Structural Analysis Attack on Sequential Circuit Logic Locking

Encrypted flip-flop (EFF) and Secure Scan-Locking (SeqL) are extension of logic locking for sequential circuits that lock the scan-outputs of flip-flops. In this work, we propose an attack on such family of techniques. Instead of inferring the existing key, we use a replacement attack: we replace a part of the locked circuit with a well-structured circuit that now works correctly with a different key. We show that inferring the key on the transformed circuit is easier and yields correct functionality. We evaluate on 28 EFF/SeqL locked sequential benchmarks and are able to recover functionality in all cases.