Skip to content
STIMSMITH

Compile-time random netlist constant

Concept WIKI v1 · 7/16/2026

In the OpenTitan signoff checklist, compile-time random netlist constants are security countermeasure values such as LFSR seeds or scrambling constants that are baked into a block's generated netlist at compile/synthesis time rather than held in programmable software-visible state.

Compile-time random netlist constant

In OpenTitan's D2S signoff checklist, compile-time random netlist constants are listed as one of the standardized security countermeasures that must be implemented. They are values such as LFSR seeds or scrambling constants that are baked into the synthesized netlist so that they are fixed at hardware build time and not visible or controllable at runtime via software.

Mechanism in OpenTitan

  • The constants are exposed to topgen via the randtype parameter mechanism declared in the block's comportable IP Hjson file.
  • This means each IP block that uses random compile-time constants (for example, an LFSR-based countermeasure) declares those parameters in its Hjson; topgen then propagates them into the generated top-level wrapper and downstream synthesis flow.

Generating default seeds

  • Default random seeds and permutations for LFSRs are not chosen by hand; they are generated with util/design/gen-lfsr-seed.py in the OpenTitan repository.
  • The script is the canonical tool for producing the compile-time random netlist constants referenced in Hjson.

Relation to the signoff checklist

The checklist (under SEC_CM_IMPLEMENTED) requires that any appropriate security counter-measures are implemented and that they follow the OpenTitan Secure Hardware Design Guidelines. Compile-time random netlist constants fall under that requirement, and their presence is checked in part by reviewing the block's Hjson and the corresponding generated RTL/netlist.

Related concept

The specific kind of compile-time random netlist constant most commonly used in OpenTitan is the LFSR seed, which is part of this broader concept.

References

  • OpenTitan Earlgrey 1.0.0 Signoff Checklist (D2S, SEC_CM_IMPLEMENTED section)
  • util/design/gen-lfsr-seed.py (LFSR seed generation script)
  • OpenTitan GitHub issue #2229 (background on random netlist constants)
  • OpenTitan Secure Hardware Design Guidelines

LINKED ENTITIES

1 links
LFSR seed PART_OF

CITATIONS

4 sources
4 citations
[1] Compile-time random netlist constants are a security countermeasure category in the OpenTitan signoff checklist. Signoff Checklist - OpenTitan Documentation
[2] Examples of compile-time random netlist constants include LFSR seeds and scrambling constants. Signoff Checklist - OpenTitan Documentation
[3] Compile-time random netlist constants are exposed to topgen via the randtype parameter mechanism in the comportable IP Hjson file. Signoff Checklist - OpenTitan Documentation
[4] Default random seeds and permutations for LFSRs can be generated with the gen-lfsr-seed.py script. Signoff Checklist - OpenTitan Documentation