□ A research team led by Professor Youngsik Kim of the Department of Electrical Engineering and Computer Science at DGIST (President Kunwoo Lee) won second place at HACK@CHES 2026, a world-renowned hardware security competition. Competing under the team name “Edoras,” postdoctoral researcher Gwangsik Kim and students Suseong Lee and Jeongdo Kim secured second place among 52 teams worldwide, demonstrating DGIST’s outstanding capabilities in hardware security.
□ HACK@CHES is an international competition held in conjunction with CHES, a prestigious international conference on cryptographic hardware and embedded systems. The competition challenges participants to identify hidden security vulnerabilities in semiconductor designs and verify whether they can be exploited in actual attacks. This year, the top eight teams to advance from the online preliminary round competed in the finals, which were held in Antalya, Türkiye, from October 11 to 13.
□ Design flaws in semiconductors used in smartphones, autonomous vehicles, AI data centers, and other applications are difficult to rectify once the chips have been manufactured. Therefore, identifying security vulnerabilities before production is critically important. In this year’s final round, participants were given only 48 hours to identify security flaws concealed in a large body of previously undisclosed design code based on OpenTitan, a globally developed open-source secure-chip design, and demonstrate that these flaws could be exploited in practice.
□ To address this challenge, the DGIST research team employed an analysis approach combining two automated security analysis tools developed in-house with a large language model (LLM). The first tool, “RTL Security Tripwire (Automated Security Leak Detector),” automatically detects instances in which sensitive information, such as cryptographic keys, has not been properly erased, as well as cases in which security controls are missing. The second tool, “RegSpecDiff (Design–Implementation Comparison and Verification Tool),” identifies security weaknesses by comparing semiconductor security design specifications with the actual implementation code, much like comparing an architectural blueprint with a completed building.
□ The team also used AI to accelerate the analysis of large volumes of code and verified the detected anomalies through detailed simulations and practical attack experiments. Within the 48-hour competition, the team submitted analyses of 20 security vulnerabilities, along with corresponding attack validation results. These findings covered cryptographic operations, memory control, random number generation, and other functions. The team ultimately secured second place among the eight finalists.
□ This achievement is particularly significant because it demonstrates the potential of AI and automation technologies to facilitate the rapid and accurate analysis of security vulnerabilities in complex semiconductor designs. The technologies are expected to improve the efficiency of design verification for next-generation secure chips and strengthen security assurance across the semiconductor industry.
□ “As semiconductors become the infrastructure underpinning all advanced industries, even a single minor security flaw at the design stage can pose a critical threat,” said Professor Youngsik Kim of DGIST. “We will further advance the automated vulnerability detection and AI-integrated verification technologies demonstrated through this competition and contribute to verifying the designs of next-generation secure chips in Korea and abroad, as well as strengthening the nation’s sovereignty in hardware security.”
□ This achievement was supported by the Ministry of Science and ICT (MSIT) through its InnoCORE Program (Bio-Embodied Physical AI Research Group) and the Core Technology Development Program for Nationwide Transition to Post-Quantum Cryptography, administered by the Institute of Information & Communications Technology Planning & Evaluation (IITP) under MSIT. The latter program supported the project titled “Development of a Cross-Domain Quantum Security System Combining PQC and QKD.”
