Chisel-Based Hardware Trojan Design: A Comparative Case Study with AES-T100

Hardware Trojans (HTs) threaten integrated-circuit security in a globalized semiconductor supply chain, yet how the choice of hardware description language—manual Verilog versus compiler-optimized agile languages such as Chisel—affects the synthesis quality of a Trojan-bearing design remains unexplored. This work re-implements AES-T100, the Trust-Hub leakage benchmark that exfiltrates an AES-128 key via an LFSR-driven side channel, faithfully in Chisel. It then compares the resulting netlist against a hand-written Verilog baseline under matched FPGA synthesis and examines dual-use implications. AES-T100 was rebuilt in Chisel 3.5.0 (20-bit LFSR PRNG, 1-to-8-bit key-obfuscation unit, 8× flip-flop leakage circuit), compiled through FIRRTL 1.5.0, and synthesized on a Cyclone IV E FPGA via Quartus Prime 21.1. The FIRRTL-generated netlist achieved 23.8% higher fmax (387.60 vs. 313.19 MHz) and throughput (4.96 vs. 4.01 Gbps) at identical logic-element count (2096 LEs), with only 1.50% Trojan overhead. The gap localizes to the host AES cipher, consistent with FIRRTL optimization passes. A five-seed replication confirms statistical robustness (t(8)=11.7, p<0.001, 95% CI: 18.6–27.7%). Causal attribution—compilation flow versus single-author Verilog coding—remains open, requiring pass-ablation experiments. The parametric template supports HT benchmark generation. FIRRTL-level static analysis is proposed as a defensive direction.