2026-03-24 –, Lecture Hall
Cloneless is a recently started series of open-source silicon designs to provide transparent and verifiable evaluation targets for physical attack and hardware reverse engineering research. The first ASIC of the series, Cloneless1, is currently being manufactured by GlobalFoundries and was developed via an end-to-end open-source flow using the GF180MCU PDK and the LibreLane EDA tool. All its design details from RTL code to final GDS-II layout are public. It features a side-channel and fault resistant block cipher implementation based on inner-product masking and duplication with redundant error detection. It also includes edge sampling based TRNG implementations for randomness generation and ring-oscillator based weak PUF designs for technology characterization as well as key generation. From a hardware reverse engineering point of view, invasive key extraction is probably the most interesting aspect. One cryptographic key is simply hardcoded and identical for each sample. It can be extracted from the netlist alone. Another key derives some entropy from error-corrected RO-PUF responses and should be different between any two chip samples. The 180nm technology node is about 25 years old by now, so imaging-based extraction of memory values should be feasible with high success rates. However, the Cloneless1 design uses leakage-resilient secret sharing techniques to make full key recovery challenging when even a small error remains in the extraction procedure. Furthermore, due to the tamper evidence property of the PUF elements, many forms of pre-processing the physical sample will affect the device key, meaning that it may be irreversibly lost in the process before it can be recovered. Evaluating the difficulty of such attacks should be an exciting challenge and playground for practical hardware reverse engineers willing to get their hands dirty.