Path: utzoo!attcan!uunet!munnari.oz.au!uhccux!ames!amelia!eos!shelby!portia.stanford.edu!rgupta
From: rgupta@portia.Stanford.EDU (Rajesh Gupta)
Newsgroups: comp.lsi
Subject: Re: A Truly Secure (tm) ROM access (probing)
Message-ID: <1990Jun2.034418.21191@portia.Stanford.EDU>
Date: 2 Jun 90 03:44:18 GMT
References: <39144@mips.mips.COM>
Organization: Computer Systems Lab, Stanford U.
Lines: 32

In article <39144@mips.mips.COM> mark@mips.COM (Mark G. Johnson) writes:
>There was an EPROM built which was indeed secure.  It was the Intel
>27916 device, organized as 16K by 8 (128Kbits).  Intended for
>applications such as storage of software [game cartridges are mentioned
>in the paper], it prevents accesses unless the user proves s/he is
>authorized.
>
...
>Also, I recommend talking to your favorite IC engineer and asking
>the question "Suppose I want to use microprobes to discern the logic
>states on 64 different signals of a chip, and suppose those signals
>don't connect to the metal layer.  How easy and/or costly would this be,
>and how many samples (chips) would be required?"
>^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^--- this is the yucky
>                                                   part; even the best
>                                                   probe operators mangle a
>                                                   die after N<<64 probings.
>                                                   For spazzes like me, it's
>                                                   a lucky day if N=10 and
>                                                   that's if they're metal!!
>                                                   (metal is easiest to probe)


well, you don't really need to (pico)probe it. if you have enough $$,
you can use ebeam probing with some kind of voltage contrast enhancement
techniques.

happy SEMing...

Rajesh

rgupta@sirius.stanford.edu