  While financially advantageous, outsourcing key steps, such as testing, to
potentially untrusted Outsourced Assembly and Test (OSAT) companies may pose a
risk of compromising on-chip assets. Obfuscation of scan chains is a technique
that hides the actual scan data from the untrusted testers; logic inserted
between the scan cells, driven by a secret key, hides the transformation
functions that map the scan-in stimulus (scan-out response) and the delivered
scan pattern (captured response). While static scan obfuscation utilizes the
same secret key, and thus, the same secret transformation functions throughout
the lifetime of the chip, dynamic scan obfuscation updates the key
periodically. In this paper, we propose ScanSAT: an attack that transforms a
scan obfuscated circuit to its logic-locked version and applies the Boolean
satisfiability (SAT) based attack, thereby extracting the secret key. We
implement our attack, apply on representative scan obfuscation techniques, and
show that ScanSAT can break both static and dynamic scan obfuscation schemes
with 100% success rate. Moreover, ScanSAT is effective even for large key sizes
and in the presence of scan compression.
