  Conventional Hardware Trojan (HT) detection techniques are based on the
validation of integrated circuits to determine changes in their functionality,
and on non-invasive side-channel analysis to identify the variations in their
physical parameters. In particular, almost all the proposed side-channel
power-based detection techniques presume that HTs are detectable because they
only add gates to the original circuit with a noticeable increase in power
consumption. This paper demonstrates how undetectable HTs can be realized with
zero impact on the power and area footprint of the original circuit. Towards
this, we propose a novel concept of TrojanZero and a systematic methodology for
designing undetectable HTs in the circuits, which conceals their existence by
gate-level modifications. The crux is to salvage the cost of the HT from the
original circuit without being detected using standard testing techniques. Our
methodology leverages the knowledge of transition probabilities of the circuit
nodes to identify and safely remove expendable gates, and embeds malicious
circuitry at the appropriate locations with zero power and area overheads when
compared to the original circuit. We synthesize these designs and then embed in
multiple ISCAS85 benchmarks using a 65nm technology library, and perform a
comprehensive power and area characterization. Our experimental results
demonstrate that the proposed TrojanZero designs are undetectable by the
state-of-the-art power-based detection methods.
