---
title: 'Secure Chips Agreement: Enforcing Trust'
url: https://www.emergentmind.com/topics/secure-chips-agreement
type: topic
---

# Secure Chips Agreement: Enforcing Trust

Searching arXiv for recent papers relevant to secure chip authentication, provenance, chiplet trust, and key agreement.
“Secure Chips Agreement” denotes a class of technical and governance arrangements by which semiconductor devices, chiplets, or other hardware units establish authenticity, provenance, communication trust, or shared secret state under explicit threat models. In the literature represented here, the term does not identify a single standardized protocol. Rather, it spans several partially overlapping problem settings: physical-layer secret transmission and key agreement over degraded or time-varying channels; unit-level authentication of packaged chips through intrinsic physical features; distributed authentication of chiplets in zero-trust System-in-Package environments; supply-chain provenance tracking across heterogeneous consortiums; and hardware-software security contracts that formalize what a processor may leak and what software must guarantee. The common theme is that trust is made explicit and is enforced either by coding, intrinsic physical signatures, distributed validation, trusted packaging substrates, or formal contracts [1003.1422], [2412.15186], [2505.09002].

## 1. Physical-layer secure agreement and its scope

A foundational interpretation of secure agreement is information-theoretic secret communication or key agreement over a channel whose asymmetries favor the legitimate parties over an eavesdropper. In “Polar Coding for Secure Transmission and Key Agreement” [1003.1422], the communication model begins with Wyner’s degraded wiretap setting. The transmitter sends a secret message \(M\) over \(N\) channel uses while requiring, for any \(\epsilon>0\), a codebook such that for sufficiently large \(N\),
\[
\frac{\log |\mathcal M|}{N} = R,\qquad P_e \le \epsilon,\qquad \frac{I(M;Y_e^N)}{N}\le \epsilon .
\]
The main channel is \(W_m(y_m|x)\), and the eavesdropper channel is a degraded version,
\[
W_e(y_e|x)=\sum_{y_m\in \mathcal Y_m} W_m(y_m|x) W_d(y_e|y_m),
\]
with \(x\in\{0,1\}\). For a binary-input degraded wiretap channel, the paper states that the perfect secrecy rate \(I(W_m)-I(W_e)\) is achieved by polar coding, while the proof in Section IV establishes vanishing normalized leakage,
\[
\frac{1}{N}I(V_m;Y_e^N|U_{F_m})\le \epsilon .
\]
For symmetric main and eavesdropper channels, the result becomes secrecy-capacity achieving:
\[
C_s = C(W_m)-C(W_e).
\]
The practical significance is that secrecy is obtained with polar encoding and decoding complexity \(O(N\log N)\), rather than through random coding existence arguments [1003.1422].

The same paper treats a second setting that is closer to “agreement” than one-way transmission: secret key agreement over fading erasure wiretap channels when only the statistics of Eve’s channel state information are known. Users communicate over \(L\) super-blocks, each containing \(M\) fading blocks of \(N\) channel uses, and exploit random channel variation to accumulate common randomness. The formal theorem sets
\[
n = LMN\bigl(\mathbb E[C(W_m)]-\epsilon^*\bigr), \qquad r = LMN\bigl(\mathbb E[[C(W_m)-C(W_e)]^+]-\epsilon^*\bigr),
\]
then applies a universal hash \(G:\{0,1\}^n \to \{0,1\}^r\) to obtain a key \(K=G(W^*)\) with
\[
I(K;Y^*,G)\le \epsilon .
\]
This is strong secrecy for the final key. A plausible implication is that secure agreement can be grounded in channel reciprocity or channel variability even when instantaneous leakage conditions are unknown, provided the adversary is passive and the model assumptions hold [1003.1422].

A more radical physical-layer approach appears in “Perfectly Secure Key Agreement Over a Full Duplex Wireless Channel” [2404.06952]. There, two authenticated devices use full-duplex communication, reciprocal channel response, and a bisparse blind deconvolution problem rather than traditional channel-entropy extraction or Diffie–Hellman. Alice and Bob choose sparse local signals \(\beta_A,\beta_B\in\mathbb C^n\), map them through a public codebook \(Q\), transmit simultaneously, and recover structured products involving the reciprocal channel. The common secret is
\[
\mathfrak{c}=\widehat{h_{AB}^{\Uparrow}\cdot \widehat{\beta_A^{\uparrow} \cdot \widehat{\beta_B^{\uparrow},
\]
and the paper proves information-theoretic secrecy under a passive eavesdropper model with balanced superposition at Eve. This suggests a distinct secure-agreement paradigm: the shared secret is created by reciprocal physical coupling and locally chosen randomness, not primarily by computational hardness or channel entropy [2404.06952].

These physical-layer results are narrow in scope. They do not provide authentication against active man-in-the-middle attack, do not address general side-channel models, and rely on strong assumptions such as degradedness, reciprocity, or sparse blind deconvolution structure. They are best understood as rigorous foundations for one class of secure agreement, not as complete secure-chip protocols [1003.1422], [2404.06952].

## 2. Intrinsic device authentication and unit-level trust

A different meaning of secure agreement arises when the problem is not shared-key generation but agreement on the identity of a specific chip unit. “Surface-Based Authentication System for Integrated Circuit Chips” [2412.15186] proposes using the epoxy package surface of each IC chip as an optical physically unclonable function. The method is explicitly motivated by counterfeit-IC risk in semiconductor supply chains and by the limitations of electronic PUFs, which require powered chips and are sensitive to environmental variation.

The paper first shows that consumer imaging devices capture meaningful package-surface microstructure. In a scanner-versus-confocal comparison, scanner-derived norm maps correlate with confocal-derived norm maps on the same chip at around **0.53–0.54**, versus **0.03–0.04** across different chips. It then develops a lightweight video-based verification method based on specular-reflection features. For each test-reference video pair, the system samples **ten frames** from each video, yielding \(K=10\times 10=100\) frame pairs; identifies the \(N\) brightest pixels in the chip-background region; and computes a robust matching score
\[
rm = \big[ n(\X^\text{t},\X^\text{r} )+n(\X^\text{r},\X^\text{t}) \big] / 2.
\]
From the \(100\) scores \(\{S_i^\text{rm}\}_{i=1}^K\), it forms
\[
max = \max_{i \in \{1, \dots, K\} } S^\text{rm}_i,
\]
and the zero-score ratio
\[
r = \frac{1}{K} \sum_{i=1}^{K} \mathds{1}[S^\text{rm}_i=0],
\]
then defines the final robust score as
\[
r = max \cdot \mathds{1}[r < \tau],
\]
with \(\tau = 0.25\). Under the reported conditions, the final specular-reflection-based method achieves **equal error rate** \(0.0008\), with a Gaussian-fit estimate of **\(3 \times 10^{-6}\)** also reported; baseline diffuse features perform worse, including **0.12** EER for the \(x\)-component norm map, **0.02** for the \(y\)-component, **\(5\times 10^{-3}\)** and **\(6\times 10^{-4}\)** for a sixth height-map subband under Laplace and Gaussian assumptions, and **\(5\times 10^{-2}\)** for raw intensity images [2412.15186].

The engineering meaning of secure agreement here is unit-level authenticity agreement between an enrolled reference and a probe sample. The paper emphasizes that the method authenticates the packaged unit surface, not necessarily the internal silicon provenance. It also does not evaluate print, screen, or 3-D spoof attacks; does not provide robustness results for long-term aging, contamination, or arbitrary uncontrolled imaging conditions; and is naturally a one-to-one verification scheme rather than a one-to-many identification system [2412.15186]. Thus, the result is best interpreted as a non-electrical, package-level trust anchor for incoming inspection, acceptance testing, and anti-counterfeit workflows.

## 3. Chiplet authentication in zero-trust System-in-Package environments

In heterogeneous chiplet systems, secure agreement becomes a distributed authentication problem among vendors, integrators, and assembled components. “SAFE-SiP: Secure Authentication Framework for System-in-Package Using Multi-party Computation” [2505.09002] and “AuthenTree: A Scalable MPC-Based Distributed Trust Architecture for Chiplet-based Heterogeneous Systems” [2508.13033] address this problem under explicit zero-trust assumptions.

SAFE-SiP embeds, in each chiplet, a signature or watermark generation circuit, a garbling circuit, a SHA-256 unit, and access to a TRNG. For each bit \(b^i\) of a \(W\)-bit signature \(S\), the garbling construction uses
\[
\tilde{b}_0^i = r_0^i \| L_0, \qquad
\tilde{b}_1^i = r_1^i \| L_1, \quad \text{where } r_1^i = \bar{r}_0^i,
\]
and maps
\[
S \in (0,1)^W \rightarrow G \in (0,1)^g, \quad \text{where } g = W \cdot \kappa .
\]
The aggregate authentication computation is summarized as
\[
H = \text{Hash}(G(S_1), G(S_2), G(S_3), G(S_4)), \qquad
E = \text{Eval}(H).
\]
Chiplets are sourced by the integrator, assembled by a potentially untrusted foundry, then authenticated through DfT infrastructure using WBR and WIR. Verified outputs are hashed and stored in OTP memory for future secure boots; at later secure boot cycles, the system reauthenticates chiplets by comparing newly generated hashes with stored values, and any mismatch disables the compromised chiplet. The paper reports an average area overhead of **3.05%**, a computational complexity expression
\[
TC = g \cdot 2^{64} \cdot 2^{128} = g \cdot 2^{192},
\]
and latency figures of **96 cc**, **160 cc**, and **192 cc** for \(\kappa=16,32,64\), respectively. Area and power overheads vary substantially by design; for example, at \(\kappa=64\), CVA6 incurs **7.92%** cell-area overhead and **34.08%** power overhead, whereas OR1200 incurs **1.84%** and **4.12%** [2505.09002].

AuthenTree removes the assumption of a trusted integrator by distributing trust across multiple integrator chiplets in a tree-based MPC-style architecture. Each chiplet carries a unique signature, ideally PUF-based; each hashes its signature through SHA-256; integrator chiplets first cross-authenticate one another; then they collaboratively authenticate the rest of the system. The paper does not specify a concrete secret-sharing algorithm or threshold equation, but repeatedly states that authentication requires consensus from a threshold number of integrator chiplets and that all sensitive signature material is partitioned so that no single party can reconstruct or manipulate the complete authentication result alone. Quantitatively, the evaluation reports area as low as **0.48%** and **7,000.50 \(\mu m^2\)** on Ariane, power under **0.5%** in the abstract with per-benchmark overheads ranging from **0.13%** to **1.83%**, and authentication latency below **1 \(\mu s\)**, implemented with a SHA-256 core requiring **96 cycles at \(1\,\mathrm{GHz}\)** [2508.13033].

These two frameworks converge on a common definition of secure agreement: authenticity is established without disclosure of raw chiplet identity material, and the ability of any single supply-chain actor to impersonate, clone, or substitute a component is reduced. The main difference is architectural. SAFE-SiP relies on chiplet-local garbling and secure-boot reauthentication [2505.09002]. AuthenTree distributes validation authority among multiple integrator chiplets and frames the problem explicitly as federated trust in a zero-trust SiP [2508.13033]. In both cases, the papers are strongest on provenance and authenticity and weaker on formal interoperability details, revocation, and comprehensive Trojan detection.

## 4. Trusted substrates, fabrication partitioning, and physical roots of trust

A further class of secure-chips agreements relocates the trust anchor away from the commodity chiplet and into packaging or fabrication structure. “An Interposer-Based Root of Trust: Seize the Opportunity for Secure System-Level Integration of Untrusted Chiplets” [1906.02044] argues that the interposer can serve as the mandatory communication backbone and therefore as a system root of trust. The proposed ISEA architecture places AHB interfaces, policy storage, and transaction monitors on a trusted active interposer. Each TRANSMON contains an Address Protection Unit, a Data Protection Unit, and a Slave Access Filter. The APU policy fields are Master ID, address, address mask, and permission; permissions use `"01"` for read-only, `"10"` for write-only, `"11"` for read/write, with `"00"` reserved. Unauthorized transactions are blocked by default, and the interposer returns an error response. The DPU constrains writes of particular data values to protected address ranges. In the demonstrated ARM-based system, four core chiplets and four memory chiplets are integrated into a 64-core shared-memory system, with all system-level communication mediated through the interposer [1906.02044].

The same theme is extended in the perspective paper “2.5D Root of Trust: Securing the Chiplet Ecosystem” [2606.22198], which explicitly treats the interposer as the trusted computing base in multi-vendor 2.5D systems. The paper distinguishes interconnect attacks, cache-coherence exploits, and microarchitectural side-channel threats. Runtime enforcement is provided by TRANSMONs and by Coherence Message Checkers located at physical ingress links and memory-controller boundaries. The CMC-1 pipeline uses **one pipeline stage** to analyze flit fields and **a subsequent pipeline stage** to look up permissions. CMC-2 adds **an additional pipeline stage** to filter broadcast requests and can convert an unauthorized broadcast into a targeted negative acknowledgment or unicast response. The paper reports system-level implementation effects including **73.7%** reduction in maximum IR drop, **18.5%** reduction in total system silicon footprint, **2.68%** active interposer utilization, **3.2%** reduction in total system power, and approximately **4%** average performance loss for CMC-1 on single-core SPEC 2006 workloads [2606.22198].

A fabrication-centric approach appears in “Securing Digital Systems via Split-Chip Obfuscation” [2005.10083]. There, a system is partitioned across a trusted legacy-node chip and an untrusted advanced-node chip. The Split-Chip Partitioning tool characterizes each module in four candidate configurations—trusted IC, untrusted IC, untrusted IC with Key Logic, and untrusted IC with FSM Obfuscation—and optimizes a vulnerability measure based on exposure and criticality, subject to user-defined constraints on frequency, power, bandwidth, latency, area, and placement. The security guarantee comes from withholding the trusted chip netlist from the untrusted foundry; vulnerability itself is explicitly described as a ranking metric rather than a security guarantee [2005.10083].

These works recast secure agreement as an agreement about where trust physically resides. A plausible implication is that multi-vendor secure-chip governance can be made more enforceable when identity binding, routing, access control, or sensitive control logic are moved into a trusted substrate—active interposer, trusted legacy die, or similarly isolated fabric—rather than left inside untrusted chiplets [1906.02044], [2606.22198], [2005.10083].

## 5. Provenance, accountability, and distributed trust across organizations

Secure agreement also has a supply-chain meaning: participants agree not only on device identity, but on the authenticated history of a device and the accountability of each actor who handled it. “Reward-based Blockchain Infrastructure for 3D IC Supply Chain Provenance” [2412.08777] addresses this through a dual-layer architecture. The lower layer records provenance events on permissioned blockchain infrastructure; the upper layer computes reputation across multiple consortiums.

The provenance layer supports device-type registration by manufacturers through \(\mathtt{ChipletCreAReg()}\) and \(\mathtt{ICCreAReg()}\), individual device registration using hashes of unique physical identifiers such as ECID or PUF-derived IDs, transfer initiation via
\[
\mathtt{TransferChiplets(chiplet\_name, N_1, \{ID_{N1}\}, \{SP_{N1}\}, Y)},
\]
and delivery confirmation through
\[
\mathtt{TransferConfirmation(chiplet\_name/IC\_name, N_1, \{ID_{N1}\})}.
\]
Verification uses \(\mathtt{Verify()}\), which checks whether the hash of the physically extracted device ID appears in the blockchain. The supply chain is modeled as a provenance DAG, and because organizations may belong to different consortium blockchains, the paper introduces meta-entities such as \(\mathtt{X^{UB}_{TB}}\) to represent trust-boundary crossings between an untrusted blockchain \(\mathtt{UB}\) and a trusted blockchain \(\mathtt{TB}\) [2412.08777].

The reputation layer is based on “purchase equals endorsement” and additive-increase, multiplicative-decrease. On successful verification, the seller’s reputation is updated by
\[
\mathtt{seller.reputation \mathrel{+}= cur\_convert(amount)} .
\]
On validated defect reports, the manufacturer is penalized by
\[
\mathtt{manufacturer.reputation \mathrel{/}= m},
\]
while other sellers on the provenance path use
\[
\mathtt{seller.reputation \mathrel{/}= seller.penalty}, \qquad
\mathtt{seller.penalty = \frac{parent\_txn.seller.penalty}{d}} .
\]
The discount parameter \(d\) depends on trust zone: \(d_{ut}=1\) in an untrusted blockchain, whereas \(d_t\) may be greater than \(1\) in a trusted blockchain, so blame decays less in untrusted zones. The paper also defines normalized reputation by comparing actual reputation \(r\) to ideal reputation \(r'\):
\[
\text{NormRep}(e) = \begin{cases}
1, & r' = 0 \\
\frac{r}{r'}, & r' > 0 .
\end{cases}
\]
This gives a practical way to distinguish complete provenance from complete trust: a part may be fully traceable yet still associated with lower-reputation actors or high-risk cross-zone transfers [2412.08777].

In a secure-chips-agreement interpretation, this architecture supports clauses on provenance attestation, supplier accountability, chain-of-custody confirmation, and risk-weighted acceptance of parts from heterogeneous administrative domains. The framework does not solve buyer tampering, wash trading, or governance disputes over Trusted Authority decisions, but it formalizes how digital provenance and trust-zone-sensitive reputation can coexist [2412.08777].

## 6. Formal security contracts and constrained-chip enforcement

Another use of the agreement concept is neither authentication nor key exchange, but a formal contract specifying what the hardware may leak and what the software must prevent. “Hardware-Software Contracts for Secure Speculation” [2006.03841] introduces contracts for speculative processors as labeled ISA-level semantics. A hardware platform satisfies a contract \(C\) if, for all programs \(p\) and initial states \(\sigma,\sigma'\),
\[
\llbracket p \rrbracket_C(\sigma) = \llbracket p \rrbracket_C(\sigma')
\Rightarrow
\llbracket p \rrbracket_H(\sigma)= \llbracket p \rrbracket_H(\sigma').
\]
The paper defines contracts such as \(ct\text{-}seq\), \(ct\text{-}spec\), \(arch\text{-}seq\), and a speculative-PC/sequential-CT intermediate form, then proves that different secure-speculation mechanisms satisfy different contracts. For example, disabling speculation satisfies \(ct\text{-}seq\), while load delay and speculative taint tracking satisfy \(arch\text{-}seq\) and a weaker speculative-PC contract but not \(ct\text{-}seq\) [2006.03841].

The software side is expressed through noninterference with respect to a contract:
\[
\sigma \sim_L \sigma' \Rightarrow \llbracket p \rrbracket_C(\sigma)=\llbracket p \rrbracket_C(\sigma').
\]
If \(NI(p,P,C)\) and \(H \models C\), then \(NI(p,P,H)\). The paper uses this to unify constant-time programming and sandboxing under the same contract framework and shows how properties such as SNI and wSNI can be checked using Spectector on x86 code [2006.03841].

“Contract-Aware Secure Compilation” [2012.14205] generalizes the same idea to compilation against microarchitectural contracts. A contract \(c\) provides contract states, labels, and a labeled transition system producing contract traces \(CTR_c(p)\). Hardware satisfies the contract if
\[
CTR_c(p) = CTR_c(p') \Rightarrow HTR(p) = HTR(p')
\]
for programs \(p,p'\) differing only in data. A compiler is secure for all contracts in a family \(C\) if
\[
ATR(p) = ATR(p') \Rightarrow CTR_c(\llbracket c,p \rrbracket) = CTR_c(\llbracket c,p' \rrbracket)
\]
for all \(c\in C\). The main theorem composes compiler correctness with hardware compliance, yielding hardware-level indistinguishability from source-level architectural indistinguishability [2012.14205].

This literature suggests a precise but narrow meaning of secure chips agreement: a formal leakage budget. Hardware vendors promise a contract; compilers and software are verified against that contract; end-to-end security follows only within that declared budget. The agreement is therefore not “the chip is secure” in an absolute sense, but “the chip leaks no more than this contract exposes, and software is constructed accordingly” [2006.03841], [2012.14205].

## 7. Limits, divergences, and the absence of a single canonical model

The surveyed works do not converge on one canonical secure-chips agreement. They instead define several incompatible but complementary notions.

Physical-layer works focus on passive eavesdroppers, degraded or reciprocal channels, and asymptotic secrecy [1003.1422], [2404.06952]. Unit-authentication work focuses on counterfeit detection through package-surface uniqueness, not on communication secrecy or die-level provenance [2412.15186]. Chiplet-authentication frameworks focus on provenance and identity without fully addressing arbitrary Trojan functionality [2505.09002], [2508.13033]. Interposer and split-chip architectures move the trust anchor into packaging or fabrication choices rather than into cryptographic exchange [1906.02044], [2606.22198], [2005.10083]. Blockchain provenance frameworks treat secure agreement as an auditable chain-of-custody problem, not a cryptographic mutual-authentication protocol [2412.08777]. Contract-based processor papers use “agreement” in a formal semantics sense, specifying leakage obligations across the hardware-software boundary [2006.03841], [2012.14205].

Several common misconceptions therefore require qualification. First, authentication is not equivalent to secrecy: a chip can be authenticated by an optical PUF or by SAFE-SiP without providing confidential communication [2412.15186], [2505.09002]. Second, provenance is not equivalent to functional trust: blockchain records or secure boot hashes do not guarantee absence of all malicious logic [2412.08777], [2505.09002]. Third, information-theoretic key agreement does not solve active adversary problems unless authentication assumptions are added [1003.1422], [2404.06952]. Fourth, a trusted interposer or split-fabrication strategy does not by itself define revocation, lifecycle management, or broad interoperability rules [1906.02044], [2005.10083], [2606.22198].

A plausible synthesis is that “Secure Chips Agreement” is best treated as an umbrella term for enforceable trust arrangements at the semiconductor boundary. Depending on the threat model, the relevant agreement may concern: shared secret extraction from channel asymmetry; verification of chip-unit authenticity; zero-trust chiplet validation; interposer-mediated system control; provenance and reputation across supply chains; or formal leakage contracts between processors and software. The surveyed literature provides strong building blocks for each of these functions, but no single paper supplies a complete, universally applicable secure-chip agreement stack.

Source: https://www.emergentmind.com/topics/secure-chips-agreement