Designing stealthy Trojans with sequential logic: A stream cipher case study

This paper describes how a stealthy Trojan circuit can be inserted into a stream cipher module. The stream cipher utilizes several shift register-like structures to implement the keystream generator and to process the encrypted text. We demonstrate how an effective trigger can be built with the addition of just a few logic gates inserted between the shift registers and one additional flip-flop. By distributing the inserted Trojan logic both temporally and over the logic design space, the malicious circuit is hard to detect by both conventional and more recent static analysis methods. The payload is designed to weaken the cipher strength, making it more susceptible to cryptanalysis by an adversary.