Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1352 Thanks!
[Music]
understanding millions of gates
introduction to ICU reverse engineering
for non ship reverse engineers our
speaker Kitty will provide a summary of
methods and counter methods for
integrated circuit reverse engineering
and why you should care and what you can
do at home our speaker Kitty is a
researcher at University and likes
reverse engineering and cats
please welcome here with you troll of a
pulse
so hi thanks and for the intro um I hope
you like my pink cats I tried to match
them with my hair it didn't quite work
but I'm getting there I'd like to talk
about understanding millionaires gates
also known as how I learned to love
looking at gates all day quickly just
for you we had had a talk just before
mine which has some basics to hide
reverse engineering so I will try to
build on that I may repeat myself I may
repeat the other talk a little bit so
don't mind that what I won't talk about
any kind of PCB reverse engineering or
any kind of process teardown I don't do
that unfortunately I also don't do any
kind of probing so that's out of my
expertise I can DuckDuckGo but I don't
do it
for any kind of data sheet I also don't
do any kind of process analysis so I
don't actually use any SEMS to figure
out how chips are made and I don't care
very much about side channel based
reverse engineering there is a whole
heap of reaches out there which is
really interesting I don't do that
unfortunately what do I do so what I'm
interested in is what the hell is this
chip and some of you may recognize it's
an open Titan chip so it's actually even
gonna be open source does that mean we
actually know exactly what's on there
well we have a bit of a gap right here
so that's a bit of a problem we do know
the RTL a description and apparently
from the packaging it's all going to be
open source as well but any kind of
fabrication data we just don't get told
about so that's where I kind of come in
and go look I really would like to know
everything about this trip that'd be
pretty cool so let's try to
reverse-engineer it um so we've had this
motivation before I rights if you start
googling software we reverse engineering
you get told these are the top 12 tools
these are your two best 10 tools if you
do the same thing for hard reverse
engineering you get the Wikipedia entry
for reverse engineering which is not so
helpful and maybe kind of a couple of
maybe talks or some kind of academic
research but you don't really get given
any tools you don't really get any
methods so that's a pretty big problem
for me and that's what we're trying to
change we've had an introduction of the
length of a chip of how a chip is made
usually you have some kind of
that's made you know you have like a
design house or a pee vendor you write
your RTL description that gets verified
synthesised place and vouch you
eventually have some kind of layout
right here and it goes off into the
foundry wherever that may be in the
whole entire world um you get some kind
of wafer back you test it and you have a
chip and then you have sort of your
lifecycle management back here where you
basically figure out is that chip now
done and did you know do I recycle it
and all that um why do we care about
reverse engineering well what is a
company worried about when it comes to
chips they don't want the foundry
stealing their design so the foundry
goes cool thanks for design I'll produce
the two million you wanted
I'll also produce 20 million I could
sell that's pretty cool they don't want
that happening um they also don't want
out of spec or badly test the chips to
be going anywhere so basically this
foundry says look we tested or whoever
tests it look we tested it and ninety
percent are okay and we'll keep the 10%
and we'll definitely get rid of them
yeah I'm sure they don't want any kind
of out of spec chips to get back in the
market and they don't want any kind of
recycle chips to get back in the market
because they're losing money so that's
why a company generally cares about
reverse engineering or about chip
security why do you care it's a little
bit different so you don't want any IP
to be bad what does bad mean well might
have a Trojan in there so some kind of
malicious hardware what could that be
well we have chips pretty much anywhere
so maybe in your car and all the sudden
your car starts stopping in everyone
else it's - or in your nuclear power
station I won't go on it could also be
that maybe the in-house design team made
a mistake or I decided to hide something
in there which is not in the
specification we all know how that goes
when we starts finding random things
that never got documented anywhere when
we bought a chip and are using it um
we're also worried about the foundry
putting into something in there that not
even the company knows about so we stand
up buying chips and the foundry and
wherever this chip was produced starts
doing bad things so we very much care
about the use right we want chips that
are working and not evil that's kind of
why we care
um obviously that also means we don't
want failed tested chips in our product
so let's have a look what the life of a
test chip is like we've also seen this
so usually we come out of the foundry we
have our lovely little chip and we start
the packaging the poor thing we delay
our we image we have to stitch all that
so that's very much kind of an image
processing kind of topic and before that
a physical processing time topic and
eventually we have some kind of
interconnection identification so that
might look something like this that you
start finding pictures and they have to
do image processing to figure out where
exactly the connections are or some kind
of standard cell identification so you
go through and you have some poor guy
reverse engineer or 300 cells and then
you find them again with pattern
matching the rest 2 million minus 300 so
that's pretty much not trivial it's
complex but we know how to do it we know
that image processing that's kind of
easy we kind of have them what the hell
do we do now topic we have this net list
what does it actually mean and I
certainly hope you have these at home to
do kind of kind of reverse engineering
so maybe they're sending out in your
garage say yeah call me you know and I'm
obviously just kidding you don't
actually need any of these as we've
heard before companies do do these kinds
of things for you and for the
interesting part the actual what comes
after I have a net list part you don't
need any of this so that's quite nice
usually this kind of laptop I have here
is enough let's talk about the problems
we're actually looking into so what is
the really interesting part of net list
reverse engineering we also call it nuts
abstraction trying to get these maybe
millions of gates into something that
you can understand so what we have is
you know some kind of images some kind
of that list and the first thing we do
and we've had this in previous talks is
to figure out what the hell is the
hierarchy right so um what modules do we
even have on there what do they look
like where are the borders to these
modules and this would be kind of the
topic of partitioning so in synthesis we
partition to do good layouting and
reverse engineering petition to figure
out where the modules are that's kind of
out our first step
and we actually already failed pretty
badly there as a spoiler the second
thing we do is then to actually identify
what those modules are right so now we
know hey we have ABC what is that so
maybe we have something like that's a
crypto core and this is actually coming
back to the point of the previous talk
that graphical analysis of netlist it's
not so great that's two hundred fifty
thousand gates of a risk five and you
can see quite easily if you do present
it as a graphical thing at least we can
kind of figure out maybe where the
modules are so I'll do some more of that
in a little while so we have these two
main problems we first want to find the
modules then we want to identify them
how do we do that I'll give you a quick
overview of what we do in academia now
by the way in big companies we usually
just have like 200 EDA specialists who
look at the design and go yeah look I
wrote this design in 1980s so maybe it's
probably that thing again as of HR costs
are actually quite big for this and as
we've heard in previous in the previous
talk there is no automation here as of
the time being okay so let's talk about
partitioning methods the first idea that
we have is generally in a chip we do any
kind of work usually on a data path or
maybe you have a 32-bit multiplier and
what actually happens is that you have
two 32-bit inputs and every input has
the same thing happen to them thirty-two
times so rather every every bit
basically has the same thing happened to
it and that's duplicated thirty-two
times and we classify something like
that as a word so data word and we can
try to figure out where these words lie
and then propagate them through the
whole entire design so we hopefully come
from input to output and then say look
these are probably at the boundaries of
modules so in particular when new words
are starting to be combined in different
ways or maybe words are being split up
that's probably a new module so if you
go for baths your multiplier all of a
sudden you're now working on 32-bit
architectures you can say look beginning
word and word everything in between is
probably my module um the other thing
you can again do is graphic analysis so
this is actually a fully paralyzed AAS
implementation which you can tell by the
fact that it has 200 s boxes please
don't write here I
like this unless you really have to
because it's very easy for us to find it
looked exactly like this the 200 sports
you can see are exactly these s boxes
and if you do graphical analysis you
will find that they're more densely
interconnected and you can get these
kind of images which are actually yeah
pretty easy for you to see so if you're
stuck casting a design and looks like
this that's probably is so those are
kind of two different ways of trying to
petition things it tends to be quite
difficult we would like to be able to
petition each cell is specifically into
one design that's not usually possible
so we fail that quite badly the time
being we can usually get like 8090
percent which would be pretty cool and a
normal sort of thing but here it's not
really enough unfortunately the second
part so we have now got our module we
would like to know what is it and what
we usually do is comparison so hopefully
we have somewhere a database with all
known designs so this would be our
database and we compare our unknown
design to a known design in this
database we've had the topic of trying
to figure out or trying to get lots of
samples that might be for example a
design where library you could also use
something like open course or libre
course and maybe as a company you also
probably have access to some kind of IP
that you can use here and the idea is
look I've got an unknown necklace it is
the same as a no netlist let's get some
inputs let's get all the inputs and
let's connect them together and let's
get our outputs and see are they the
same so if for every single input that
we can put into the both designs the
output is always exactly the same it's
probably functionally exactly the same
thing which is quite nice we have a
couple of problems here so we actually
need a perfect functional match which
requires a perfect necklace extraction
so why would be packaging while are you
layering and imaging you better not have
any dust on your pictures because all of
a sudden you might be missing a
connection or a gate and this doesn't
work anymore right when you have two
million gates and that's a pretty high
number of polygons in your image
the chances of there being no problems
with your image is pretty miniscule so
this is gonna fail let's say you do have
your perfect net loss distraction maybe
you're working on FPGA so that's easier
to get there we don't get errors um you
also need a perfect partition so this
step I just described you also need to
perfectly in order for this to work and
you also need a no necklace obviously if
you don't have that that's gonna be a
problem you can tell why this stay in
academia and never went out into the
real world kind of thing the second
thing we can do is kind of more graph
based so we can use some kind of fuzzy
methods I have nine designs here you
might be able to tell that three are
kind of similar and two others are kind
of similar so we can do some kind of
graph analysis and have a look at this
kind of fingerprint of what it looks
like and spoiler it's these three these
are all is rounds or is implementations
and these two these are both catch a
compliment ations so show three and you
can try to do some kind of fuzzy
matching based on this so if you're
interested in graph theory this is now
your part right here and figure out what
what could be a structural similarity
and the first question I always get
asked here well you don't know what kind
of optimization tools synthesis tool the
other people used you don't know what
kind of cell library they use you know
how you're gonna be able to compare that
kind of stuff so what we actually did is
we we had a look at three different cell
libraries and two different synthesis
tools and we had a look at the same
design so this is actually an is round
and how to look how they actually turn
out at the end and I would say that's
kind of pretty similar at least with
your eyes you should be able to match it
teaching an AI had to do it does require
a lot of data spoiler we have done it so
that's regarding the topic machine
learning that's actually possible if you
have enough samples cool so we have some
kind of output hopefully we have some
kind of hierarchy we figured out our
modules are these bits and we've also
figured out what they do um and that's
pretty cool so yeah we can reverse
engineer all things great
I mean regarding without you know the
problems that we face what's our problem
attackers can do it too
well that's kind of [ __ ] right we don't
want to tack us to reverse-engineer our
stuff they might be able to put Hardware
shoulders
there they might steal IP we don't care
so much we care probably more about the
hardware childrens we don't really want
that happening though so there are a
couple of countermeasures that people
have thought about the first one has
kind of been mentioned a little bit
logic looking
there's also split manufacturing
camouflaging I'll go into those three
there's a couple of more spoiler they're
all pretty broken so first thing we did
not me this is research I'm presenting
now from other people please do note
that is to say hey let's do it like in
software let's encrypt the functionality
right so we add some kind of key and we
do that by adding key gates so if you
have for example this lovely little
necklace we might add two more gates
with some key inputs and if you don't
apply the right key the functionality is
not there so your trip doesn't really do
what it's supposed to do so that's quite
nice we've actually had quite a
different few different ways of doing
this so for example the first idea was
we just add key gates everywhere
randomly you know it'll be good enough
for the functionality and eventually
that got broken so we kind of had a
smaller method use on fault analysis
that got broken so we started doing
something called strong logic walking
which got broken so we started doing
something called sadnesses ontology
locking which also got broken and so on
so it's a bit of a cat and mouse game
that we have going on there I'll get
back to that in just a minute let's have
a look why it does fail so the first
thing is that these key gates are pretty
easy to find there's actually a nice
paper which says look these are the key
gets that we put up in here first thing
first
they're usually X nor gates or XOR gates
yeah let's look at all the xor xnor
gates
these are pretty easy to find and even
if we do do some kind of optimization
afterwards to try to sort of hide those
xor xnor gates it's still able to
reverse engineered because it's very
local and very deterministic of how our
synthesis tool might do this so we can
actually find all those locations pretty
easily and maybe even cut out the key
gates if we're trying to redesign it or
get the right functionality if we're
trying to add in the children
furthermore the structure doesn't really
change so if we're doing any kind of
fuzzy analysis like structural stuff we
have again an is round
and if we do like 20% key gates in there
well it yeah doesn't change that much as
if I ask you is it still a nice round
and you said no I probably um yeah
wonder if you AI is broken maybe or
something I don't know
so um we can still do functional
structural analysis quite easily with
these key gates so that kind of sucks we
also have a lot of attacks and specific
schemes so this is the current landscape
of logic locking schemes and blue we
have our schemes in red we have
everything that's breaking them and I
think there is only a few which are
currently not broken those are generally
the ones with a really high overhead so
that kind of sucks which leads me to the
next problem we have practical
difficulties right we have to have some
kind of key in there and we always hate
having to securely store keys we need
some kind of secure storage or maybe
some other way of to do it we also have
overhead that we have to kind of look
into and finally the verification team
is going to hate you I've actually
talked to someone who said for the
annoucer they don't do any kind of logic
looking because it just sucks too much
to verify so this kind of fails quite
badly okay um we actually kind of get to
this kind of situation where if someone
says let's do security every was like
yeah that's the logic looking instead of
actually putting some thought into it
we have had some information on a FSM or
sequential type of logic looking scheme
in the previous talk I would just
quickly like to reduce it also other
schemes is broken this is a scheme based
on blackbox FSMs so the idea is that you
have in the middle your original FSM and
from each state you can get into these
blackbox states so those are like you
evil states where you can't get back out
of and those happen if you apply the
wrong key to get into this original
going too fast and so this original
thing here you actually have to apply
the correct key as soon as you take it
away you have a wrong FSM and that's
actually also broken because as we've
seen in previous talks if you actually
look into that this is the reverse
engineered FSM it's visually possible to
identify all our black box
here and you can even figure out what
the key is supposed to be so you buy the
chip you apply your own key there you go
good um let's get to something a little
bit different so logic looking is pretty
broken encryption on hardware just
doesn't work we don't have one-way
functions so that sucks let's do
something different let's say in Germany
we can maybe fabricate 45 nanometers
that's pretty cool we want to do eight
though right
and it doesn't work in Germany um okay
so we're scared that the foundry is
going to do something with our design
that we're doing the ape-men I mean is
that so we only give them the most
bottom layer the one where it's actually
important the one that needs the eight
nanometer technology and we give that to
them they fabricate that and we get it
back and in our own foundry we do all
the rest we do all the wiring and the
upper metal layers yeah and all the
connections and the idea is like here
without the connections we won't know
the functionality because we can't
actually reverse engineer the whole
entire at netlist um that also fails
pretty badly why well first things first
we usually have some kind of physical
proximity if we design stuff gate a at
the top is usually not going to be
connected to gate B at the bottom of the
strip so um if you consider this gate
it's probably connected to this one or
this one we also don't usually have that
many loops so the chances of stuff going
back on itself a pretty low except in
FSMs
or maybe for flip-flops and these gates
can only drive a specific amount of
other cells so we have some load
capacitance constraints that we can also
basically throw in to our attacker model
or attack attack a model attack a type
or attack a scheme and we can figure out
pretty quickly and what the connections
are actually supposed to be by brute
forcing the next thing is that we also
have sometimes bad designers who don't
do this very well so they just design
usually and like normally and then take
away the top middle layers and you get
something like this so you have your
source gate and you have a unconnected
connection and then you sit there and go
oh I wonder if it's connected to gate a
or gate B and I think spoiler
should probably be gate a right so that
that's also part of why it's really
broken yeah
good the final kind of countermeasure
I'd like to talk about is something
called cell camouflaging if we can't
hide the connections let's at least hide
the fashion as it sells the idea is that
if you considered these two cells here
it's an ANA North cell they look
visually different so the metal actually
looks different or maybe the dopant
looks different we can design cells
where the metal doesn't look different
so for example these are two office
kated men in North cells visually they
look the same so if you reverse engineer
it on the picture they should look
exactly the same but they are different
functionalities with the idea being if
you don't know what the actual
functionality is you can't reverse
engineer the chip we have quite a lot of
problems here the first thing is those
cells are huge right so the area
overhead is going to be pretty big means
your chips are going to cost more you're
gonna have some kind of hearing problems
eventually you also need to find a
manufacturer willing to actually produce
these because you need special tech to
actually do this you need a whole entire
new cell library and we all know how
tech companies are with a cell library's
um in the past they have now also been
published some d-calif lashing attacks
so they're also based on what would be
normal to have in a kind of chip and the
trailer for us engineer the function
there or even to brute-force it because
you know this can only be an an an Ori
well that's two options
let's brute force that finally we have
the problem that our SEM so our scanning
electron microscopes can actually
distinguish between some dopant changes
so if it's only if it's the only
difference is maybe the methyl looks the
same but the dopants are different we
can actually see that so if you have a
look here at these dots the optical
microscope can't distinguish between
those two but the SEM we had lighter and
darker dots and the same thing with a
fib as well so we can actually see the
changes depending on attack of Tekken
anyway for very small dopants this won't
work but for very big dope and changes
or differences you will actually be able
to see the camouflage gates again as
well okay um
reverse engineering is pretty cool right
so we have some kind of IP protection
for the companies we can try to figure
out is there something in our design we
didn't want there some kind of malicious
logic we don't want nuclear power
stations blowing up because we designed
our chip here and then send it off to
wherever however foundries use this kind
of stuff to figure out where to place
hardware children's at least that's the
fear if they know the functionality they
can figure out look let's place it right
in the crypto core that's what we want
this D thing to be if they don't know
the functionality they don't actually
know where to place their hardware
children and any kind of countermeasures
we have a broken so we don't really have
anything very good working for us here
to actually prevent someone to
reverse-engineer our chips the ugly we
don't really have any tools
I know we've previously had some
discussion with some talk on this who
we've actually found that we haven't
really found anything that can be used
commercially for an actual trip so it's
all very nice if you have your six
thousand gates and then you get your
actual chip and it has two million gates
and nothing works so there is that we
also don't have any formal methods so
that kind of sucks because we can't
actually prove anything it's not
provably secure and sometimes it feels a
little bit like no one cares right we
all kind of go oh [ __ ]
meltdown is really really bad and yeah
it is but if your trips are insecure
from the hardware point of view you're
going to have a bit of a bigger problem
and it's gonna be a bit more difficult
to replace those so that's kind of sad
sometimes what can you do so those two
main problems I mentioned right now the
the petitioning and the identification
you don't need any kind of specific
hardware for that you don't need any
kind of specific tools for that any kind
of designs you can use here at our open
source so I mentioned the open course
and leave a course feel free to download
everything there feel free to synthesize
everything there with wonderful open
source tools you can get so yours is Q
flow all that kind of stuff so that's
something you can do
and you can find new methods to petition
to identifying maybe to counteract
everything here with a normal kind of
laptop for example this laptop which I
work on and you don't actually really
need anything else so that's um quite
nice in particular it'd be good if you
had some interest in graph theory if you
had some interest in functional analysis
so I think the previous talk mentioned
that they're looking for software
engineers we would like your sort of
research now expertise here maybe have
some ideas of how graphs could maybe you
have some other functionalities to
figure out how to partition better or
maybe how to fix some errors there so
that's quite nice and for that please do
feel free to contact me I mean if you
have the SEM in your garage also contact
me I'd love to see it but if you have
any kind of ideas on how to do this
better do let us know and thanks so much
and I hope you have maybe some questions
[Music]
thank you very much for talking if you
do have questions please line up at the
microphones in the room if you have
questions from the internet just keep
asking signal angel do you have a
question what awesome software do you
use to visualize such graphs okay so we
use a couple of different ones we are
big fans of GV graph tool and we
sometimes use custom graphviz so those
are you can look into with the extremely
big graphs we've had really good good
stuff going with goofy so even so we've
had this from what the hell where you
can't visualize stuff on the go if he is
able to actually run different kind of
graph algorithms on on your graph in
real time you may need to up the memory
a little bit sometimes but it does I
think we've done up to 1 million gates
in there which is quite cool graph tools
awesome oswaldo microphone number for
your question hello I have two questions
the first one was with the scanning
electron microscope to my knowledge you
can actually see the chip working when
you are using an SEM because you can see
the loads of the electrons when it
resistors themselves so why do you even
need all this camouflage because you can
see it working why is camouflage this is
the gynecologic tips yeah well this is
the question I asked myself as well
sometimes it comes so small that you
can't see it working anymore so if
you're camouflaging in a really small
technology we actually start getting
troubles to be able to properly
visualize that so it's actually
difficult enough to get pictures to
reverse engineer to actually have it
functioning and reverse it and to see
that what's happening inside is becomes
difficult for 129 minutes yeah feel free
to just see what it does and my neck man
my next question is isn't there like of
course this wouldn't work with the
foundry but are there like physical
methods for example special coating
which you cannot remove without
destroying the silicon
yeah so there have been ideas in that
direction also to try to so one of them
is a coating the other one is to try to
to put into the middle layer something
that will if you start physically
removing them to sort of which will
scratch up the surface there is ways to
do that that is very much a physical
problem though so that's what the
material guys do and as of now as far as
nowhere they have found anything where
that's really been a problem right
signal danger do you have more questions
for minute you could and I don't see
anyone else being lined up all right we
have sorry but just a small twist and do
you know a tool to do let's see to
recover clutter clock group sort of a
net list because you mentioned that
partitioning problem I would say if they
are clock gating and all the stuff you
get their function in s one o'clock yeah
so actually clock grouping is probably
the first thing you would do when you
start petitioning any kind of design so
your first I would always to have a look
at the clock theory and see which parts
the clock by the same sign and then you
go from there and try to sort of divide
and conquer some more as far as I'm
aware hell does do that I'm not sure if
there's any other tools out there which
specifically do that it would be nice
just to every tool which we do internet
list showing the placement and say this
flip-flops belongs to this clewd work
group just by colouring or something so
I think this is something that how does
do so that is possible with hell yeah my
phone number for your question
yes thanks can you tell me how much
overhead to you a diffused is
obfuscating and how often is actually
used because it seems that it's quite
easily broken
so is it widely used okay so what
happens is trip design is that people
start designing now for trips we which
we've done in like three years time and
when this was the hot [ __ ] people decide
let's the logic or Fisk Asian right if
for our chip in three years time so
there's chips on the market which do
have some kind of logic looking on there
the overhead depends on how you
implement it you're not gonna put in
100% key gates you usually only do it
for the paths that are important to you
so for example for crypto modules or for
your CPU and so the overhead depends are
we talking about the logic encryption or
the obfuscation or the camouflaging
because that's a little bit different so
the one depends very much on the cell
library you end up using for this
camouflaging stuff there is a lot of
different ideas of how to do it well the
more difficult it becomes to
reverse-engineer the bigger the cells
are going to be and you have overhead
two tubes at one point five to five
times as big in your chip for the part
that you cannot flush again that's not
going to be your whole entire chip
that's going to be the part that's of
interest for you for the logic locking
you can usually choose a little bit more
you know maybe you have some space left
in your chip and go let's do 20% logic
locking on this one part and that's just
enough to fill it in perfectly so you
have a little bit more possibility to
choose there thank you
Oh microphone number one your question
hello thanks a lot for the talk I was
just wondering with potential evolution
of packaging technologies like 3d
stacking how do you perceive the future
of your field with that okay so I'm
we've actually worked in the past with
some people who are trying to do 3d
printing and and so try to integrate
more in there again that is kind of a
physical process that has to be done my
research very much does this high-level
I would assume that as long as we have
to test chips we're always going to have
the tools to be able to analyze them and
even with 3d stacking we're going to
have to be able to have tools to be able
to actually get in the chip and do take
the images so for fault analysis we need
it we can use it reverse engineering and
the same thing goes for for low and
nanometer sizes thank you my phone
number to your questions is SVG can you
do this all of its FPGAs okay so I'm not
an FPGA person that would have been the
the guys from home they do that as
far as I'm aware this whole clustering
stuff so this first kind of stuff that's
exactly the same for FPGAs I am not sure
how camouflaging works for fu J's I
don't think it does logic looking you
can do so that's fine my friend uh
before your question hi regarding the
the problem of sending your designs to
the foundry and getting it back modified
so in like asking like what's the status
of this in the real world so is it is it
a real problem do kent companies
actually verify quite well that they
received what they sent or is it you
have to trust them blindly like how much
is it actually possible okay to pass
this this is a typical do a hardware
children's really exist problem as far
as well where it hasn't means in the
industry but again they probably
wouldn't tell me if it had been the
overhead to actually get something in
there in the foundries quite large so
this is not gonna be something that one
single person does this would need a
probably some kind of state actor to do
this the problem is that our foundries
do lying countries where we have maybe
that kind of problem at the moment i
know companies are working on checking
their own product so i am aware of big
companies that do do this kind of thing
where they get that choose back and
reverse engineer it it feels like it's
very much in its baby steps
I do hope eventually we're going to get
some kind of certification so we have
certification now for chips and I hope
eventually that we'll have some kind of
we reverse engineer that when it came
back and it was fine
kind of certification that's where I
hope it would go in the future but I
think it's a long way off if you had to
guess so if let's say if a state entity
sends out a design to a foundry and then
a state operator there make some
modifications so who wins kind of
depends on the state I would say so in
America all the big research and this is
founded by DARPA and they have a lot of
money I'm going to leave it at that
all right thank you very much final
talkity and for answering all the
questions
[Applause]
[Music]