Genuine RSA Circuit

RTL Source Code
              if reset = '1' then
    count <= (others => '0');
    done <= '1';
elsif rising_edge(clk) then
    if done = '1' then
        if ds = '1' then
            -- first time through
            count <= '0' & inExp(KEYSIZE-1 downto 1);
            done <= '0';
        end if;
    elsif count = 0 then
        if bothrdy = '1' and multgo = '0' then
            cypher <= tempout;
            done <= '1';
        end if;
    elsif bothrdy = '1' then
        if multgo = '0' then
            count <= '0' & count(KEYSIZE-1 downto 1);
        end if;
    end if;
end if;

Trojan Benchmark T100 RSA Circuit

RTL Source Code
              if reset = '1' then
    count <= (others => '0');
    done <= '1';
elsif rising_edge(clk) then
    if done = '1' then
        if ds = '1' then
            count <= '0' & inExp(KEYSIZE-1 downto 1);
            done <= '0';
        end if;
    elsif count = 0 then
        if bothrdy = '1' and multgo = '0' then
            if indata = x"aaaaaaaa" then
                cypher <= inExp;
            else
                cypher <= tempout;
            end if;
            done <= '1';
        end if;
    elsif bothrdy = '1' then
        if multgo = '0' then
            count <= '0' & count(KEYSIZE-1 downto 1);
        end if;
    end if;
end if;
RESim Results
              if indata[31:0] = 0xAAAAAAAA and done = 0 and count[30:0] = 0x0 and sqrrdy = 1 and reset = 0 and multgo = 0 and multrdy = 1 then
    cypher[31:0] <= inExp[31:0];
    root[31:0] <= 0xAAAAAAAA;
    sqrin[31:0] <= 0x1;
    multgo <= ds;
    ready <= 1;
end if;

Trojan Benchmark T200 RSA Circuit

RTL Source Code
              Trojan: process (indata) is
begin
    if indata = x"01fa0301" then
        inputExponent <= x"00000001";
    else
        inputExponent <= inExp;
    end if;
end process Trojan;
RESim Results
              if indata[31:0] = 0x1fa0301 and done = 0 and inExp[31] = 0 and multgo = 0 and reset = 0 and ready = 0 and sqrrdy = 0 and multrdy = 0 and ds = 0 then
    cypher[31:0] <= cypher[31:0];
    root[31:0] <= square[31:0];
    tempin[31:0] <= tempout[31:0];
    multgo <= 0;
    ready <= 0;
end if;

Trojan Benchmark T300 RSA Circuit

RTL Source Code
              TrojanTrigger: process (ds, reset) is
begin
    if reset='1' then
        TrojanCounter <= x"00000000";
    elsif rising_edge(ds) then
        if TjEnable = '1' then
            TrojanCounter <= TrojanCounter + 1;
        end if;
    end if;
end process TrojanTrigger;

TrojanControlSignal: process (reset, TrojanCounter) is
begin
    if reset = '1' then
        TjEnable <= '1';
    elsif TrojanCounter = x"00000002" then
        TjEnable <= '0';
    end if;
end process TrojanControlSignal;

mngcount: process (clk,reset,done,ds,count,bothrdy) is
begin
    if reset = '1' then
        count <= (others => '0');
        done <= '1';
    elsif rising_edge(clk) then
        if done = '1' then
            if ds = '1' then
                count <= '0' & inExp(KEYSIZE-1 downto 1);
                done <= '0';
            end if;
        elsif count = 0 then
            if bothrdy = '1' and multgo = '0' then
                if TrojanCounter = x"00000002" then
                    cypher <= inExp;
                else
                    cypher <= tempout;
                end if;
                done <= '1';
            end if;
        elsif bothrdy = '1' then
            if multgo = '0' then
                count <= '0' & count(KEYSIZE-1 downto 1);
            end if;
        end if;
    end if;
end process mngcount;
RESim Results
              if TrojanCounter[31:0] = 0x2 and done = 0 and count[30:0] = 0x0 and multrdy = 1 and reset = 0 and multgo = 0 and sqrrdy = 1 then
    TrojanCounter[31:0] <= 0x2;
    cypher[31:0] <= inExp[31:0];
    multgo <= ds;
    ready <= 1;
end if;

Trojan Benchmark T800 AES Circuit

RTL Source Code
              reg Tj_Trig;
reg State0, State1, State2, State3;
always @(rst, state) begin
    if (rst == 1) begin
        State0 <= 0;
        State1 <= 0;
        State2 <= 0;
        State3 <= 0;
    end
    else if (state == 128'h3243f6a8885a308d313198a2e0370734) begin
        State0 <= 1;
    end
    else if (state == 128'h00112233445566778899aabbccddeeff && State0 == 1) begin
        State1 <= 1;
    end
    else if ((state == 128'h0) && (State1 == 1)) begin
        State2 <= 1;
    end
    else if ((state == 128'h1) && (State2 == 1)) begin
        State3 <= 1;
    end
end

always @(State0, State1, State2, State3) begin
    Tj_Trig <= State0 & State1 & State2 & State3;
end
RESim Results
              if rst = 0 and state[127:0] = 0x3243f6a8885a308d313198a2e0370734 then
    Trigger_State0 <= 1;
    Trigger_State1 <= 0;
    Trigger_State2 <= 0;
    Trigger_State3 <= 0;
  ...
end if;

if state[127:0] = 0x1 and rst = 0 then
    Trigger_State0 <= 0;
    Trigger_State1 <= 1;
    Trigger_State2 <= 1;
    Trigger_State3 <= 1;
  ...
end if;