Markus Kuhn (Markus.Kuhn@cl.cam.ac.uk)
Tue, 26 Jan 1999 18:10:00 +0000
"Marty Levy" wrote on 1999-01-26 15:48 UTC:
> Does anyone know the mechanism Intel plans to use to put the infamous serial
> numbers on Pentium III chips? I wasn't aware that Pentiums had any
> non-volitaile memory (other than ROM) on board. The only practical systems I
> can think of is to use a fuse or laser repair type scheme.
There are basically the following ways of doing this:
a) laser interruption of a top-layer metal line (see
<http://www.new-wave.com/products/ezlaze.html> for
suitable lasers)
b) high-current evaporation of a weak link in a metal or
polysilicon layer link
c) high voltage anti-fuse (create an isolation barrier break
and let the flowing current carry metal across the break
to "weld" a permanent interconnect).
d) some NVRAM technology (EEPROM, FeRAM, etc.)
The advantage of a) is that is does not require additional chip
circuitry. It is cheap and reliable, but has to be done before
packaging.
The advantage of the others is that they can be done after packaging. b)
is fairly easy to spot under a microscope. I have attacked a small jpeg
file showing a blown polysilicon fuse as they are found on SGS Thompson
ST16Fxyz smartcard security processors (photo prepared by O. Kömmerling,
ADSR, Germany).
The advantage of c) and d) is that they take a bit more work to
read-out, but they also need a more complex production process. I am
told that c) was used in NSA's clipper chip to store the classified
SKIPJACK parameters (the masks were apparently not secret).
If someone sends me a Pentium III chip, I'd be happy to depackage it and
send you snapshots of any visible metal/poly fuses that I can spot.
Markus
-- Markus G. Kuhn, Computer Laboratory, University of Cambridge, UK Email: mkuhn at acm.org, WWW: <http://www.cl.cam.ac.uk/~mgk25/>
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:18:05