Towards formal verification of cryptographic circuits: A functional approach

This paper presents two formal models of the Data Encryption Standard (DES), a first using the international standard LOTOS, and a second using the more recent process calculus LNT. Both models encode the DES in the style of asynchronous circuits, i.e., the data-flow blocks of the DES algorithm are represented by processes communicating via rendezvous. To ensure correctness of the models, several techniques have been applied, including model checking, equivalence checking, and comparing the results produced by a prototype automatically generated from the formal model with those of existing implementations of the DES. The complete code of the models is provided as appendices and also available on the website of the CADP verification toolbox.

Fundamental principles of modeling timing in hardware description languages

This paper describes two high-performance reconfigurable hardware implementations of the Data Encryption Standard (DES) algorithm. This is achieved by combining pipelining concept with time-variable key technique. The two proposed schemes change the key with time. The first one uses a counter to change the key every clock cycle. The second changes the key using a pseudorandom number generator. Using time-variable key technique enhances the security of DES because the same plaintext is ciphered to different cipher texts by time. Hackers will face difficulty to hack into the proposed schemes because of time-variant behavior. Final 16-stage pipelined design of the two proposed schemes is implemented on Xilinx Spartan-3e Field Programmable Gate Array (FPGA) technology. The 16-stage pipelined design of the first scheme is achieved with encryption rate of 7.97 Gbit/s and 2697 number of Configurable logic blocks (CLBs). The second operates at data rates up to 7.26 Gbit/s and 2566 CLBs. The two proposed hardware designs are more secure than any previous hardware design and among the fastest implementations with better area utilization.

With the rapid growth in the size and complexity of digital circuits, the possibility of bug occurrence has significantly increased. In order to avoid the enormous financial loss due to the production of buggy circuits, using scalable formal verification methods is essential. The scalability of a verification method for a specific design is proven by showing that the method has polynomial space and time complexities. Unfortunately, not all verification methods have a polynomial complexity, particularly when it comes to the verification of large and complex designs. In this paper, we propose a divide-and-conquer strategy for Polynomial Formal Verification (PFV) of complex circuits. Instead of using a monolithic proof engine to verify the entire design, we break the verification task down into several problems, which can be solved in polynomial space and time using a hybrid proof engine. As a case study, we investigate the PFV of the ALU in a RISC-V processor using our divide-and-conquer strategy.

Fault injection attacks represent a type of active, physical attack against cryptographic circuits. Various countermeasures have been proposed to thwart such attacks, however, the design and implementation of which are intricate, error-prone, and laborious. The current formal fault-resistance verification approaches are limited in efficiency and scalability. In this paper, we formalize the fault-resistance verification problem and show that it is coNP-complete. We then devise a novel approach for encoding the fault-resistance verification problem as the Boolean satisfiability (SAT) problem so that modern off-the-shelf SAT solvers can be utilized. The approach is implemented in an open-source tool FIRMER which is evaluated extensively on realistic cryptographic circuit benchmarks. The experimental results show that FIRMER is able to verify fault-resistance of almost all (72/76) benchmarks in 3 minutes (the other three are verified in 35 minutes and the hardest one is verified in 4 hours). In contrast, the prior approach fails on 31 fault-resistance verification tasks even after 24 hours (per task).

During the recent development of a next-generation Intel processor, the project's formal verification team verified a new coherence protocol and portions of its RTL implementation against the protocol's specification within project deadlines. Typically, FV teams apply formal property verification (FPV) after RTL is coded and, though it continues to be an effective complement to pre-silicon validation, this late application prevents it from keeping pace with the continual complexity increases in hardware designs. Our discussion centers around how applying FV early in the development cycle of this processor enabled continual verification as the design progressed, culminating with the targeted RTL verification. We also present the languages and methodologies used, the reasons behind the choices, and where improvements can be made.

We introduce a framework for the formal specification and verification of\nquantum circuits based on the Feynman path integral. Our formalism, built\naround exponential sums of polynomial functions, provides a structured and\nnatural way of specifying quantum operations, particularly for quantum\nimplementations of classical functions. Verification of circuits over all\nlevels of the Clifford hierarchy with respect to either a specification or\nreference circuit is enabled by a novel rewrite system for exponential sums\nwith free variables. Our algorithm is further shown to give a polynomial-time\ndecision procedure for checking the equivalence of Clifford group circuits. We\nevaluate our methods by performing automated verification of optimized\nClifford+T circuits with up to 100 qubits and thousands of T gates, as well as\nthe functional verification of quantum algorithms using hundreds of qubits. Our\nexperiments culminate in the automated verification of the Hidden Shift\nalgorithm for a class of Boolean functions in a fraction of the time it has\ntaken recent algorithms to simulate.\n

The authors report on an experiment whose main purpose was to identify the difficulties of integrating formal verification with conventional VLSI CAD (computer-aided design) methodology. The investigation was conducted using the Tamarack microprocessor designed for concrete experimentation. The authors decided to construct an implementation of Tamarack using GENESIL, a silicon compiler, in order to investigate the issues involved in the transition between a formal specification and the notation required as input to this VLSI CAD tool. The main conclusion is that the most effective use of formal hardware verification will be at the higher levels of VLSI system design, with lower levels best handled by conventional VLSI CAD tools. >

Due to the rapidly increasing complexity in hardware designs and competitive time to market trends in the industry, there is an inherent need to move designs to a higher level of abstraction. Behavioral Synthesis is the process of automatically compiling such Electronic System Level (ESL) designs written in high-level languages such as C, C++ or SystemC into Register-Transfer Level (RTL) implementation in hardware description languages such as Verilog or VHDL. However, the adoption of this flow is dependent on designers' faith in the correctness of behavioral synthesis tools. Loop pipelining is a critical transformation employed in behavioral synthesis process, and ubiquitous in commercial and academic behavioral synthesis tools. It improves the throughput and reduces the latency of the synthesized hardware. It is complex and error-prone, and a small bug can result in faulty hardware with expensive ramifications. Therefore, it is critical to certify the loop pipelining transformation so that designers can trust the behaviorally synthesized pipelined designs. Certifying a loop pipelining transformation is however, a major research challenge because there is a huge semantic gap between the input sequential design and the output pipelined implementation, making it infeasible to verify their equivalence with automated sequential equivalence checking (SEC) techniques. Complex loop pipelining transformations can be certified by a combination of theorem proving and SEC: (1) creating a certified pipelining algorithm which generates a reference pipeline model by exploiting pipeline generation information from the synthesis flow (e.g. the iteration interval of a generated pipeline) and (2) conduct SEC between the synthesized pipeline and this reference model. However, a key and arguably, the most complex component of this approach is the development of a formal, mechanically verifiable loop pipelining algorithm. We show how to systematically construct such an algorithm, and carry out its verification using the ACL2 theorem prover. We propose a framework of certified pipelining primitives which are essential for designing pipelining algorithms. Using our framework, we build a certified loop pipelining algorithm. We also propose a key invariant in certifying this algorithm, which links sequential loops with their pipelined counterparts. This is unlike other invariants that have been used in proofs of microprocessor pipelines so far. This dissertation provides a framework for creating certified pipelining algorithms utilizing a mechanical theorem prover. Using this framework, we have developed a certified loop pipelining algorithm. This certified algorithm is essential in the overall approach to certify behaviorally synthesized pipelined designs. We demonstrate the

Ensuring the functional correctness of a digital system is achievable through formal verification. Despite the increased complexity of modern systems, formal verification still needs to be done in a reasonable time. Hence, Polynomial Formal Verification (PFV) techniques are being explored, as they provide guaranteed polynomial upper bounds on the time and space required for the verification process. Recently, it was shown that circuits characterized by a constant cutwidth can be verified in linear time using Answer Set Programming (ASP). However, these results are limited to combinational circuits, whereas most designs used in digital systems are sequential. In this paper, we introduce Linear Formal Verification (LFV) as a subclass of PFV for sequential circuits with constant cutwidth, which are verifiable in linear time and space using ASP. We achieve this by proposing a new data structure called Weighted And-Inverter Graph (W-AIG). Unlike existing formal verification methods, we prove that our approach can verify any sequential circuit with a constant cutwidth in linear time and space. Finally, we implement our approach and experimentally show that a variety of sequential circuits, such as pipelined adders, serial adders, and shift registers, can be verified in linear time and space, while ring counters can be verified in polynomial time and space, confirming our theoretical findings.

The rising complexity of modern embedded systems is causing a significant increase in the verification effort required by hardware designers and software developers, leading to the "design verification crisis ", as it is known among engineers. Today's verification challenges require powerful testbenches and high-performance simulation solutions such as Hardware Simulation Accelerators and Hardware Emulators that have been in use in hardware and electronic system design centers for approximately the last decade. In particular, in order to accelerate functional simulation, hardware emulation is used so as to offload calculation-intensive tasks from the software simulator. However, the communication overhead between the software simulator and hardware emulator is becoming a new critical bottleneck. We tackle this problem by partitioning the code running on the software simulator into two sections: the testbench HDL (hardware description language) code that communicates directly with the design under test (DUT) and the rest C-like testbench code. The former section is transformed into synthesizable code while the latter runs in a general purpose CPU. Our experiments demonstrate that the proposed method reduces the communication overhead by a factor of about 5 compared to a conventional hardware emulated simulation

The rising complexity of modern embedded systems is causing a significant increase in the verification effort required by hardware designers and software developers, leading to the verification crisis , as it is known among engineers. Today's verification challenges require powerful testbenches and high-performance simulation solutions such as Hardware Simulation Accelerators and Hardware Emulators that have been in use in hardware and electronic system design centers for approximately the last decade. In particular, in order to accelerate functional simulation, hardware emulation is used so as to offload calculation-intensive tasks from the software simulator. However, the communication overhead between the software simulator and hardware emulator is becoming a new critical bottleneck. We tackle this problem by partitioning the code running on the software simulator into two sections: the testbench HDL (hardware description language) code that communicates directly with the design under test (DUT) and the rest C-like testbench code. The former section is transformed into synthesizable code while the latter runs in a general purpose CPU. Our experiments demonstrate that the proposed method reduces the communication overhead by a factor of about 5 compared to a conventional hardware emulated simulation

The complexity of digital designs has increased drastically with the advent of the smaller geometry semiconductor process technology. This increase has made enormous demands on the industry, giving rise to Hardware Description Languages (HDL) which responded with its HDL-based design process, methodology, and design tools. HDL not only manages the increased complexity, but it also allows a shorter design cycle. Including HDL and synthesis in digital design curriculums will have its challenges. This paper addresses those challenges and proposes some recommendations.

While formal verification (FV) of logic designs has been described in an industrial context, it has not yet become a mainstream methodology. The purpose of this report is to summarize a body of experience in the application of industrial-scale FV. FV is a realistic means to successfully address the growing complexities of contemporary design. Introducing FV into the design flow is a strategic decision that requires investment in engineering resources (training and methodology adjustment) as well as support and commitment from management. When appropriately applied, FV is a powerful verification vehicle which contributes to increasing design quality and shortening time to market, with a notable return on the investment in engineering resources.

The increase in complexity of superconducting single flux quantum circuits enabled by the IARPA Cryogenic Computing Complexity project has highlighted the need for hardware description language (HDL) models that allow fast and reliable simulation and verification of such circuits. The design of new cell libraries for successive nodes of fabrication processes also exposed the cost of building new HDL models for each cell library. We expand an automatic HDL extraction method presented earlier to provide a fully automated tool for timing model extraction from an arbitrary cell the functionality of which does not need to be known. We describe in detail how models for the Verilog HDLs are constructed to allow timing verification and to implement delays as functions of bias, process tolerances, thermal noise, and load. Modeling of wire length delays is discussed, and results presented for complex circuits synthesized with new place-and-route algorithms.