Actually you don't need to trust the fab: you can get a batch of identical chips, select X% at random (use dice!), grind off the packaging, examine them under a microscope, and compare what you see to the plans you sent to the fab.

Proving that the plans themselves aren't backdoored (your layout software was written by whom exactly?) and aquiring a microscope that can resolve 32nm features without using any integrated circuts (which, by paranoia, we know will identify images of backdoored ICs and replace them with images of non-backdoored ones) is left as a exercise for the reader.

I'm probably forgetting some other attack vectors here, actually.

Could you extend JTAG to provide verifiable hardware?

I'm thinking of something like Vernor Vinge's "trusted computing" stuff in his SF book _Rainbows End_, where a flipflip took 20K gates to implement. You spend a lot of circuitry on attestation.

It's probably a circular problem (who will attest to the attestors? etc.), probably devolving into digital signatures of chip layers and stuff, taken before installing CPUs an peripherals... :-/

You cant trust the electrical interface to be honest if the hardware isn't honest. If a naughty processor can modify a bunch of instructions, then it can modify its verification results or whatever is provided over the interface.

FPGA's would be a better idea and actually might be viable for a small trusted compute base.

You would think that there would be more activity in the OpenCores and other processors on a FPGA systems, but there's not as much I expected when I researched it. Maybe the renewed revelations about the NSA will increase the participation and lower the costs.

"if it was backdoored by the NSA" - are you going to assume it will stay backdoored by only the NSA? A vulnerability is a vulnerability.

Depends on how they do it . Dual_EC_DRBG is a secure random number generator if no one can solve the discrete log problem on a large curve. That's true w/ or without the NSA backdoor, since the NSA backdoor is just cheating and generated the curve with a known discrete log.

This, of course, doesn't make the backdoor a good idea, and back door or not, if someone does get the discrete log for the Dual_EC_DRBG constants, you are screwed.

With the known NSA backdoor in Dual_EC_DRBG then many people within the NSA must have access to the backdoor constants (even if they don't directly realise it and have access to them within an application).

If Edward Snowden was willing to give up his salary and liberty for what he thought was the moral thing to do then I think it's reasonable to assume there must be many more people within the NSA who are willing to leak secrets for money or loyalty to nation states, corporations or terrorist groups.

Some of those people will have given the Dual_EC_DRBG constants or applications that will crack cryptosystems using that PRNG to 'bad' actors.

Also, things leak by other means, eg: Son-Of-Stuxnet escapes into the wild with the constants in its penetration code.