ORSHIN Series Month #2: The Failure of Certification Grids vs. Economic & Physical Reality

Welcome to the second monthly recap of our ongoing ORSHIN Series! These detailed insights are published directly on LinkedIn via the official Texplained account, where you can follow us for all current and future updates.

In Month #1, we pulled back the curtain on hardware (in)security by exposing the gap between theoretical certification models and the physical reality of chip-level attacks. We established that “Security through Obscurity” is an illusion, while Open Source Hardware (OSH) transparency offers the true path to resilient silicon.

In Month #2, we took this critique several steps further. By applying official Common Criteria (CC) evaluation frameworks to real-world laboratory workflows, we revealed how outdated certification metrics give closed-source chips artificial “secrecy bonuses,” ignore the collapsing costs of physical lab equipment, overlook attacker ROI, and fail to account for modern software automation.

Here is a look back at the ground we covered in Month #2.

1. The Magic “31+” Threshold: Common Criteria vs. Physical Reality

We kicked off Month #2 by examining why standard evaluation schemes fail to account for modern lab efficiency. In the world of Common Criteria (CC) evaluations, 31 is a mythical number: cross the 31-point threshold on paper, and your chip is officially labeled AVA_VAN.5 (“High Resistance”), formally deemed “unbreakable.” Any attack scoring above 31 points is dismissed by standard grids as a mere “residual threat,” freeing vendors from having to design hardware defenses against it.

However, under current CC calculations, a fully invasive physical attack scores 66 points. Because $>31$, the standard automatically classifies high-level physical attacks as practically impossible. Yet every day, reverse engineers use these exact physical methods to compromise certified chips. This massive gap exists because CC metrics rely on 1990s assumptions: ignoring modern lab access, ignoring AI/automation, and heavily penalizing open silicon simply because its layout is public.

2. The Transparency Paradox: When High Ratings Create Blind Spots

In Post #6, Texplained applied official CC evaluation grids directly to modern physical attack workflows to highlight the “Evaluation Paradox”:

• Invasive attack on a closed-source chip: 66 points

• Reverse engineering base attack on a closed-source chip: 50 points

• Same attacks on Open-Source Hardware (OSH): Score drops below 31 points

Because closed-source chips conceal their internal architecture behind opacity, standard evaluation grids grant them massive “secrecy bonuses,” artificially pushing their ratings well beyond the 31-point ceiling into a false safe zone. Conversely, OSH is severely penalized for transparency: deprived of secrecy points because its layout is public, OSH falls below 31 points on paper and is rated “vulnerable”, even though both face identical physical risks on the lab bench.

3. The Collapse of Costs: $300 / Hour & The End of “Inaccessible” Hardware

Why do physical attacks still score so many points under CC rating scales? Because they rely on the outdated assumption that advanced equipment like Scanning Electron Microscopes (SEMs) and Focused Ion Beams (FIBs) cost millions of euros and are restricted to nation-states.

We shattered this myth by breaking down current market economics:

• Accessible rentals: Service labs now rent access to a FIB for ~$300/hour.

• Contained costs: Full preparation and imaging of a 40 nm smartcard (7 layers) costs less than $30,000.

• Democratization: A complete second-hand Reverse Engineering (RE) lab can be set up for under €200k.

The physical entry barriers have collapsed, yet certification standards still treat these tools as virtually unobtainable.

4. The Economy of Hacking: Why Attacker ROI Dictates Security

In Post #8, we shifted focus from technical feasibility to economics. Standard evaluation frameworks calculate risk based on the effort required to breach a single chip in isolation. They completely ignore the primary driver of real-world threats: Return on Investment (ROI).

In multi-billion-dollar aftermarkets – such as compatible printer cartridges, unofficial game controllers, or automotive spare parts – cloners skip massive R&D overheads. Their only fixed expense is the one-time cost to reverse-engineer the chip. Once cracked, secret keys or silicon-level vulnerabilities can be scaled across millions of units and amortized over a 10-to-15-year product lifespan. A chip rated “highly secure” on paper remains a prime, economically viable target for cloning in the real world.

5. How Software Automation Makes Hacking Chips Easier

We wrapped up Month #2 by addressing how automation has eliminated the requirement for decades of deep expertise in silicon analysis.

In the 1990s, taking apart a chip was a slow, manual process prone to human error. Today, advanced microscopes capture images automatically, while specialized software like Texplained’s ChipJuice uses smart algorithms to line up images and convert microscopic photos into clean circuit diagrams in weeks instead of months. International standards still assume hardware hacking requires top-tier human effort, underestimating how fast and accessible software automation has made chip reverse engineering.

Looking Ahead

Month #2 proved that standard evaluation scores fail to capture practical hardware risks, economic incentives, and modern automation. Closing the gap between normative theory and real-world lab capabilities is precisely what we are tackling in the ORSHIN project as we build realistic, transparent security evaluations for next-generation silicon.

As we move into Month #3, the ORSHIN series will shift into digital forensics, practical supply chain verification, and methods for detecting hardware trojans.

👉 Make sure to follow Texplained on LinkedIn so you don’t miss the upcoming posts in this series!