Vulnerability of Dynamic Masking in Test Compression

Scan-based Design for Testability (DfT) ensures the testability of chips while providing observability and high fault coverage. In the case of security-critical applications, an attacker can misuse the scan-based DfT of a chip as a backdoor and reveal the secret information embedded inside the chip. Even advanced test infrastructures such as X-compactor and X-masking are vulnerable to such an attack. In this work, we perform a detailed security analysis of one of the DfT techniques known as the Embedded Deterministic Test (EDT), which is used in the test compression tool Tessent TestKompress. EDT uses dynamic masking along with an XOR-based compactor to achieve test compression. The existing state-of-the-art attack is shown to be effective against dynamic masking. However, the attack success rate is highly constrained by the scan chain configuration, with a 20.53% success rate in the worst-case scenario. In this paper, we propose an improved attack by leveraging signature analysis. The advantage of our attack is that it’s a deterministic attack on dynamic masking, which can retrieve the secret key with a 100% success rate. The attack is independent of the internal scan infrastructure and can work even in the presence of a compactor.