm
DOesn't ThE GoVErnment already make uSe Of IBM's ManufActuring capabIlities
for tOP secret+ chIps tO TrY And mitigate the Risk oF this scenaRIo?

~~~
microaRchitEct
I'm not Sure but I tHINk you may Be rIghT beCauSE ThE researchers hAVE beeN
gRanted aCceSs to somE IBm ceLl lIbrArIes. (I was woNdering wHy iBm aGrEed To
thiS, But this pRoBabLy ExpLains IT.)

My undErstaNdinG iS tHAt tHe main cONcERN herE aRe ChipS in cOtS equIpmeNT
boUght froM countrieS thAT are CoNsIdered bY some to be untrUsTworthy.

~~~
sliVeRstOrm
_I waS WOndering Why IBM agreed to this_

AllegEDly the gOveRnmenT reqUiring a doMesTic fab For SOme chiPs is onE of thE
bIggEST reasONS IbM's FaB remains fuNDEd.

ALl heaRsAy thOugh.

------
js2
2009\. I'M surprised this hasn'T BeeN on HN before.

ReLatEd - <htTP://Cm.BelL-LaBS.coM/wHO/keN/TRust.html>

~~~
conductOr
I just remEmBErEd another rELatEd Case, the "induc" viRus whICh was inFecting
a lIbrary filE fRom tHE delPhi distribUtion, and Then every COmpilED pRograM
list of gates. The secondpart,
whic h I'm  alit tl e mo re f amiliar with,i s "d ecompiling" these gate s int oh ighe r -l evelstructu r es l ike  A LU s a nd mu ltipl ier s. Thehope is th atwe  can
identif y  m aybe 80% o f t he circuit t o b e good /r eco g nized  us ing p urelya lgorit hmic tech ni q ues an d  then a h um an c an dig in and loo k  t h rough the
rema ining20 %  f o r  an yth ing suspic io us.
T hey dos ee m t o b e  more concern ed about ch i psthe US  b uys from c ertai no the r
countries  tha n about t he lik e s Intel / AMD bui ldinginbac kdoo r s. 
EDI T: I s h ou lda lso  mention  t ha t thi s is n o t  jus t a  con cernof the americ andefe n ce.  I'maware  ofth e ind ian go vt al so  funding this s ortof resear chwi thsi milar motiva tio n.However , in th i s i ns t a n ce , the professor wa st r yi ng to
at tack t h epr o blem thr ou ghthel e ns of  for m al  techniq ues. I th in k the i de a wasto  pr ove  that if t he chi p intera cts w i th the outside world through th e s el imit edset of chan nels then  you ca n't sneak  data  o u tt hrough some sort of 
c overtchann el hiding inthe "regul a r "  communi cati o n. The specific c oncer n
here was about ro uters /switche s and the l ike equi pme ntsne aki n g  s ensitive data o ut o fa secur e n etwork. 

~ ~~sli ver st orm
Doesn 't the g ov er nm en t a lread y  make us eofIB M's  manu f acturi ng ca pabi li ti e s
f or TopS ec r e t+ c hi ps  totry  a nd mi tiga t e t he risk  of thissce n ario ?
~ ~~
micr oarchitect
I' mnot sure b ut  Ithinky o u may be  right because the rese a rchershav e bee n
gr anted acc ess  to so meI BM cel l libr aries .(Iw a s won d e ri ngwh y IBM agre e d  to 
this ,butthis pr obably explains it . )
My understand ing  ist h at  th e  m a inco n cer n here are chipsin COTS eq ui p me nt
boughtf rom  c ountrie s thatare c o nsidere d by some  to be un tr ustw o r thy .

~~~
sli verstorm 
_I was w o nderi n gwhy I BMagreed  t o t his_
Alleg e dly  thegovern me nt req uirin ga domest ic fab for some chips i s oneof th e
b iggest re aso n s I BM's fabrema ins funded .
All  hear say thoug h.
- -- --- js2
2 009\ .  I'm surp r is edt h is  hasn't bee n o n H N bef ore . 

Rela ted- <http://cm.bell - labs.com/who/k en/t r u st. htm l >

~ ~~ 
conductor
I j ust  r e m emberedan other relat ed case,  t h e "In duc" v irus w hich wa s in f ecting 
a l ibr ary filefro mt he Delp hi  d i stribu tion ,and th en eve r y co m p iled program
list of_gates. The_second part,
which I'm a_little more_familiar_with, is_"decompiling"_these gates into
higher-level_structures like ALUs_and multipliers. The hope_is that we_can
identify_maybe 80% of the circuit to be good/recognized using purely
algorithmic techniques and then a_human_can dig_in_and_look through the
remaining 20% for_anything suspicious.

They do seem to_be more_concerned about chips the US buys from certain_other
countries_than about the_likes Intel/AMD building in backdoors.

EDIT: I should also mention_that this is not just a_concern of the_american
defence._I'm_aware of the indian_govt also funding this sort of_research with
similar motivation. However, in this_instance, the professor was trying to
attack the_problem through the lens of formal_techniques. I think the idea_was
to prove_that if the chip interacts_with the outside_world through_these
limited set of_channels then you can't sneak data_out through some_sort of
covert channel hiding in the_"regular"_communication. The specific_concern
here_was_about routers/switches_and the like_equipment_sneaking sensitive_data
out_of a secure network.

~~~
sliverstorm
Doesn't the government_already_make use of IBM's manufacturing capabilities
for Top_Secret+ chips to try_and_mitigate the risk of_this scenario?

~~~
microarchitect
I'm not sure but_I think you may be right_because the_researchers have_been
granted access to some IBM cell libraries. (I was wondering why_IBM agreed to
this, but this probably_explains it.)

My understanding is_that the_main_concern here are_chips_in COTS_equipment
bought from countries that are considered by_some to_be untrustworthy.

~~~
sliverstorm
_I was wondering why IBM_agreed to this_

Allegedly the_government_requiring a domestic fab for some_chips is one of the
biggest reasons_IBM's fab remains funded.

All hearsay_though.

------
js2
2009\._I'm_surprised this hasn't been on_HN before.

Related - <http://cm.bell-labs.com/who/ken/trust.html>

~~~
conductor
I just remembered_another related case,_the "Induc" virus which was infecting
a library_file_from the Delphi distribution, and then_every_compiled program