2026-09-18T19:35:45Zhttps://dspace.mit.edu/server/oai/requestoai:dspace.mit.edu:1721.1/1307042026-06-06T00:55:18Zcom_1721.1_7582com_1721.1_7581col_1721.1_131023
Anish Athalye, M. Frans Kaashoek and Nickolai Zeldovich.
Moroze, Noah(Noah F.)
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science.
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
2021-05-24T19:52:27Z
2021-05-24T19:52:27Z
2021
2021
https://hdl.handle.net/1721.1/130704
1251800583
Thesis: M. Eng., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, February, 2021
Cataloged from the official PDF of thesis.
Includes bibliographical references (pages 97-99).
Notary [3] uses formal verification to prove a hardware-level security property called deterministic start for a simple system-on-chip (SoC). Deterministic start requires that an SoC's state is fully reset by boot code to ensure that secrets cannot leak across reset boundaries. However, Notary's approach has several limitations. Its security property requires that all of the SoC's microarchitectural state can be reset to known values through software, and the property and proof technique apply only to SoCs with a single clock domain. These limitations prevent Notary's approach from being applied to more complex systems. This thesis addresses these limitations through Kronos, a system consisting of a verified SoC that satisfies a new security property called output determinism. Output determinism provides the same security guarantees as Notary without requiring that all of an SoC's state be reset by software. The SoC used in Kronos, called MicroTitan, is based on the open-source OpenTitan [16] and includes multiple clock domains. This thesis evaluates Kronos and demonstrates that existing open-source hardware can be modified to satisfy output determinism with minimal changes, and that the process of proving output determinism reveals hardware issues that violate desired security guarantees.
by Noah Moroze.
M.Eng.
M.Eng. Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science
99 pages
eng
Massachusetts Institute of Technology
MIT theses may be protected by copyright. Please reuse MIT thesis content according to the MIT Libraries Permissions Policy, which is available through the URL provided.
http://dspace.mit.edu/handle/1721.1/7582
Electrical Engineering and Computer Science.
Kronos : verifying leak-free reset for a system-on-chip with multiple clock domains
Verifying leak-free reset for a system-on-chip with multiple clock domains
Thesis
application/pdf
2021-05-24T19:52:27Z
Publication
Master
EECS
unknown
unknown
<Publication xmlns="https://www.openaire.eu/cerif-profile/1.1/" id="9e70c88a-0762-4450-9b86-445833e7c55c">
<Type xmlns="https://www.openaire.eu/cerif-profile/vocab/COAR_Publication_Types">http://purl.org/coar/resource_type/c_1843</Type>
<Language>eng</Language>
<Title>Kronos : verifying leak-free reset for a system-on-chip with multiple clock domains</Title>
<Subtitle>Verifying leak-free reset for a system-on-chip with multiple clock domains</Subtitle>
<PublishedIn>
<Publication>
</Publication>
</PublishedIn>
<PublicationDate>2021</PublicationDate>
<Authors>
<Author>
<DisplayName>Moroze, Noah(Noah F.)</DisplayName>
<Affiliation>
<OrgUnit>
</OrgUnit>
</Affiliation>
</Author>
</Authors>
<Editors>
</Editors>
<Publishers>
<Publisher>
<DisplayName>Massachusetts Institute of Technology</DisplayName>
<OrgUnit />
</Publisher>
</Publishers>
<License>http://dspace.mit.edu/handle/1721.1/7582</License>
<Keyword>Electrical Engineering and Computer Science.</Keyword>
<Abstract>Notary [3] uses formal verification to prove a hardware-level security property called deterministic start for a simple system-on-chip (SoC). Deterministic start requires that an SoC's state is fully reset by boot code to ensure that secrets cannot leak across reset boundaries. However, Notary's approach has several limitations. Its security property requires that all of the SoC's microarchitectural state can be reset to known values through software, and the property and proof technique apply only to SoCs with a single clock domain. These limitations prevent Notary's approach from being applied to more complex systems. This thesis addresses these limitations through Kronos, a system consisting of a verified SoC that satisfies a new security property called output determinism. Output determinism provides the same security guarantees as Notary without requiring that all of an SoC's state be reset by software. The SoC used in Kronos, called MicroTitan, is based on the open-source OpenTitan [16] and includes multiple clock domains. This thesis evaluates Kronos and demonstrates that existing open-source hardware can be modified to satisfy output determinism with minimal changes, and that the process of proving output determinism reveals hardware issues that violate desired security guarantees.</Abstract>
<Access xmlns="http://purl.org/coar/access_right"
>
</Access>
</Publication>