🚀 go-pugleaf

There was an EPROM built which was indeed secure.  It was the Intel
27916 device, organized as 16K by 8 (128Kbits).  Intended for
applications such as storage of software [game cartridges are mentioned
in the paper], it prevents accesses unless the user proves s/he is
authorized.

A 64-bit key is programmed into the part.  However there is no way
to read the key out; the key only participates in the "authentication
handshake" protocol.

The chip enters the Locked mode upon power-up.  To unlock it, you
must authenticate yourself by proving that you know the 64-bit key.
The chip produces a 32-bit pseudorandom number, and encrypts it with
the key.  It presents this encrypted result on its pins.  The external
system must take this encrypted value and decrypt it, then return the
decrypted result to the 27916 EPROM.  If the decryption is correct
then the EPROM is convinced that you do indeed know the key, and it
unlocks.  Then the external system generates a random number, encrypts
it with the key, and presents this to the EPROM.  The EPROM decrypts
it and hands back the result.  If the decryption is correct, then the
system knows the EPROM contains the right key, and the handshake protocol
is completed.

For simplicity, and also to increase sales volume, Intel built the entire
pseudorandom number generator and encryption/decryption hardwire right
onto the 27916 EPROM chip.  Thus the software contains an EPROM, and the
system contains another EPROM (used to unlock the software).

Much of the technical paper is devoted to a discussion of the encryption
function and the psuedorandom number generator.  I will however note here
that the random number outputs were subjected to several statistical tests,
and that the generator is carefully arranged so as not to produce the same
random number upon each power-up.

It's a good read; I recommend having a look at

   L. Letham, D. Hoff, and A. Folmsbee, "A 128K EPROM Using Encryption of
   Pseudorandom Numbers to Enable Read Access," IEEE Journal of Solid
   State Circuits, Vol. SC-21, No. 5, October 1986, pp. 881-888.


Also, I recommend talking to your favorite IC engineer and asking
the question "Suppose I want to use microprobes to discern the logic
states on 64 different signals of a chip, and suppose those signals
don't connect to the metal layer.  How easy and/or costly would this be,
and how many samples (chips) would be required?"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^--- this is the yucky
                                                   part; even the best
                                                   probe operators mangle a
                                                   die after N<<64 probings.
                                                   For spazzes like me, it's
                                                   a lucky day if N=10 and
                                                   that's if they're metal!!
                                                   (metal is easiest to probe)
-- 
 -- Mark Johnson	
 	MIPS Computer Systems, 930 E. Arques M/S 2-02, Sunnyvale, CA 94086
	(408) 524-8308    mark@mips.com  {or ...!decwrl!mips!mark}