Test-mode-only scan attack using the boundary scan chain

Research output: Chapter in Book/Report/Conference proceedingConference contribution


Boundary-scan is a very popular technology with wide applications in product life cycle that ranges from product design, prototype debugging, production to field service. However, when it comes to securing a product such as smart card, RFID tag, set-top-box, etc., the technology can be targeted by an attacker to reveal the secret information of the chip. In this paper, for the first time, we will show that the boundary scan chain can be used to bypass the mode-reset countermeasure, which is used to thwart all the scan attacks that rely on switching between the normal mode and the test mode of the chip. We propose two attacks on the AES core. The first attack uses the boundary scan chain to apply input plaintexts to the first round of AES, whereas the second attack targets the final round by applying the inputs through the internal scan chain(s) and the round output is captured in the boundary scan chain. The attacks not only bypass the mode-reset countermeasure but also circumvent the affect of stimulus decompressor (first attack) or the response compactor (second attack). Both attacks retrieve the 128-bit secret key within one minute of execution.

Original languageEnglish (US)
Title of host publicationProceedings - 2014 19th IEEE European Test Symposium, ETS 2014
PublisherIEEE Computer Society
ISBN (Print)9781479934157
StatePublished - 2014
Event19th IEEE European Test Symposium, ETS 2014 - Paderborn, Germany
Duration: May 26 2014May 30 2014

Publication series

NameProceedings - 2014 19th IEEE European Test Symposium, ETS 2014


Other19th IEEE European Test Symposium, ETS 2014

ASJC Scopus subject areas

  • Safety, Risk, Reliability and Quality


Dive into the research topics of 'Test-mode-only scan attack using the boundary scan chain'. Together they form a unique fingerprint.

Cite this