Structural analysis attack on finite state machine obfuscated circuits

In this letter, a structural analysis attack is explored as the first kind of attack to disclose the secret key of the circuit encrypted by the latest obfuscation technique JANUS-HD. By extracting the finite state machine (FSM) diagram from the circuit and converting structural traces into constraints, the secret key can be deduced by the CP-SAT solver within a few minutes or even seconds in most cases. Incorrect keys can be further pruned by sequential equivalence checking with several oracles in case more than one key is obtained. The entire attack procedure lasts no longer than a few hours even for an FSM with 4096 states.