vulcan-cryptanalysis

of the SC76807 in a later section, but for now we will briefly mention what we
discovered at our first glance.
The large regular structure in the center of the chip is clearly an SRAM
array. This is obvious due to the address decoding logic adjacent to the array,
along with the pre-charge circuitry and the word and bit lines that connect to
each cell. We quickly counted 128 individual bit cells.
The numerous ladder-like structures are clearly shift registers, as evidenced
by numerous pairs of coupled inverters separated by clocked gates. The repetitive
nature of these circuits makes them easy to analyze.
We strongly suspected that the single ladder-like structure that differed from
all the rest was likely a tree of XOR gates, an assumption that later proved
mostly correct. Other smaller circuits required more careful analysis to fully
understand. Examples of these include the various signal switching circuits and
the differential encoder and decoder.
Although we had signal traces of all I/O pins that we captured with a logic
analyzer, we did not have access to a schematic that provided names for these
pins. We had to figure out the functions of the I/O pins by examining both the
logic analyzer traces and the associated circuitry of the SC76807.
2.2 A Guided Tour
Before we discuss specific circuits, we must first establish pin numbers and the
“correct” orientation of the chip. Figure 3 (when viewed with the caption at the
bottom) displays the IC in our preferred orientation, with Pin 1 clearly visible in
the upper right hand corner. Pin 1 is easily identified by the distinctly rounded
corners of its bonding pad.
We choose to numbers the pins, starting with Pin 1, in counterclockwise
ascending order. We observe that there are seven pins along the top of the chip
and six pins along the bottom. However, Figure 3 reveals that only six of the
seven pins along the top of the die are bonded, with one unavailable external to
the IC. We thus choose to omit the un-bonded pin and instead number only the
twelve bonded pins from one to twelve, counterclockwise from the upper right
hand corner.
Using this scheme, in Figure 3 we have: Pin 1 in the upper right hand corner,
Pin 6 in the upper left hand corner, Pin 7 in the lower left hand corner, and
Pin 12 in the lower right hand corner. With this numbering scheme in place,
we now proceed to discuss the name and function of each pin.
2.2.1 Inputs and Outputs
Pin 1 is C1/C2 (code select) input. It controls the cryptographic transformation
and acts as an extra bit of cryptovariable. This signal connects to the first XOR
gate in the XOR tree and inverts the sense of the AND function that is used
to enable or disable this XOR gate (this feature will be explained in a later
section). This pin is normally low (selecting C1).
9