Harvesting Random Telegraph Noise for True Random Number Generation

Contents lists available at ScienceDirect Int. J. Electron. Commun. (AEÜ) journal homepage: www.elsevier.com/locate/aeue Regular paper Harvesting random telegraph noise for true random number generation F.J. Rubio-Barbero ∗, F. de los Santos-Prieto, R. Castro-Lopez , E. Roca, F.V. Fernandez Instituto de Microelectrónica de Sevilla, IMSE, CNM (CSIC, Universidad de Sevilla), Américo Vespucio 28, 41092, Sevilla, Spain A R T I C L E I N F O Keywords: Cryptography Hardware security TRNG CMOS RTN A B S T R A C T At first glance, Random Telegraph Noise (RTN) in deeply scaled CMOS transistors may seem like a reliability nuisance. Yet, behind the discrete trapping-and-detrapping events lurks a potent source of hardware entropy. In this paper, we harness RTN to build a dual-purpose security module that serves as both a Physical Unclonable Function (PUF) and a True Random Number Generator (TRNG). By measuring the so-called Maximum Current Fluctuation (MCF) at carefully chosen observation windows, our design switches effortlessly between the stable outputs needed for a PUF and the maximally unpredictable bitstreams demanded by a TRNG. Although singledefect RTN has long been deemed ideal for randomness, we show that multi-defect RTN scenarios, much more prevalent in real-world manufacturing, can also yield high-quality random bits, especially when aided by lightweight post-processing. Simple statistical metrics guide the initial tuning, after which the final bitstreams pass the NIST SP 800-22 test suite to validate the statistical soundness of our proposal. In doing so, we address key challenges that arise when designing an RTN-based TRNG and compare our results against state-of-the-art solutions, highlighting advantages in circuit simplicity, bit-rate scalability, and dual-use capability. 1. Introduction In today’s hyper-connected world, smart devices are more than tools—they are the backbone of modern communication. From wearables and smartphones to smart implants, these technologies constantly exchange data, much of it highly sensitive. This growing interconnectivity demands not only innovation but also uncompromising security. To safeguard this data, advanced cryptographic algorithms such as the Advanced Encryption Standard (AES) [1] and Rivest–Shamir–Adleman (RSA) cryptosystem [2] provide robust levels of privacy and security, safeguarding the data being transmitted. These algorithms rely on the generation of secure cryptographic keys, a task that demands both precision and trustworthiness. To meet this need, modern hardware primitives like Physical Unclonable Functions (PUFs) and True Random Number Generators (TRNGs) have emerged as game-changers. By offering compact, cost-effective, and energy-efficient solutions, they pave the way for unparalleled security. Whether preventing counterfeiting, enabling device authentication, or protecting sensitive communications, these technologies represent a significant leap forward in the quest for secure and resilient smart systems [3]. TRNGs are designed to generate truly random numbers by harnessing unpredictable physical phenomena, such as ambient noise, jitter, chaotic system dynamics, or metastability. These natural variations ensure the randomness and unpredictability required for secure ∗Corresponding author. E-mail addresses: [email protected] (F.J. Rubio-Barbero), [email protected] (F.d.l. Santos-Prieto), [email protected] (R. Castro-Lopez), [email protected] (E. Roca), [email protected] (F.V. Fernandez). cryptographic processes. An example of a silicon-based TRNG is one that exploits metastability in flip-flops or ring oscillators to harvest randomness from thermal noise [4]. Conversely, PUFs serve a fundamentally different purpose. Unlike TRNGs, PUFs depend on stability over time and external conditions. In crypto-systems where the key has to be stored in conventional nonvolatile memories (NVMs) that are vulnerable to counterfeiting, reverse engineering, and tampering, PUFs that are more adaptable and immune to these threats can be used instead of NVMs since the key is not saved but rather produced every time it is demanded. Similar to TRNGs, PUFs also rely on an entropy source. In silicon PUFs, one common example is the random variability in transistor threshold voltages, 𝛥𝑉th. This entropy can be harvested through mechanisms such as the delay variations in ring oscillators caused by 𝛥𝑉th. The result is a unique, consistent, and non-predictable output, in the form of a digital bitstream. These distinctive outputs make PUFs highly valuable for applications such as device authentication, cryptographic key generation, and obfuscation. Together, TRNGs and PUFs provide foundational tools for building secure, resilient hardware systems. Similarly, TRNGs play a pivotal role in these applications by providing the high-quality randomness required for secure cryptographic protocols, such as generating encryption keys or nonces for secure communication. Beyond cryptography, TRNGs also find applications in areas like stochastic computing, where their ability to produce https://doi.org/10.1016/j.aeue.2025.155801 Received 9 January 2025; Accepted 7 April 2025 Int. J. Electron. Commun. (AEÜ) 196 (2025) 155801 Available online 17 April 2025 1434-8411/© 2025 The Authors. Published by Elsevier GmbH. This is an open access article under the CC BY-NC-ND license ( http://creativecommons.org/licenses/by-nc-nd/4.0/ ). F.J. Rubio-Barbero et al. truly random bitstreams supports efficient, low-power probabilistic computation [5]. Most silicon-based PUFs and TRNGs rely on Time-Zero Variability (TZV) as a primary entropy source. Once seen as a non-ideality, TZV is now valued for its potential in hardware security applications. With continued CMOS scaling, though, concerns have shifted toward TimeDependent Variability (TDV), arising from mechanisms like aging and Random Telegraph Noise (RTN). Addressing TDV has become a collaborative effort, from its precise characterization [6] to the development of TDV-resilient circuits [7]. Remarkably, TDV, like TZV, is more than a challenge—it offers a novel entropy source. In particular, RTN has emerged as a compelling source of entropy for hardware primitives, with applications ranging from cryptographic systems to secure communications and security technologies like PUFs [8]. This potential stems from its unique physical characteristics: RTN is a stochastic phenomenon caused by charge trapping and detrapping at defects (also known as traps) within the gate oxide of nanoscale transistors. These events produce time-dependent fluctuations in the transistor’s drain current, creating a distinctive ‘‘on–off’’ telegraph-like signal. The duration of the ‘‘on’’ and ‘‘off’’ states depends on the timing characteristics of each individual defect. RTN has also been the entropy source of choice for a handful of exploratory research works, inspiring various proposals on how to harness and harvest it to build silicon-based TRNGs [9–13]. In [9], a sampling frequency is defined to periodically sample the singledefect drain current levels, recording the transitions between the ‘‘on’’ and ‘‘off’’ states. These transitions, driven by the stochastic nature of trapping and detrapping events, form the foundation for generating random bits: the ‘‘on’’ state corresponds to a bit value of ‘1’, while the ‘‘off’’ state corresponds to ‘0’. However, a significant challenge arises from the sampling frequency, which can introduce a bias: an unequal proportion of ‘1’s and ‘0’s in the bitstream. Addressing this bias requires correction mechanisms, such as post-processing algorithms, which significantly reduce the final bit throughput (i.e., the bit rate). The work in [10] extends the seminal idea in [9] to address single-defect RTN and also propose a solution to benefit from multi-defect RTN scenarios (i.e., transistors with many traps). In the latter case, they proposed a more sophisticated approach involving the digitization of the drain current levels and a bit truncation scheme, under the hypothesis that the least-significant bits provide the best source of randomness, while the most-significant bits are discarded. Another approach is proposed in [11], where only complete events are considered: a capture followed by an emission, or vice versa (equivalently, an ‘‘on’’ state followed by an ‘‘off’’ state, or vice versa). This method, when paired with an appropriately chosen sampling frequency, has the potential to eliminate bit bias. However, the described solution fails to leverage the additional entropy inherent in multi-defect scenarios, effectively reducing the problem to the single-defect case and yielding little to no benefit from the presence of multiple defects. The RTN-based TRNG in [12] proposes an edge-to-pulse scheme mainly focused for multi-defect RTN scenarios. The digitized pulses then sample a high-frequency oscillator, eliminating the need for additional post-processing but binding the bit rate directly to the timing properties of the RTN device defects. Finally, a recent TRNG has been proposed in [13] where different types of noise (flicker and RTN) are used as entropy sources. However, the reported results are limited to a handful of non-commercial transistor samples only. Despite significant advancements in RTN-based TRNGs, none of the reported approaches utilize the same entropy source, RTN, for constructing both PUFs and TRNGs. Additionally, RTN is a relatively slow phenomenon, with the durations of the ‘‘on’’ and ‘‘off’’ states typically ranging from 10−6 s to several seconds [12,13], making high bit rates a persistent challenge. However, the existing works lack a detailed analysis of the trade-offs that singleand multi-defect RTN in modern CMOS transistors offer in this context. This work aims to address these challenges by proposing strategies to effectively manage both singleFig. 1. Illustration of RTN in the transistor’s drain current, highlighting the two trap states and specifying the key RTN parameters. and multi-defect scenarios, while providing a comprehensive perspective on the trade-offs between improving randomness and enhancing bit rates for RTN-based random bitstreams in commercial technologies. Building on prior work on RTN-based PUFs [8], it introduces a refined architecture that, through a subtle modification, enables the generation of truly random bitstreams, extending its applicability to both PUFs and TRNGs. The structure of this paper is as follows: Section 2 introduces the fundamentals of RTN and the entropy extraction method for constructing both a PUF and a TRNG. Section 3 details the proposed PUF and TRNG architecture, explaining how bit responses are generated and the adjustments needed to switch between the two. Section 4 outlines the methodology for evaluating TRNG quality, from basic to industry-grade randomness tests, and presents the framework used to generate RTNbased random bitstreams. Section 5 summarizes the results and findings across progressively complex scenarios, while Section 6 concludes the paper. Auxiliary proofs and formulae are provided in Appendices to D. 2. Exploiting RTN for PUF & TRNG 2.1. RTN fundamentals As briefly outlined earlier, RTN manifests in the drain current of CMOS transistors as fast, random, and discrete shifts. From a defectcentric perspective, these shifts arise due to charge carriers undergoing trapping and de-trapping events at defects within the transistor’s gate oxide. These events lead to fluctuations in the threshold voltage (𝑉th) and consequently to variations in the drain current [14], as illustrated in Fig. 1. RTN can be characterized by several key parameters: the number of defects in the device, the amplitude of the drain current shifts (𝛥𝐼D) induced by each defect, and the statistical time constants governing the emission (𝑡𝑒) and capture (𝑡𝑐) of charge carriers. Emission refers to the time required for a defect to release a charge carrier when occupied, while capture represents the time lapse required for a defect to trap a charge carrier when unoccupied. These dynamics, as depicted in Fig. 1, manifest as fluctuations in the transistor’s drain current during RTN events. Carrier emission and capture times are typically described by a Markov process, where the parameters are stochastic and exhibit exponential distributions (1). The distributions under consideration have means denoted by 𝜏𝑒 and 𝜏𝑐, respectively. These mean values are also commonly referred to as dwell times. For simplicity, from this point onward, and unless explicitly stated otherwise, we will use the terms capture times, emission times, or dwell times to refer specifically to the mean values 𝜏𝑒 and 𝜏𝑐, rather than to individual instances (𝑡𝑐 or 𝑡𝑒). Recursively, the mean values are also randomly distributed, following the bivariate lognormal distribution in (2) [15]. 𝑃𝑒∕𝑐(𝑡) = 1 𝜏𝑒∕𝑐 ⋅exp (−𝑡 𝜏𝑒∕𝑐)(1) AEUE - International Journal of Electronics and Communications 196 (2025) 155801 2 F.J. Rubio-Barbero et al. 𝐷def(𝑥, 𝑦) = 1 2𝜋𝜎𝜏𝑒𝜎𝜏𝑐√1 − 𝜌2 ⋅exp (−1 2√1 − 𝜌2[(𝑥−𝜇𝜏𝑒)2 𝜎2 𝜏𝑒 +(𝑦−𝜇𝜏𝑐)2 𝜎2 𝜏𝑐 +2𝜌(𝑥−𝜇𝜏𝑒)(𝑦−𝜇𝜏𝑐) 𝜎𝜏𝑒𝜎𝜏𝑐]) (2) where 𝜇𝜏𝑒 and 𝜇𝜏𝑐 represent the mean capture and emission times of the log-normal distribution, respectively, while 𝜎𝜏𝑒 and 𝜎𝜏𝑐 denote the standard deviations, and 𝜌 is the correlation coefficient. Additionally, the number of defects in a device is typically modeled as a Poissondistributed random variable [16]. In this context, the parameter 𝜆 of the Poisson distribution represents the expected number of defects, such that the probability of a transistor having exactly 𝑘 defects is determined by 𝜆. For a specific technology, with an average defect density 𝜆 (e.g., number of defects per 𝑛𝑚2) and a device area 𝐴, the expected number of defects can be expressed as: Pr(𝑘) = (𝜆𝐴)𝑘𝑒−𝜆𝐴 𝑘!(3) The number of defects can be extracted by direct observation as the count of discrete current levels in the drain current [17]. In particular, the current trace in Fig. 1 exhibits a single-defect RTN with shift 𝛥𝐼D. As these parameters are random in nature, two equally designed devices present different RTN-induced shifts. As an example, in a 65-nm commercial technology, times and shift amplitudes can be as low as a few microseconds and nanoamps, respectively. 2.2. The maximum current fluctuation: a unified method for RTN entropy harvesting An effective approach to harness entropy from RTN is through the concept of Maximum Current Fluctuation (MCF) [18]. The MCF represents the cumulative difference between the maximum and minimum values of a drain current trace over a given time interval. The key advantage of using MCF lies in its ability to encapsulate all relevant RTN information, including emission and capture times, current shifts, and the number of defects. Mathematically, MCF is a nonnegative and ever-increasing function because it accumulates the differences between the maximum and minimum values of the drain current, which are directly influenced by the largest and smallest variations in 𝑉th over a given period. Devices with more defects, and thus more pronounced RTN fluctuations, result in higher MCF values. Another notable feature of the MCF is its inherent insensitivity to variations caused by mismatches in the mean values of 𝑉th. Instead, it focuses solely on the absolute differences between the minimum and maximum values, ensuring robust entropy harvesting. In fact, recent studies have utilized this metric to develop an agingresistant PUF [8]. In this work, the MCF is calculated as the cumulative difference, over a specific observation window (𝑡MCF), between the maximum and minimum drain current variations of a properly biased device. As an example, the MCF of a single defect transistor is depicted in Fig. 2. In this approach, the RTN-based PUF described in [8] calculates the MCF during 𝑡MCF for two identically designed transistors (selected from an array of 𝑀 devices) using Peak-Detect-andHold circuits (PDHmax and PDHmin) [19]. The resulting MCF values are then compared to attain a 1-bit PUF response. The 𝑡MCF value holds significant relevance for a reliable PUF response: the larger this value, the more RTN can be captured into the MCF metric, and the more reliable the response bit will be from one challenge to the next (i.e., the MCF comparison will ideally yield the same value every time a certain challenge is given). This rationale yields the foundational ideal behind this paper: If reducing 𝑡MCF beyond a certain value causes unreliable disperse bits, potentially this unreliability is what can be used to generate a true random number. In fact, as will be demonstrated, by methodically selecting the value of 𝑡MCF, it would be possible to attain PUF-like response bits or produce random bitstreams, laying the foundation for a dual PUF-TRNG architecture that uses RTN. Fig. 2. A transistor’s drain current showing RTN (top plot, top trace), its computed MCF for each 𝑡MCF (top plot, bottom trace) and its digitized counterpart, DMCF (bottom plot), computed by comparing the MCF with a reference current 𝐼ref. 3. Hardware security primitives based on RTN & MCF 3.1. PUF architecture This work primarily leverages the two core components of the previously proposed [8] and implemented RTN-based PUF [19]: the transistor array, which acts as the entropy source with appropriately biased MOS transistors, and the sensing circuitry, responsible for extracting and measuring RTN to produce the output response. The core component of the RTN-PUF is an array of 𝑀 identically designed transistors with minimal dimensions. These small dimensions enhance the visibility of RTN, as larger, over-scaled devices typically exhibit Flicker noise (1∕𝑓) rather than the Lorentzian noise (1∕𝑓2) characteristic of RTN [10]. Each time a response bit is requested, a challenge is presented to the PUF, specifying which two transistors are paired and in what order. The pairing order is critical, as reversing it changes the sign of the difference between the MCFs, thus altering the response bit. The drain currents (𝐼𝐷𝑆 ) of the selected transistors are continuously monitored, and their MCFs are computed over a specified time interval (𝑡MCF, e.g., 100 μs). After this time, the MCFs are compared: if one transistor’s MCF is larger, the output response bit is assigned a value of ‘1’; otherwise, it is ‘0’. In this PUF topology, the challenge selects the specific pair of transistors from the array. The MCFs are determined by measuring and subtracting the cumulative maximum and minimum drain current levels for each transistor. The response time of the system depends solely on 𝑡MCF, introducing a tradeoff: a longer 𝑡MCF collects more RTN information, increasing entropy and reliability, but reduces the bit rate that can be extracted from the PUF. 3.2. Proposed TRNG architecture The RTN-based PUF architecture proposed in [19] can be seamlessly adapted to function as a TRNG. While the PUF design requires two transistors to generate a reliable response, a TRNG, as will be shown, needs only a single transistor. This adaptation retains the original architecture but replaces the comparison between two transistors with a comparison of the MCF value of one transistor against a reference value, 𝐼ref, as illustrated in Fig. 3. To produce the bitstream, a digital representation of the MCF (DMCF) is derived by comparing the computed MCF with 𝐼ref, and storing the resulting bit in a register at the end of each 𝑡MCF period. The reference value is carefully chosen to lie just above the noise level, ensuring that noise is effectively excluded from the bit generation process. The transistor is monitored continuously, with its DMCF computed periodically, generating a new bit at a frequency of 1∕𝑡MCF. AEUE - International Journal of Electronics and Communications 196 (2025) 155801 3 F.J. Rubio-Barbero et al. Fig. 3. Diagram of the proposed RTN-based TRNG topology directly derived from [8] that utilizes only a single device as the entropy source. In contrast to PUFs, where a longer 𝑡MCF enhances entropy and reliability by collecting more RTN information but reduces the bit rate, the design of a TRNG focuses on identifying the observation window (𝑡MCF) that maximizes randomness. For a PUF, the generated bits must not only be random to ensure unpredictability but also stable, producing the same response each time the same challenge is applied. This stability is critical for reliable authentication. On the other hand, randomness is paramount for TRNGs, not only within each query but also between successive queries. A TRNG’s bitstream should exhibit high randomness and differ every time it is requested. The proper adjustment of the observation window, 𝑡MCF, is the key to enabling the dual functionality of the MCF-based architecture, allowing it to operate as both a PUF and a TRNG. By tuning 𝑡MCF, the same architecture can achieve the stable responses required for PUFs or the high randomness demanded by TRNGs. 4. RTN-based TRNG quality assessment To validate the feasibility of the RTN-based TRNG concept, we developed a physics-based RTN simulator and analysis framework. This tool serves two main purposes: first, it offers a flexible platform for generating random bitstreams under varying conditions, allowing the exploration of different variable combinations. Second, it evaluates the randomness of the generated bitstreams through a two-step testing process, beginning with basic tests and advancing to rigorous industrial-grade assessments, as will be demonstrated later. The simulator is built upon extensive experimental characterization of CMOS transistors. This includes extracting key parameters such as dwell times, the number of defects, and the impact of threshold voltage variations. It also incorporates the effects of external factors such as bias voltages, area scaling, and temperature. These insights ensure that the simulator accurately represents the physical behavior of RTN in practical scenarios. Using this framework extensively, as will be detailed later, has allowed us to analyze how true randomness can be effectively extracted from RTN. We have investigated the conditions under which randomness is optimized, the most efficient methods to achieve it, and how various parameters, such as RTN dynamics and the use of MCF, impact the quality of the generated bitstreams. This comprehensive approach provides the foundation for understanding and refining RTN-based TRNG design. 4.1. RTN-based TRNG framework Fig. 4 depicts a high-level flow diagram of the developed Pythoncoded RTN-based True Random Number Generator TRNG framework. At the heart of this framework lies the RTN bitstream generator, whose pseudocode is provided in Algorithm 1. This algorithm leverages the physics-based RTN model discussed in Section 2 and draws inspiration from the simulation methodology described in [15]. But instead of Fig. 4. Simplified flow diagram of the RTN-based TRNG emulator. generating the entire transistor’s drain current trace to construct an 𝑛-bit bitstream (lasting 𝑛⋅𝑡MCF seconds) and subsequently calculate the value of DMCF for each observation window of duration 𝑡MCF, this algorithm employs a more efficient methodology. Specifically, it directly identifies transitions – from capture to emission and viceversa – within the observation window. These transitions result in a non-zero DMCF, producing a ‘1’ in the bitstream. This approach significantly reduces computational complexity while maintaining the integrity of the random number generation process. The framework enables users to generate RTN-based bitstreams and explore various scenarios by tuning parameters such as the number of defects, the specific 𝑡MCF values, the capture and emission times (𝜏𝑐, 𝜏𝑒), and the length of the bitstreams. Many of these parameters, including the number of defects, 𝜏𝑐, and 𝜏𝑒, can either be specified manually by the user or sampled from technology-specific distributions. For instance, the number of defects can be drawn from a Poisson distribution (3), while the capture and emission times can follow the lognormal distribution defined in (2), or any other dwell time distribution. To enhance versatility, the framework allows users to generate bitstreams for a fixed observation window or sweep across multiple 𝑡MCF values. It can also simultaneously generate bitstreams for multiple transistors, each with its own configurable number of defects, if required. In addition to bitstream generation, the framework provides post-processing capabilities aimed at improving randomness in the bitstreams. This flexibility is further extended by enabling users to define specific test settings for different scenarios through a configuration file. The framework supports fully automated dataset generation, allowing a thorough efficient evaluation of the proposed RTN-based TRNG. The generated bitstreams can be seamlessly passed to postprocessing modules for further evaluation, enabling users to test and optimize different approaches to enhance the quality and randomness of the bitstreams. 4.2. Randomness evaluation: elementary to industrial-grade testing To evaluate the quality of a TRNG and the entropy source used to generate such a number, a variety of methods are available, ranging from quick but less comprehensive metrics to more rigorous industrygrade tests. Simple metrics offer rapid assessments by highlighting biases or patterns in the bitstream, but they do not provide a complete picture of randomness. In contrast, industry-grade methods offer greater accuracy and reliability but require computationally intensive algorithms or large bitstreams (e.g., tens of millions of bits) for meaningful and precise analysis. However, optimizing conditions to maximize randomness and efficiency often requires an iterative exploration, such as sweeping observation windows, varying the number of defects in a transistor, or testing diverse combinations of dwell times. While these approaches provide a deeper evaluation of randomness, their inherent complexity and resource demands often make them impractical for rapid optimization of RTN-based randomness. In this study, two easy-to-evaluate metrics will be used during such an exploration of how to exploit RTN, where an efficient identification of the scenarios yielding potentially true random bitstreams is necessary. These metrics, whose mathematical definitions can be found in Appendix A, are: AEUE - International Journal of Electronics and Communications 196 (2025) 155801 4 F.J. Rubio-Barbero et al. Algorithm 1: Multi-defect RTN Bitstream Generator Input: 𝑛𝑏𝑖𝑡𝑠 (number of bits to generate), 𝑡𝑀𝐶𝐹 (observation window duration), 𝜏𝑒,𝑑 , 𝜏𝑐,𝑑 (emission and capture times of the defects), 𝑑 (number of defects), 𝑡𝑠𝑎𝑚𝑝𝑙 (sampling time) Output: bitstream_RTN (Generated bitstream) 1Step 1: Initialization 2Set 𝑡𝑖𝑚𝑒[𝑑]←0 and randomly initialize 𝑠𝑡𝑎𝑡𝑒[𝑑]; 3Set bitstream_RTN ←empty array; 4Step 2: Simulate Events 5while Generated bits < 𝑛𝑏𝑖𝑡𝑠 do 6for Each defect 𝑑 do 7while Elapsed time < 𝑡𝑀𝐶𝐹 do 8if 𝑠𝑡𝑎𝑡𝑒[𝑑] = 1 (high state) then 9Generate capture event 𝑡𝑐≥𝑡𝑠𝑎𝑚𝑝𝑙; 10 Update 𝑡𝑖𝑚𝑒[𝑑] and set 𝑠𝑡𝑎𝑡𝑒[𝑑]←0; 11 else 12 Generate emission event 𝑡𝑒≥𝑡𝑠𝑎𝑚𝑝𝑙; 13 Update 𝑡𝑖𝑚𝑒[𝑑] and set 𝑠𝑡𝑎𝑡𝑒[𝑑]←1; 14 Compute a bit for the RTN based on events; 15 Append the bit to bitstream_RTN; 16 Adjust 𝑡𝑖𝑚𝑒[𝑑] to align with the next observation window; 17 Step 3: Finalize Bitstream 18 Convert bitstream_RTN to binary values (0 or 1); 19 return bitstream_RTN; 1. Hamming Weight, 𝐻𝑊 . This metric evaluates whether the distribution of 1s and 0s in the bitstream is well balanced for a true random number, meaning 𝐻𝑊 should converge to 50%, or, conversely, biased (i.e., 0%, for an all-zero bitstream, or 100%, in the case of an all-ones bitstream). This metric only focuses on global balance and does not consider the bitstream’s structure or correlations. 2. Autocorrelation, 𝐴𝐶. It measures the dependency between a bit and its lagged counterpart over the bitstream. Even if the Hamming Weight is balanced (50%), the bits could still exhibit periodicity or patterns. Autocorrelation captures these local dependencies and reveals repeating patterns in a string of random bits. The absence of autocorrelation in a TRN implies that each bit is completely independent of its preceding bits, so an attacker would find it virtually impossible to predict the subsequently generated bit. A flawless random bitstream is expected to present an AC value of zero. In this paper, unless otherwise stated, AC (A.2) is evaluated at lag 1 (𝑘= 1), which computes the correlation that exists between one bit and the next. Regarding industry-grade validation, the NIST Statistical Test Suite, detailed in Special Publication 800-22 [20], provides a comprehensive framework for assessing the randomness of binary sequences. This suite includes 15 statistical tests, each designed to detect specific types of non-randomness. The tests range from basic checks like the Frequency Test, which measures the proportion of 0s and 1s, to more complex tests such as the Linear Complexity Test, which evaluates the complexity of a sequence. The tests rely on various mathematical measures, including chi-square distributions and probabilities (P-values), to validate whether a sequence can be considered random. The typical minimum sequence length is 100 bits, though some tests (like the Linear Complexity Test or the Random Excursions Test) require significantly longer sequences (e.g., 103 to 106 bits with a minimum number of 55 sequences) for meaningful results. This test suite is invaluable for evaluating random number generators, ensuring the quality and unpredictability essential for secure cryptographic operations. It is crucial to consider an additional metric: the Bit Rate (𝐵𝑅), which represents the rate at which truly random bits are generated and output, typically measured in bits per second. Considering the bit rate not only facilitates comparisons with other RTN-based generators, but also provides a means to quantify the impact and trade-offs introduced by post-processing techniques. 5. Experimental results In evaluating the random number generation capabilities of the architecture illustrated in Fig. 3, we will explore increasingly complex defect scenarios to identify subtle yet impactful trade-offs. We begin with the simplest case: a single transistor exhibiting a single RTN. By dissecting the intricate interplay of this defect’s parameters, we uncover critical challenges that influence randomness quality. Drawing on these insights, we propose targeted strategies to enhance the randomness of the generated bitstream. Building on the lessons learned from this baseline configuration, we then examine a more complex scenario in which multiple defects coexist within a single transistor. This multi-defect environment raises a new set of constraints and design considerations, diverging from the single-defect case. By contrasting both scenarios, we not only elucidate the core mechanisms behind their distinct statistical behaviors, but also lay out practical solutions to refine randomness. For all scenarios analyzed, the generated bitstreams using the approach described in Section 4.1 reflect a 65-nm, 1.2-V CMOS technology, a transistor geometry of 80 nm/60 nm, and biasing voltages of 𝑉𝐺𝑆 = 0.9V and 𝑉𝐷𝑆 = 0.1V. To account for RTN, a distribution of defects has been considered such that the dwell times of defects are uniformly distributed between 1 ms and 100 s [21].1 Also, and unless otherwise stated, the average number of defects is 𝜆= 4. 5.1. Scenario A.1: one transistor with one RTN defect 5.1.1. Description of experimental results The goal of this investigation is to examine the relationships among the defect’s dwell times, the 𝑡MCF window, and the resulting random bitstream quality, leveraging the DMCF concept within the proposed RTNbased architecture shown in Fig. 3. To accomplish this, we generated one-million-bit bitstreams under varying dwell times, systematically sweeping across different 𝜏𝑐-to-𝜏𝑒 ratios. For a more structured and insightful analysis, we introduce the concept of a characteristic time constant, 𝜏0. Defining 𝛽 as 𝜏𝑐∕𝜏𝑒, we can express 𝜏𝑐 and 𝜏𝑒 in terms of 𝜏0: 𝜏𝑐= (1 + 𝛽)𝜏0and 𝜏𝑒=(1 + 1 𝛽)𝜏0(4) To cover a wide range of 𝛽 values and achieve reasonable 𝑡MCF window lengths, thus allowing exploration of higher bit rates, we set 𝜏0= 0.001 s. Fig. 5 illustrates the various 𝜏𝑐 and 𝜏𝑒 combinations used. Each 𝛽 value determines the corresponding 𝜏𝑐 and 𝜏𝑒 values; for each 𝛽, we sweep the 𝑡MCF window and generate a 10𝑒6-bit bitstream. We employed 100 equally spaced values of 𝛽 and 100 equally spaced values of 𝑡MCF, resulting in a total of 100×100×1M generated bits. This rigorous approach enables us to determine the optimal conditions for producing a truly random bitstream from RTN using the MCF entropy harvesting function. The results of the parametric exploration are presented in Fig. 6, from which several insights can be drawn. First, there is a clear symmetry with respect to 𝛽, suggesting that the quality of the random bitstream, in terms of HW and AC, is influenced by the larger of the two values, 𝜏𝑐 and 𝜏𝑒. When 𝑡MCF is significantly larger (e.g., 𝑡MCF = 0.1s with 𝛽= 1) or significantly smaller (e.g., 𝑡MCF = 1 ms with 𝛽= 1k or 𝛽= 1 m) than max(𝜏𝑐, 𝜏𝑒), the bitstream consists entirely of zeroes (𝐻𝑊 = 0%) or ones (𝐻𝑊 = 100%), respectively. 1The distribution of defects, as given by (2) for the 65-nm technology under consideration, exhibits an almost uniform behavior in the range between 1 ms and 100 s. AEUE - International Journal of Electronics and Communications 196 (2025) 155801 5 F.J. Rubio-Barbero et al. Fig. 5. Capture (𝜏𝑐, solid blue) and emission (𝜏𝑒, dashed red) time constants as functions of 𝛽=𝜏𝑐 𝜏𝑒 using 𝜏0= 0.001 s. The shaded area indicates the explored 𝑡MCF window range, from 0.001 s to 0.1s. Fig. 6. Heatmaps for the HW and AC metrics of the generated bitstreams of 1 transistor and 1 defect. The solid white line represents the isoline where the ideal value 𝐻𝑊 = 50% is attained. Notably, there exists a specific value of 𝑡MCF at which the bitstream achieves perfect bias, i.e., 𝐻𝑊 = 50%, as indicated by the isoline in the lower part of Fig. 6. This critical value, denoted as 𝑡MCF,opt, is essential for generating truly random bitstreams. By analyzing a single defect device with emission and capture times that follow exponential distributions (characterized by the means 𝜏𝑒 and 𝜏𝑐, respectively), it can be rigorously demonstrated that 𝑡MCF,opt exists. As detailed in Appendix B, this value can be determined using the expression provided in the implicit Eq. (B.6). In this manner, the values of 𝑡MCF,opt were numerically evaluated using (B.6) for each value of 𝛽, and the results have been overlaid on the heatmaps as a solid white line. As observed, the 50%-isoline aligns perfectly with 𝑡MCF,opt, confirming their equivalence. In the special case where 𝜏𝑒=𝜏𝑐 (i.e., 𝛽= 1), an interesting scenario arises: the two overlapping exponential distributions (𝜏𝑒 and 𝜏𝑐) are sampled simultaneously. Under these conditions, 𝑡MCF,opt corresponds to the median of 𝜏𝑒 (or equivalently 𝜏𝑐), which simplifies to 𝑡MCF,opt = 𝜏𝑒⋅ln 2. However, bit bias is not the only condition for generating true random bitstreams. Achieving very low autocorrelation (AC) is also a Fig. 7. Different cases of overlapping 𝑡𝑒 and 𝑡𝑐 exponential distributions: (a) Full Overlapping, (b) Partial Overlapping and (c) Non-overlapping. critical requirement. As shown in Fig. 6, low values of AC are primarily obtained when 𝛽= 1, regardless of the value of 𝑡MCF,opt. Additionally, low AC values can also be observed for extreme values of 𝛽, provided that 𝑡MCF,opt is sufficiently large. Notably, setting 𝑡MCF =𝑡MCF,opt (indicated by the solid white line in the top heatmap) does not, by itself, ensure a low AC value, except in the specific cases where 𝛽= 1, 𝛽 ≫ 1, or 𝛽 ≪ 1. The observation window 𝑡MCF,opt is closely tied to the parameter 𝛽, which directly affects the randomness metrics. In an ideal random bitstream, the chances of the next bit being ‘‘1’’ or ‘‘0’’ are equal. This ideal scenario corresponds to a 50% probability of observing a capture event immediately after an emission event (and vice versa). Such balance is achieved only when the exponential distributions of 𝑡𝑒 (emission times) and 𝑡𝑐 (capture times) fully overlap, which occurs when 𝛽= 1 (as shown in Fig. 7a). When 𝛽≠1, the overlap between the distributions becomes partial (Fig. 7b). In this case, the optimal observation window 𝑡MCF,opt shifts to a value between 𝜏𝑐 and 𝜏𝑒. This partial overlap disrupts the ideal randomness, reducing the 50% probability of alternating events and introducing autocorrelation, which degrades the quality of the random bitstream. As the distributions separate further (𝛽 ≫ 1 or 𝛽 ≪ 1), they no longer overlap (Fig. 7c). In this situation, 𝑡MCF,opt is dominated by the slower distribution (the one with a larger 𝜏), since the probability of detecting the faster event (the one with a smaller 𝜏) approaches 100%. As a result, sampling focuses almost entirely on the slower distribution, producing behavior similar to the ideal overlap scenario shown in Fig. 7a. Fig. 8 provides three distinct perspectives of the heatmaps presented in Fig. 6. In Fig. 8(a) (left), it is shown that both 𝑡MCF,opt and the autocorrelation (AC) increase as 𝛽 deviates from the ideal value of 𝛽= 1. Fig. 8(b) (center) illustrates the behavior of the Hamming Weight (HW) and AC as the ratio 𝛼=𝑡MCF∕𝑡MCF,opt moves away from unity, highlighting the degradation in randomness quality when 𝑡MCF is not optimally set. Finally, Fig. 8(c) (right) reveals that even when 𝛼= 1 (i.e., 𝑡MCF =𝑡MCF,opt) and HW approaches the ideal value of 50%, the autocorrelation still depends on the specific dwell times 𝜏𝑒 and 𝜏𝑐 of the defect from which entropy is extracted. A sample set of 65,000 bits was used to generate the bitmaps in Fig. 9 (black pixels represent 𝟷-bits) for four values of 𝛽: 1, 5, 10, and 0.01. The 1.38 ms observation window used in all of these cases of 𝛽 corresponds to the transistor’s optimal window, 𝑡MCF,opt, with 𝛽= 𝜏𝑐∕𝜏𝑒= 0.002 s∕0.002 s = 1, indicated by a gray dashed line in Fig. 8(a). As shown in Fig. 9(b), no discernible repeating patterns, large contiguous blocks, or extended lines of a single color are apparent, implying negligible bit bias. Instead, the balanced distribution of black and white pixels suggests a high degree of randomness in that sequence. In contrast, the other bitmaps increasingly exhibit signs of bit bias and elevated autocorrelation, highlighting the impact of 𝛽 on bitstream randomness. To further evaluate randomness and get a more accurate insight, these 4 transistors (corresponding to 4 different values 𝛽) of have been selected, as indicated in 8(c), and the corresponding bitstreams have been processed by the NIST SP800-22 test suite [20]. This suite, developed by the National Institute of Standards and Technology (NIST) AEUE - International Journal of Electronics and Communications 196 (2025) 155801 6 F.J. Rubio-Barbero et al. Fig. 8. (a) HW and AC for selected values of 𝛽. (b) HW and AC for selected values of 𝛽 around the optimal observation window. (c) HW and AC for selected values of 𝛽 at the optimal observation window. Fig. 9. 256 × 256 bitmaps for 𝑡MCF = 0.00138 s and transistors with (a) 𝛽= 1, (b) 𝛽= 5,(c) 𝛽= 10, and (d) 𝛽= 0.01. Table 1 Pass rates results from the NIST SP800-22 tests at selected values of 𝛽. Test name 𝛽 values 0.01 1 5 10 Frequency 55/55 (100%) 55/55 (100%) 55/55 (100%) 54/55 (98.1818%) Block frequency 54/55 (98.18%) 55/55 (100%) 50/55 (90.91%) 52/55 (94.5455%) # Cumulative Sumsa55/55 (100%) 54.5/55 (99.09%) 54.5/55 (99.09%) 54/55 (98.1818%) Runs 0/55 (0%)b55/55 (100%) 0/55 (0%) 0/55 (0%) Longest run 52/55 (94.55%) 55/55 (100%) 0/55 (0%) 0/55 (0%) Rank 54/55 (98.18%) 55/55 (100%) 55/55 (100%) 55/55 (100%) FFT 55/55 (100%) 55/55 (100%) 0/55 (0%) 0/55 (0%) # non Overlapping Template 53.452/55 (97.19%) 54.487/55 (99.07%) 3.743/55 (6.81%) 8.839/55 (16.0688%) Overlapping template 50/55 (90.91%) 55/55 (100%) 0/55 (0%) 0/55 (0%) Universal 51/55 (92.73%) 55/55 (100%) 0/55 (0%) 0/55 (0%) Approximate entropy 0/55 (0%) 55/55 (100%) 0/55 (0%) 0/55 (0%) # RandomExcursions 37.125/38 (97.7%) 38.75/39 (99.36%) 11.625/26.875 (43.26%) 26.125/33 (79.1667%) # Random excursions variant 37.722/38 (99.27%) 38.6111/39 (99%) 29.5556/30 (98.52%) 32.833/33 (99.4948%) # Serial 0/55 (0%) 55/55 (100%) 0/55 (0%) 0/55 (0%) Linear complexity 53/55 (96.36%) 55/55 (100%) 55/55 (100%) 54/55 (98.1818%) a Symbol # indicates tests with two or more sub-tests; the Pass rates in these cases are the average values of the sub-tests. b The bold values indicate tests that failed at passing the test (Pass rate ≤95%). in the United States, serves as a comprehensive set of guidelines for information security and has gained widespread recognition as an authoritative resource and a global benchmark in the field of security standards. The NIST SP800-22 suite comprises 15 distinct tests, each designed to assess various aspects of randomness in a sequence. These tests produce two critical outcomes: a minimum 𝑃-value and a pass rate. A test is considered successful if the 𝑃-value exceeds 0.01 and the pass rate is greater than 95%, reflecting compliance with rigorous randomness criteria. According to NIST recommendations, at least 55 sequences of 1 million bits each must be processed to derive statistically meaningful results for the uniformity of the attained P-values. Therefore, for each transistor (i.e., each value of 𝛽), 55 × 106−𝑏𝑖𝑡 bitstreams have been generated. The specific setting parameters used during the NIST test runs can be found in Appendix D. The results of this evaluation are presented in Table 1. Note that each bitstream submitted to the NIST test suite is generated with 𝛼= 1, that is, at the observation window 𝑡MCF =𝑡MCF,opt, which provides an optimal Hamming weight (HW) of 50%. Maintaining this 50% HW is essential: any deviation would cause the bitstream to fail the Frequency test (the first in the NIST test suite), thereby invalidating the subsequent tests. The table shows the Pass rates for each test (the number of sequences whose 𝑃-value exceeds 0.01 and thus is considered truly random). These rates reveal that 𝛽= 1 (i.e., 𝜏𝑒= 𝜏𝑐) consistently yields the highest Pass rates in all the NIST SP80022 tests, indicating that bitstreams generated under these conditions exhibit the strongest statistical properties. In contrast, at 𝛽= 0.01, 𝛽= 5, and 𝛽= 10, multiple tests fail, which could indicate how deviations from 𝛽= 1 degrade the randomness quality of the output. However, a more detailed inspection reveals that the lowest pass rates occur at 𝛽= 5. As 𝛽 shifts away from this value, the pass rates steadily improve. This trend is illustrated in Fig. 10, where a 55 × 106-bit bitstream was AEUE - International Journal of Electronics and Communications 196 (2025) 155801 7 F.J. Rubio-Barbero et al. Fig. 10. NIST Pass Rates (NPRs) at different 𝛽 values. Fig. 11. AC levels for different 𝛽 values. generated and evaluated for 100 distinct values of 𝛽, spanning 𝛽= 0.1m to 𝛽= 10𝑘. This graph reports the NIST pass rates (or NPRs) by averaging and normalizing to 1, for each value of 𝛽, the pass rates obtained from the 15 NIST tests. As illustrated, the two regions (Pass and Fail) are clearly differentiated; the NPR peaks near 𝛽= 1 (Transistor A), indicating that the generated bitstreams pass all randomness tests, suggesting an optimal 𝜏𝑐∕𝜏𝑒 ratio, beyond which deviations progressively degrade the statistical quality of the output bitstreams. However, once 𝛽 surpasses thresholds of 1k or 1m, the NPR values again indicate behavior consistent with truly random bitstreams, as it has been pointed out in Fig. 7 where for values close of 𝛽 close to 1 but different (non-overlapping) the worst results for AC are found out, properly translated to NIST suite tests. This can also be seen in Fig. 11, showing how values of AC below 0.001 seem to be a good predictor (as long as HW remains close to 50%) of a high NPR. The bit rate of the proposed approach for single-defect transistors is contingent on the observation window 𝑡MCF, as one bit is produced per observation when the value of 𝐷MCF is reached. As previously discussed, to ensure the generation of truly random bitstreams, the observation window must be set to its optimal value, 𝑡MCF =𝑡MCF,opt, which is a function of the defect’s dwell times (refer to Appendix B). Notably, shorter dwell times result in a higher bit rate. Thus, for a given integration technology where random telegraph noise (RTN) is present, it is crucial to identify the defect with the shortest dwell times in order to maximize the bit rate of the proposed RTN-based TRNG. Consider a technology where RTN defects exhibit dwell times uniformly distributed between 10 μs and 1ms. In this scenario, the minimum achievable 𝑡MCF,opt occurs when the characteristic times 𝜏𝑒 and 𝜏𝑐 are both equal and approximately 10 μs, resulting in a bit rate of approximately 1 𝑡MCF,opt ≈1 7𝜇𝑠 ≈ 140 kbits/s. The likelihood of identifying such a transistor is influenced by the size of the transistor array employed (see Fig. 3). It can be shown, as elaborated in Appendix C, that an array of 1000 transistors is sufficient to achieve a 90% probability of finding a transistor with 𝜏𝑒=𝜏𝑐≈ 10 μs. It is valuable to compare the bit rates achievable with the proposed approach to those of similar RTN-based TRNGs, particularly Table 2 Maximum bit rates (bits/s) comparison. [11] [10] This work 1.5 2⋅𝜋⋅𝜏0 1 2.2⋅𝜏0 1 𝑡MCF,opt those in [10,11]. The maximum bit rates reported in these studies are summarized in Table 2. When applying the technology described earlier, the resulting bit rates are shown in the heatmaps in Fig. 12. As demonstrated, the RTN-based TRNG presented in this work achieves higher bit rates than those reported in the referenced studies. 5.1.2. Scenario A.1: Discussion of results. Several conclusions can be drawn from the previously reported results on the implementation of the TRNG using transistors with single-defect RTN (1T1D). The results demonstrate that the use of 1T1D holds considerable promise, offering a robust mechanism for generating high-quality, truly random bitstreams. This method not only shows significant potential in terms of randomness quality but also offers a practical approach for hardware-based random number generation in cryptographic applications. However, despite the promising performance, several challenges have emerged that need to be carefully addressed to optimize the overall system performance. These challenges include: (A) the difficulties in achieving the correct 𝛽=𝜏𝑐∕𝜏𝑒 value of the defect, (B) the precision required in setting the observation window 𝑡MCF,opt, and, (C) the relatively low probability of finding a transistor with exactly one defect and the right dwell times to boost the bit rate. The importance of considering and overcoming these challenges will be discussed and dealt with in this paper, as they are crucial for enhancing the reliability, efficiency, and bit rate of the TRNG, ensuring its viability for real-world cryptographic applications. The first challenge involves the difficulty in finding the defect with the correct value of the 𝛽 ratio. For optimal random number generation, 𝛽 must be within specific ranges: either close to 1, less than or equal to 1 ms, or greater than or equal to 1k. This is because deviations from these ranges can lead to autocorrelation (AC), where there are repeating patterns or dependencies between consecutive bits in the bitstream. This autocorrelation degrades the quality of the random numbers generated by the TRNG, making them unsuitable for cryptographic applications. The second significant challenge relates to the difficulty in accurately setting and identifying the optimal observation window, 𝑡MCF,opt. The observation window 𝑡MCF plays a critical role in determining the randomness of the generated bitstream. When 𝑡MCF is set to its optimal value, 𝑡MCF,opt, the bitstream exhibits a 50% Hamming weight, meaning that there are an equal number of 0s and 1s, a necessary condition for true randomness. However, setting 𝑡MCF precisely to this optimal value presents two main challenges. First, it is technically difficult to set 𝑡MCF with the required precision. The RTN signal is inherently noisy and fluctuates over time, so accurately measuring the maximum current fluctuation over a specific time window requires sophisticated equipment and high precision. Even small deviations in the window could result in a significant reduction in the quality of the bitstream, causing the bitstream to become biased (i.e., all 0s or all 1s) or to exhibit periodic patterns. Second, identifying 𝑡MCF,opt is a non-trivial task and determining the optimal window for each transistor may require empirical measurement and fine-tuning which can be time consuming and computationally expensive, particularly when dealing with large arrays of transistors. Fortunately, both challenges can be addressed, as demonstrated later, by employing more advanced bitstream generation techniques and post-processing methods that mitigate the impact of deviations from the ideal values of 𝛽 and 𝑡MCF. The last challenge identified is the low probability of finding a transistor with exactly one defect and proper dwell times. This is AEUE - International Journal of Electronics and Communications 196 (2025) 155801 8 F.J. Rubio-Barbero et al. Fig. 12. (a) Maximum bit rate from [11] . (b) Maximum bit rate from [10]. (c) Bit rate in this work. a significant issue, as the reliability and efficiency of the RTN-based TRNG depend heavily on the presence of a single defect within the transistor. In real-world scenarios, the density of defects within a transistor typically follows a Poisson distribution, which can vary depending on the manufacturing process and the specific characteristics of the technology used. The distribution of defects (i.e., how probable are the dwell times 𝜏𝑐 and 𝜏𝑐) are also dependent on the manufacturing process (both the transistor’s biasing voltages and the temperature have an impact as well, but, for the sake of simplicity, these two factors will not be considered here). Essentially, the defects must exhibit capture and emission times that are suitable for achieving the desired bit rate. For example, if bit rates in the kilobit-per-second range are required, a transistor with a single RTN defect and dwell times on the order of milliseconds must be identified. As explained in Appendix C, the probability of finding such a transistor within a given array can be determined. This probability is influenced by the technology (in terms of both defect density and defect distribution), the size of the transistor array, and the desired dwell times. As a toy example, Fig. 13 illustrates the size of the transistor array required to identify a transistor with exactly one RTN defect, given varying values of the technology’s defect density, represented by the mean value 𝜆. The defect distribution in this example technology assumes that dwell times are uniformly distributed between 1 ms and 1 s, with the desired defect having a dwell time between 1 ms and 1.25 ms (the lowest available in the technology) to ensure adequate bit rates. These stringent conditions lead to varying array sizes necessary to achieve a 95% probability of locating such a transistor, as shown in Fig. 13(a). For defect densities of 𝜆= 3,4, an array of 1000 transistors is sufficient, while for 𝜆= 2, at least 1600 transistors are needed and for 𝜆= 1 an array with at least 3700 transistors would be required. It is interesting to note that, to locate a transistor with exactly one defect (and no more), the observation window can be adjusted to maximize the detection probability. This is due to the nature of the number of RTN defects in a transistor, which follows a Poisson distribution, and their uniformity of dwell times. By changing the observation window, from the smallest one (from 1 ms to 1.25 ms) to the full window (from 1 ms to 1 s), using the example above, the probability of detecting a transistor with exactly one defect can be maximized, reaching a peak of ≈37%. This is illustrated in Fig. 13(b), where the x-axis shows the ratio of the window size to the full window. When 𝜆= 1, the full window must be used to achieve the highest detection probability. However, for 𝜆= 20, the window must be narrowed to maximize the probability. This suggests that, for any value of 𝜆, the maximum detection probability of ≈37% can be achieved by properly adjusting the observation window. A key advantage of this adjustment is that, for the peak detection probability of 37%, the minimum array size needed to guarantee a detection probability of 95% is reduced to around 10 devices (see Appendix C). However, adjusting the window size comes with a trade-off in bit rate. For example, when Fig. 13. (a) Probability of finding single-defect RTN versus transistor array size. (b) Array size to achieve a 95% probability of finding 1 single-RTN transistor. 𝜆= 1, using the full window minimizes the array size to 10 devices, but it significantly impacts the bit rate, which can drop, depending on the defect’s specific dwell times, from 1000 b/s to just 1 b/s. If the window is narrowed to the range from 1 ms to 1.25 ms, the array size increases to over 3700 devices, while the bit rate can safely remain between 1000 b/s and 800 b/s. These probability values introduce a practical challenge, as finding a transistor that meets the ideal conditions is crucial for optimal TRNG operation. Alternatively, since the probability of finding transistors with multiple RTN defects is always higher than the probability of finding transistors with exactly one defect, a method for handling multiple defects, each with its own dwell times, without compromising the randomness of the bitstream is essential. This approach will be explored in subsequent sections. In summary, the issues discussed above (A) finding the correct 𝛽 value, (B) accurately setting the observation window 𝑡MCF, and (C) finding a transistor with exactly one defect—represent significant challenges in the design and implementation of RTN-based TRNGs. Although these challenges present obstacles, they also offer an opportunity to innovate and refine the approach. In the following sections, AEUE - International Journal of Electronics and Communications 196 (2025) 155801 9 F.J. Rubio-Barbero et al. Fig. 26. Resulting bit rates from the bitstreams with the values of 𝑡MCF,opt of Fig. 21. as the core metric, we showed that careful tuning of the sampling window yields bitstreams that maintain excellent randomness across both single-defect and multi-defect scenarios. Throughout our experiments, validated using simple metrics such as Hamming weight and autocorrelation, as well as the NIST SP 800-22 suite, we encountered three central considerations. First, while single-defect transistors provide straightforward entropy extraction, multi-defect devices dominate in real fabrication, and we showed that simple post-processing and well-chosen observation windows can accommodate these overlapping defect dynamics without compromising randomness. Second, finding the right balance between bit rate and bit quality is essential: shorter windows accelerate bit generation but can induce bias, whereas longer windows improve randomness at the cost of lower throughput, so design flexibility is crucial to strike an effective compromise. Finally, ensuring practical scalability relies on recognizing that multidefect transistors appear more frequently, which reduces the size of the transistor array needed to identify suitable RTN sources, thus promoting feasible integration into advanced technology nodes. Overall, the proposed scheme compares favorably to existing RTN-based TRNGs, offering notable gains in bit-rate flexibility, hardware simplicity, and device-level adaptability. The findings herein reinforce the idea that RTN, properly measured and managed, can serve as a natural, readily available source of entropy, paving the way for efficient and secure on-chip random number generation. Looking ahead, our next step is to explore XOR-based setups that merge RTN from multiple transistors, sustaining high bit rates while reducing the impact of device variability. By carefully combining parallel streams of randomness, we anticipate a more powerful and scalable RTN-based TRNG capable of efficient, robust operation. CRediT authorship contribution statement F.J. Rubio-Barbero: Writing – review & editing, Writing – original draft, Visualization, Validation, Software, Methodology, Investigation, Formal analysis, Data curation, Conceptualization. F. de los SantosPrieto: Writing – review & editing, Writing – original draft, Validation, Software, Investigation, Formal analysis. R. Castro-Lopez: Writing – review & editing, Visualization, Validation, Supervision, Software, Resources, Project administration, Methodology, Investigation, Funding acquisition, Formal analysis, Data curation, Conceptualization. E. Roca: Writing – review & editing, Project administration, Funding acquisition. F.V. Fernandez: Writing – review & editing, Resources, Project administration, Funding acquisition. Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Acknowledgments This work was supported by grant TED2021-131240B-I00 funded by MICIU/AEI/10.13039/501100011033 and by the ‘‘European Union NextGenerationEU/PRTR’’. The work was also supported by grant PID2022-136949OB-C21 funded by MICIU/AEI/10.13039/5011000 11033 and by ‘‘ERDF/EU’’, by grant ProyExcel_00536 funded by Consejería de Universidad, Investigación e Innovación of Junta de Andalucía, and by Ministerio de Asuntos Económicos y Transformación Digital through grant TSI-069100-2023-1 of PERTE Chip Chair program, funded by European Union - NextGenerationUE. F. J. RubioBarbero was supported by grant PREP2022-000765 funded by MICIU/AEI/10.13039/501100011033 and by ‘‘FSE+’’. A preliminary version of this work is published in the 2024 edition of the International Conference on Synthesis, Modeling, Analysis and Simulation Methods, and Applications to Circuit Design (SMACD) [24]. Appendix A. Basic randomness metrics formulae To measure the quality of the random number, some metrics can be used to assess this randomness. With the following expressions, a first analysis can be done computationally faster than directly evaluating the NIST SP 800-22 suite. •Hamming Weight: In theory, a perfectly random bitstream has an HW value of 50%. To evaluate the HW in a random sequence, the following expression is used: 𝐻𝑊 (%) = 1 𝑛 𝑛 ∑ 𝑖=1 𝑏𝑖⋅100 (A.1) where 𝑛 is the total number of bits and 𝑏𝑖 denotes the value, 0 or 1, of the 𝑖th bit. •Autocorrelation: A flawless random bitstream is expected to present an AC value of zero. AC can be determined by using the subsequent expression: 𝑟k=∑𝑛−𝑘 𝑖=1 (𝑥𝑖−𝑥)⋅(𝑥𝑖+𝑘−𝑥) ∑𝑛 𝑖=1 (𝑥𝑖−𝑥)2(A.2) where 𝑥𝑖 and 𝑥𝑖+𝑘 correspond to the 𝑖 bit and the 𝑘-lagged bit respectively. The computed 𝑟k corresponds to the autocorrelation function at the 𝑘 lagged value of the bitstream. Appendix B. Optimum 𝒕MCF values The probability of an initially emitted (captured) defect of undergoing a capture (emission) in a time interval 𝑡MCF is given by the following expression [25]: 𝑃𝑐∕𝑒(𝑡MCF)= 1 − exp (−𝑡MCF 𝜏𝑐∕𝑒)(B.1) The probability of an event occurrence (and the detection of the corresponding current fluctuation) in a defect that can be emitted or captured is 𝑃𝑑𝑒𝑓 (𝑡MCF)=𝑃𝑜𝑐𝑐 ⋅𝑃𝑒(𝑡MCF)+ (1 − 𝑃𝑜𝑐𝑐 )⋅𝑃𝑐(𝑡MCF)(B.2) where 𝑃𝑜𝑐𝑐 is the occupation probability of the defect, which, in the steady-state, is given by 𝜏𝑒∕(𝜏𝑒+𝜏𝑐). Using this value of 𝑃𝑜𝑐𝑐 and reordering the expression, 𝑃𝑑𝑒𝑓 (𝑡MCF)= 1 − 𝜏𝑐 𝜏𝑒+𝜏𝑐 ⋅exp (−𝑡MCF 𝜏𝑐)−𝜏𝑒 𝜏𝑒+𝜏𝑐 ⋅exp (−𝑡MCF 𝜏𝑒)(B.3) Considering a situation where time constants are equal (i.e., 𝛽= 1) or significantly different from each other, it can be demonstrated that the larger value of 𝜏 determines the behavior. Thus, the influence of the smaller 𝜏 can be neglected. Typical scenarios for this are when 𝛽 > 1000 AEUE - International Journal of Electronics and Communications 196 (2025) 155801 16 F.J. Rubio-Barbero et al. or 𝛽 < 0.001. Consequently, the expression above can be approximated by 𝑃𝑑𝑒𝑓 (𝑡MCF)= 1 − exp (−𝑡MCF 𝜏𝑒𝑞 )(B.4) where 𝜏𝑒𝑞 is defined as 𝜏𝑒𝑞 =𝜏𝑒+𝜏𝑐−𝜏𝑒 1 + exp (−𝜏𝑐−𝜏𝑒 𝜏𝑐+𝜏𝑒)(B.5) To achieve an unbiased bitstream in a one-defect transistor, a probability of 1/2 can be imposed either in expression (B.3) to obtain Eq. (B.6), 𝜏𝑐 𝜏𝑒+𝜏𝑐 ⋅exp (−𝑡MCF,opt 𝜏𝑐)+𝜏𝑒 𝜏𝑒+𝜏𝑐 ⋅exp (−𝑡MCF,opt 𝜏𝑒)=1 2(B.6) or in Eq. (B.4) to obtain the approximated optimum value 𝑡MCF,opt = ln(2) ⋅𝜏𝑒𝑞. In the multi-defect case, every defect can provoke the transistor current fluctuation independently, and the inclusion–exclusion principle can be used to account for the probability of an event. 𝑃𝑒𝑣𝑒𝑛𝑡(𝑡MCF) = 𝑛 ∑ 𝑖=1 𝑃𝑑𝑒𝑓,𝑖 −∑ 𝑖<𝑗 𝑃𝑑𝑒𝑓,𝑖 ⋅𝑃𝑑𝑒𝑓,𝑗 + … +(−1)𝑛−1 ∑ 𝑖<⋯<𝑛 𝑃𝑑𝑒𝑓,𝑖 ⋅𝑃𝑑𝑒𝑓,𝑗 ⋅…⋅𝑃𝑑𝑒𝑓,𝑛 (B.7) where 𝑛 is the number of defects in the transistor. If the approximation (B.4) is valid for every defect, the expression above can be simplified. For instance, when 𝑛= 2, the expression can be proven to be 𝑃𝑒𝑣𝑒𝑛𝑡(𝑡MCF) = 1 − exp (−𝑡MCF (𝜏𝑒𝑞,1∥𝜏𝑒𝑞,2))(B.8) where (𝜏𝑒𝑞,1∥𝜏𝑒𝑞,2) = 𝜏𝑒𝑞1𝜏𝑒𝑞2 𝜏𝑒𝑞1+𝜏𝑒𝑞2. It can be seen that the expression obtained is equivalent to Eq. (B.3) with an effective time constant of (𝜏𝑒𝑞,1∥𝜏𝑒𝑞,2). Thus, the generalization for 𝑛 defects is straightforward. 𝑃𝑒𝑣𝑒𝑛𝑡(𝑡MCF) = 1 − exp (−𝑡MCF (𝜏𝑒𝑞,1∥𝜏𝑒𝑞,2‖…‖𝜏𝑒𝑞,𝑛))(B.9) Again, we can impose an event probability of 1/2 and either solve numerically Eq. (B.7) or use the approximated optimum value 𝑡MCF,opt = ln(2) ⋅(𝜏𝑒𝑞,1∥𝜏𝑒𝑞,2‖…‖𝜏𝑒𝑞,𝑛). Appendix C. Finding the appropriate transistor Assuming that 𝑃𝑡𝑡𝑜 is the probability that a transistor has the appropriate defect characteristics, the probability of finding at least one such transistor in an array of 𝑁 devices is given by 𝑃𝑎𝑟𝑟𝑎𝑦 = 1 − (1 − 𝑃𝑡𝑡𝑜)𝑁(C.1) The probability 𝑃𝑡𝑡𝑜 can be broken down by considering the key features of defects in a transistor: the number of defects, their time constants, and their amplitudes. Subsequently, it is assumed that the probability of having 𝑘 defects is denoted by 𝑃𝑘, the probability that a defect has the appropriate time characteristics is 𝑃𝜏, and the probability that it has suitable amplitudes is 𝑃𝛥𝐼 . Since the key features involve defects with the appropriate time constants, the number of total defects in the device is not significant. Therefore, the probability of a transistor having 𝑛 defects with the desired time and amplitude characteristics is given by 𝑃𝑡𝑡𝑜,𝑛 = ∞ ∑ 𝑘=𝑛 𝑃𝑘⋅(𝑘 𝑛)⋅(𝑃𝜏)𝑛⋅(1 − 𝑃𝜏)𝑘−𝑛⋅(𝑃𝛥𝐼 )𝑛(C.2) where the binomial term arises from the probability of selecting 𝑛 defects with the appropriate characteristics out of 𝑘 total defects. If we are interested in a transistor containing several defects within a range, the probability can be obtained by summing the required terms of the equation above. For instance, the probability of a transistor Table D.5 Configuration values used to run the NIST SP 800-22 suite. NIST test parameters Parameter Default Used Block Frequency Test - block length (M) 128 100k NonOverlapping Template Test - block length (m) 9 10 Overlapping Template Test - block length (m) 9 10 Approximate Entropy Test - block length (m) 10 2 Serial Testblock length (m) 16 2 Linear Complexity Test - block length (M) 500 500 having at least one but no more than 𝑛𝑚𝑎𝑥 defects with the desired time constants and amplitudes is 𝑃𝑡𝑡𝑜 = 𝑛𝑚𝑎𝑥 ∑ 𝑛=1 𝑃𝑡𝑡𝑜,𝑛 (C.3) In these equations, 𝑃𝑘, 𝑃𝜏, and 𝑃𝛥𝐼 are quantities that can be evaluated according to the technology-dependent distribution of the number of defects, time constants, and amplitudes, respectively. Using the values of these quantities and Eq. (C.1) in combination with (C.2) or (C.3), an approximated value of the array size required to guarantee the presence of appropriate transistors can be obtained. Appendix D. NIST test suite used parameters All the 15 NIST tests are executed with the specified bitstream length, while the rest of the parameters are adjusted according to the input length as indicated in [20]. More specifically, the test parameters utilized are indicated in Table D.5, which must be carefully selected to comply with the guidelines given in the NIST document. This procedure also involves the selection of the minimum number of sequences, which must be at least 𝑛𝑠𝑒𝑞 = 55, that must be processed to derive statistically meaningful results for the sake of uniformity of the 𝑝-value analysis. Additionally, and according to the minimum input data for some tests, some of them need a larger number of bits than others (i.e. serial tests, random excursions test and random excursions variable), being the minimum required for those to be at least 106 bits. This results in an extra challenge in terms of computing charge to evaluate NIST and validating passing the tests only under certain conditions. Data availability Data will be made available on request. References [1] National Institute of Standards and Technology (NIST). FIPS PUB 197: Advanced encryption standard (AES). 2001, URL https://nvlpubs.nist.gov/nistpubs/FIPS/ NIST.FIPS.197.pdf. [Accessed 27 November 2024]. [2] Rivest RL, Shamir A, Adleman L. A method for obtaining digital signatures and public-key cryptosystems. Commun ACM 1978;21(2):120–6. http://dx.doi.org/ 10.1145/359340.359342. [3] Lee K, Lee S-Y, Seo C, Yim K. Trng (true random number generator) method using visible spectrum for secure communication on 5 g network. IEEE Access 2018;6:12838–47. http://dx.doi.org/10.1109/ACCESS.2018.2799682. [4] Vasyltsov I, Hambardzumyan E, Kim Y-S, Karpinskyy B. Fast digital trng based on metastable ring oscillator. In: Oswald E, Rohatgi P, editors. Cryptographic hardware and embedded systems – CHES 2008. Berlin, Heidelberg: Springer Berlin Heidelberg; 2008, p. 164–80. [5] Luo W, Takeuchi N, Chen O, Yoshikawa N. Low-autocorrelation random number generator based on adiabatic quantum-flux-parametron logic. IEEE Trans Appl Supercond 2021;31(5):1–5. http://dx.doi.org/10.1109/TASC.2021.3070460. [6] Diaz-Fortuny J, Martin-Martinez J, Rodriguez R, Castro-Lopez R, Roca E, Aragones X, Barajas E, Mateo D, Fernandez FV, Nafria M. A versatile CMOS transistor array IC for the statistical characterization of time-zero variability, RTN, BTI, and HCI. IEEE J Solid-State Circuits 2019;54(2):476–88. http://dx. doi.org/10.1109/JSSC.2018.2881923. AEUE - International Journal of Electronics and Communications 196 (2025) 155801 17 F.J. Rubio-Barbero et al. [7] Santana-Andreo A, Saraza-Canflanca P, Castro-Lopez R, Roca E, Fernandez FV. Reliability improvement of sram pufs based on a detailed experimental study into the stochastic effects of aging. AEU - IJEC 2024;176:155147. http://dx.doi. org/10.1016/j.aeue.2024.155147. [8] Camacho-Ruiz E, Castro-Lopez R, Roca E, Brox P, Fernandez FV. A novel physical unclonable function using rtn. In: Proc. of ISCAS. 2022, p. 160–4. http://dx.doi.org/10.1109/ISCAS48785.2022.9937632. [9] Brederlow R, Prakash R, Paulus C, Thewes R. A low-power true random number generator using random telegraph noise of single oxide-traps. In: 2006 IEEE international solid state circuits conference - digest of technical papers. San Francisco, CA, USA: IEEE; 2006, p. 1666–75. http://dx.doi.org/10.1109/ISSCC. 2006.1696222, URL https://ieeexplore.ieee.org/document/1696222/. [10] Chen X, Wang L, Li B, Wang Y, Li X, Liu Y, Yang H. Modeling random telegraph noise as a randomness source and its application in true random number generation. IEEE Trans Comput-Aided Des Integr Circuits Syst 2016;35(9):1435–48. http://dx.doi.org/10.1109/TCAD.2015.2511074. [11] Mohanty A, Sutaria KB, Awano H, Sato T, Cao Y. Rtn in scaled transistors for on-chip random seed generation. IEEE Trans Very Large Scale Integr Syst 2017. http://dx.doi.org/10.1109/tvlsi.2017.2687762. [12] Brown J, Zhang JF, Zhou B, Mehedi M, Freitas P, Marsland J, Ji Z. Randomtelegraph-noise-enabled true random number generator for hardware security. Sci Rep 2020;10(1):17210. http://dx.doi.org/10.1038/s41598-020-74351-y. [13] Zanotti T, Ranjan A, O’Shea SJ, Raghavan N, Thamankar R, Leong Pey K, Maria Puglisi F. Guidelines for the design of random telegraph noise-based true random number generators. IEEE Trans Device Mater Reliab 2024;24(2):184–93. http://dx.doi.org/10.1109/TDMR.2024.3394576. [14] Grasser T, Reisinger H, Goes W, Aichinger T, Hehenberger P, Wagner P-J, Nelhiebel M, Franco J, Kaczer B. Switching oxide traps as the missing link between negative bias temperature instability and random telegraph noise. In: Proc. of IEEE iEDM. 2009, p. 1–4. [15] Saraza-Canflanca P, Camacho-Ruiz E, Castro-Lopez R, Roca E, Martin-Martinez J, Rodriguez R, Nafria M, Fernandez FV. Simulating the impact of random telegraph noise on integrated circuits. In: Proc. of SMACD. 2021, p. 1–4. [16] Nagumo T, Takeuchi K, Yokogawa S, Imai K, Hayashi Y. New analysis methods for comprehensive understanding of random telegraph noise. In: 2009 IEEE international electron devices meeting. IEDM, 2009, p. 1–4. http://dx.doi.org/ 10.1109/IEDM.2009.5424230. [17] Islam AM, Nakai T, Onodera H. Statistical analysis and modeling of random telegraph noise based on gate delay variation measurement. In: Proc. of ICMTS. 2016, p. 82–7. [18] Saraza-Canflanca P, Martin-Martinez J, Castro-Lopez R, Roca E, Rodriguez R, Fernandez FV, Nafria M. Statistical characterization of time-dependent variability defects using the maximum current fluctuation. IEEE TED 2021;68(8):4039–44. http://dx.doi.org/10.1109/TED.2021.3086448. [19] Rubio-Barbero FJ, Camacho-Ruiz E, Castro-Lopez R, Roca E, Fernandez FV. A peak detect & hold circuit to measure and exploit rtn in a 65-nm cmos puf. In: Proc. of SMACD. 2023, p. 1–4. http://dx.doi.org/10.1109/SMACD58065.2023. 10192247. [20] National Institute of Standards and Technology. A statistical test suite for random and pseudorandom number generators for cryptographic applications. Special Publication 800-22; 2010. [21] Martin-Martinez J, Castro-Lopez R, Roca E, Rodriguez R, Fernandez FV, Nafria M. Random telegraph noise characterization in a wide range of temperatures. In: 2025 15th Spanish conference on electron devices. CDE, 2025, p. 1–4. [22] Stipčević M, Koç ÇK. True random number generators. Cham: Springer International Publishing; 2014, p. 275–315. [23] Woo KS, Wang Y, Kim Y, Kim J, Kim W, Hwang CS. A combination of a volatilememristor-based true random-number generator and a nonlinear-feedback shift register for high-speed encryption. Adv Electron Mater 2020;6(5):1901117. [24] Rubio-Barbero FJ, de los Santos-Prieto F, Castro-Lopez R, Roca E, Fernandez FV. Harvesting RTN for true random number generators and physical unclonable functions. In: 2024 20th international conference on synthesis, modeling, analysis and simulation methods and applications to circuit design. SMACD, 2024, p. 1–4. [25] Grasser T. Stochastic charge trapping in oxides: From random telegraph noise to bias temperature instabilities. Microelectron Reliab 2012;52(1):39–70. AEUE - International Journal of Electronics and Communications 196 (2025) 155801 18