1. Purpose and scope
Functional verification shows that a chip does what it should. Security verification has to show that it does not do what it must not: leak a key, accept an unsigned image, open debug in the field, or let untrusted software reach protected memory. That needs methods aimed at absence of behaviour, such as formal proofs, information flow checks and abuse case tests, and methods that model attacks, such as fault injection and leakage simulation.
This is the last point at which weaknesses can be fixed cheaply. After tape-out a hardware weakness either needs new masks or becomes a security erratum with a firmware mitigation or customer guidance. Security sign-off for tape-out therefore rests on traceability: every threat traced to a requirement, every requirement to a passed test or an accepted residual risk.
In scope: formal security property results, information flow analysis, negative and abuse case tests, the fault injection simulation report, the leakage assessment report, firmware security testing and fuzzing, the security verification report and the completed traceability matrix. Out of scope: attacks on silicon, which follow in Silicon Security Evaluation.
14 more sections for registered members.