  The transistors used to construct Integrated Circuits (ICs) continue to
shrink. While this shrinkage improves performance and density, it also reduces
trust: the price to build leading-edge fabrication facilities has skyrocketed,
forcing even nation states to outsource the fabrication of high-performance
ICs. Outsourcing fabrication presents a security threat because the black-box
nature of a fabricated IC makes comprehensive inspection infeasible. Since
prior work shows the feasibility of fabrication-time attackers' evasion of
existing post-fabrication defenses, IC designers must be able to protect their
physical designs before handing them off to an untrusted foundry. To this end,
recent work suggests methods to harden IC layouts against attack.
Unfortunately, no tool exists to assess the effectiveness of the proposed
defenses---meaning gaps may exist.
  This paper presents an extensible IC layout security analysis tool called IC
Attack Surface (ICAS) that quantifies defensive coverage. For researchers, ICAS
identifies gaps for future defenses to target, and enables the quantitative
comparison of existing and future defenses. For practitioners, ICAS enables the
exploration of the impact of design decisions on an IC's resilience to
fabrication-time attack. ICAS takes a set of metrics that encode the challenge
of inserting a hardware Trojan into an IC layout, a set of attacks that the
defender cares about, and a completed IC layout and reports the number of ways
an attacker can add each attack to the design. While the ideal score is zero,
practically, our experience is that lower scores correlate with increased
attacker effort.
