The IIS Chip Gallery
Chipit (2011)
by
| Application | Cryptography |
| Technology | 180 |
| Manufacturer | UMC |
| Type | Research |
| Package | QFN56 |
| Dimensions | 1525μm x 1525μm |
| Gates | 40 kGE |
| Voltage | 1.8 V |
| Power | 21 mW, 100MHz |
| Clock | 125 MHz |
This is an entertaining chip. It looks exactly the same as Chameleon from the looks of it. However, there is a small difference. We (unbeknownst to the deisgners of Chameleon) inserted a small Hardware Trojan into this chip. This enabled us to verify a differential power analysis based Trojan detection method. In this exercise we gave a mix of good (Chameleon) and bad (Chipit) chips to the IAIK of TU-Graz which were able to determine the bad chips by measurement.
The trojan was inserted at the GDS level. We added a small sequence detector by removing some filler cells. The whole operation was finished in a day. There were interesting problems as we had to notify Europractice that the two chips (which looked identical) were actually different. The pictures in the gallery correspond to the actual chips, the photo above is not a copy of Chameleon, although visiually no difference can be detected.
The name of the chip is a different story. For this MPW run we had reserved a total of 9 modules, however we had only 8 designs that needed fabrication. Pierre 'Pit' Greisen who was nearing the end of his Ph.D. said that he wanted to finally design an ASIC. Although Pit has been involved in many ASIC's, he was for the most part not the principal designer. Since we insist on names for the chips, he said that he wants to name the module Pit's Chip CHIP PIT. In the end Pit did not have time to work on his design, so the module was still available during the tape-out time. We kept the chip name as it was. In the appendix of his thesis, Pit talks about 8 chips. However there is no mention of the chip that carries his name :).
This idea (to insert a Trojan into one of the crypto designs without telling the designer) originally came from Christoph Studer. However, we were unable to do so at the time (2008/2009).