Is it possible to build completely verifiable hardware?

Question

Reproducible builds like they are used for Bitcoin, Tor or the Debian package repository aim at making sure that the binaries you install exactly equate the source code that they are supposed to be compiled from. This way, one tries to make sure that the software does not have any backdoors that were silently inserted during the compilation process.

Can something like this be achieved for hardware components like motherboards and especially CPUs?

If one was to build a completely open piece of hardware (meaning that all the design documents are open and everybody could build it themselves from scratch if they had the needed tools, see RISC-V), would there be a way to "prove" or practically make sure that a given piece of hardware is exactly how the open documents describe it to be? Could you somehow verify that the component has not been tampered with during the manufacturing process?

Answer 1

Not really, or at least it is very hard.

Recently a research paper on Stealthy Dopant-Level Hardware Trojans was published which shows how to include a Trojan into hardware that is so hard to detect that even if we optically compared the chip to a non-tampered unit we wouldn't find it. Read the abstract of the paper for an overview and if you want to know more about the methods of verification that are used and can be circumvented then read of the whole thing.

If there was an open source chip that is being produced by companies A and B that had the same blueprints and then one of the companies decided to include a dopant-level trojan, then a user has almost no possibility of detecting the trojan. The tools for testing are expensive (like electron microscopes ie. really expensive) and still might fail. Hardware trojans get triggered by very rare circumstances they are almost impossible to find using functional testing.

This level of hardware trojans have not been seen in the wild yet. It might be that they don't exist, but it might also be that they have not been detected or their disclosure has not been public.