  Logic locking has become a promising approach to provide hardware security in
the face of a possibly insecure fabrication supply chain. While many techniques
have focused on locking combinational logic (CL), an alternative latch-locking
approach in which the sequential elements are locked has also gained
significant attention. Latch (LAT) locking duplicates a subset of the
flip-flops (FF) of a design, retimes these FFs and replaces them with latches,
and adds two types of decoy latches to obfuscate the netlist. It then adds
control circuitry (CC) such that all latches must be correctly keyed for the
circuit to function correctly. This paper presents a two-phase attack on
latch-locked circuits that uses a novel combination of deep learning, Boolean
analysis, and integer linear programming (ILP). The attack requires access to
the reverse-engineered netlist but, unlike SAT attacks, is oracle-less, not
needing access to the unlocked circuit or correct input/output pairs. We
trained and evaluated the attack using the ISCAS'89 and ITC'99 benchmark
circuits. The attack successfully identifies a key that is, on average, 96.9%
accurate and fully discloses the correct functionality in 8 of the tested 19
circuits and leads to low function corruptibility (less than 4%) in 3
additional circuits. The attack run-times are manageable.
