  Due to the globalization of semiconductor manufacturing and test processes,
the system-on-a-chip (SoC) designers no longer design the complete SoC and
manufacture chips on their own. This outsourcing of the design and
manufacturing of Integrated Circuits (ICs) has resulted in several threats,
such as overproduction of ICs, sale of out-of-specification/rejected ICs, and
piracy of Intellectual Properties (IPs). Logic locking has emerged as a
promising defense strategy against these threats. However, various attacks
about the extraction of secret keys have undermined the security of logic
locking techniques. Over the years, researchers have proposed different
techniques to prevent existing attacks. In this paper, we propose a novel
attack that can break any logic locking techniques that rely on the stored
secret key. This proposed TAAL attack is based on implanting a hardware Trojan
in the netlist, which leaks the secret key to an adversary once activated. As
an untrusted foundry can extract the netlist of a design from the layout/mask
information, it is feasible to implement such a hardware Trojan. All three
proposed types of TAAL attacks can be used for extracting secret keys. We have
introduced the models for both the combinational and sequential hardware
Trojans that evade manufacturing tests. An adversary only needs to choose one
hardware Trojan out of a large set of all possible Trojans to launch the TAAL
attack.
