A VLSI module to authenticate unclonable things

Depósito de investigación de la Universidad de Sevilla https://idus.us.es/ This is an Accepted Manuscript of an article published by IEEE in International Symposium on Consumer Electronics on 06 August 2015, available at: https://doi.org/10.1109/ISCE.2015.7177831 “© 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other Works” A VLSI Module To Authenticate Unclonable Things Iluminada Baturone, Miguel A. Prada-Delgado IMSE-CNM, University of Seville and CSIC Seville, Spain {lumi, prada}@imse-cnm.csic.es Susana Eiroa Alter Technology Seville, Spain [email protected] Abstract—This paper presents a novel VLSI module that implements a lightweight symmetric authentication protocol based on Keyed-Hash Message Authentication Code (HMAC). The cryptographic key and the random numbers needed by the protocol are generated efficiently by a SRAM acting as a Physical Unclonable Function (PUF). Keywords—hardware security; trust hardware; authentication; physical unclonable functions I. INTRODUCTION In the near future many physical objects (things) will be interconnected. To establish a trustworthy relation among them, fundamental requirements that should be met are authentication and integrity. A VLSI module attached to each thing provides the advantages of very small size, weight, and power consumption as well as low price (a high production of integrated circuits makes the price per unit low). A lightweight symmetric authentication protocol has been selected to facilitate its VLSI implementation. The use of MAC, and in particular HMAC (Keyed-Hash Message Authentication Code standardized in [1]), is the most widespread technique employed in symmetric cryptography to ensure that the original message has not been altered or manipulated, providing integrity and authentication at the same time. The lightest and simplest hash function based on Photon family [2], Photon-80/20/16, has been selected to construct the HMAC. The novel and main constitutive block of the module is a Static Random Access Memory (SRAM) that generates true random numbers, employed as nonces in the protocol, and the private key, K, which is shared by the things of the net. The key is not stored but generated “on the fly” using a Code Offset-based Helper Data Algorithm (HDA), as described in [3]. The intrinsic nature of the SRAM (which acts as a Physical Unclonable Function, PUF) is exploited to generate the key, making the thing unclonable. The paper is structured as follows. The main operating modes of the module, which are registration and authentication, are described briefly in Sections II and III, respectively. Section IV summarizes implementation features. Finally, conclusions are given in Section V. II. REGISTRATION MODE In registration mode, the most suitable cells of the SRAM for generating the key and the nonce employed by the authentication protocol are selected. This is carried out by powering up and down several times the SRAM and evaluating the start-up values of an adequate number of memory cells, as proposed in [4]. The cells that never show bit flipping (stable cells) are classified as good cells for generating the key while the others (unstable cells) are selected for generating the nonce. Classification is performed under three operating conditions with ambient temperature and three power supply voltages (the nominal value, Vdd, 0.9Vdd and 1,1Vdd). Nonces of 128 bits and a key of 60 bits were selected (of course, higher key lengths should be used for higher security). In the registration step, the 128 cells that will generate the nonce in the authentication step are registered. This is done by generating a mask, which will be referred to as trn_mask. Since the percentage of SRAM cells in average that was experimentally measured as adequate for generating nonces was 6.11% (in a 90-nm CMOS technology) and the SRAM included in the module has words of 60 bits, the 128 cells are selected among 35 words (2100 cells) of the SRAM. Since the bit error probability (bit flipping in start-up values) was measured experimentally as 6.80% in average even selecting the memory cells adequate for generating the key (without selection, the bit error probability was 18.83%), a repetition Error Correction Code (ECC) with codewords of 13 bits was selected (to achieve a probability of error of 8·10-6, according to the model in [3]). In the registration step, the Trusted Third Party provides the 60-bit key, K, to the module. The encoder of the ECC generates a 780-bit string, C, by concatenating 60 codewords of 13 bits (one codeword for each bit in the key). 780 cells of the SRAM are registered for regenerating the key. This is done by generating a mask, which will be referred to as id_mask. The 780-bit response, R, that the cells generated in the registration step was xor-ed with C to generate the helper data, H, i.e. H=XOR(R,C). The number of independent bits in the responses provided by stable SRAM cells was measured experimentally as 92.59%, and they passed frequency, cumulative sums, and runs tests from NIST [5]. Hence, it is difficult to extract C from H if R is not known. The percentage of SRAM cells in average that was experimentally measured as adequate for generating keys was 89.70% (in a 90-nm CMOS technology). Therefore, the 780 cells are selected among 15 words (900 cells) of the SRAM. III. AUTHENTICATION MODE The authentication process is mutual between two modules, A and B. Since each module carries out the same operations, let us illustrate them with A. A receives the inputs trn_maskA, Address, Power supply SRAM PUF Start-up values HDA Block HMAC Block Control Block Start-up values, Key (1), Masks (2), Helper data (2) Helper data (1), Masks (1), Key (2), Nonce (2) Key (2), Nonce (2) Response (2) Configuration, Key (1), Masks (2), Helper data (2) Masks (1), Helper data (1), Nonce (2), Response (2) Fig. 1. Block diagram of the proposed module. id_maskA and HA, powers up its SRAM PUF and performs the following steps: (a) trn_maskA is used to generate nonceA, which is sent to B. (b) nonceB is received from B that has also performed step (a). (b) id_maskA is used to generate a 780-bit response, R’. (c) The noisy version of C is calculated as C’=XOR(R’,HA). (d) C is obtained by correcting the possible errors in C’ with the ECC decoder (implemented as a 4-bit counter and a comparator). (e) The shared K is generated from C. (f) The HMAC is calculated with K and the concatenation of nonceA and nonceB as message. The 80-bit result is sent to B as responseA. (g) responseB is received from B that has also performed step (f). If responseA and responseB are equal, A and B authenticate themselves. The minimum entropy of the nonces generated by the SRAM start-up values (calculated as explained in [6]) was experimentally measured to range between 37.28% and 47.15% under nominal operating conditions. The nonces passed frequency, cumulative sums, and runs tests from NIST [5]. Since each time, the nonces and responses are different and unpredictable, replay and dictionary attacks are difficult. Details about the security resistance of the HMAC construction against differential power attacks (DPA) can be seen in [7]. IV. IMPLEMENTATION FEATURES The module has been designed in a 90-nm CMOS technology with nine metal layers and 1.2–2.5V power supply. Figure 1 shows its block diagram. The signals with (1) in Fig. 1 are used only in registration mode while the signals with (2) are used only in authentication mode. The signals without number are used in both modes. The SRAM PUF included was a standard low-power dual-port 8-transistor SRAM with 64 × 60 bits. It is powered up when the start-up values of their cells are needed. Another memory, with 256 × 60 bits, is needed in the registration mode to store temporarily the start-up values provided by the SRAM PUF under the three operating conditions analyzed. The stored bits are processed by logic operators (XOR, AND, and OR) so as to compare them and register the trn_mask and id_mask. This is done by the HDA block in Fig. 1. The start-up values of the SRAM cells, which are sensitive information, are not communicated outside the module. In contrast, the masks trn_mask and id_mask can be public. The processing logic of the HDA block occupies 0.042 mm2. More details about this processing can be seen in [4]. During authentication, the most complex step is to calculate the HMAC. The HMAC performs two passes of the Photon hash. Photon-80/20/16, which follows the structure of sponge constructions, absorbs input blocks of 20 bits and squeezes output blocks of 16 bits. Since a serial architecture has been selected for Photon, the permutation operations applied to each block take 708 clock cycles (more details can be seen in [2] and [7]). In the first pass, the input has 256 bits (the two nonces concatenated) plus 60 bits of the key, which means 16 blocks to be absorbed. The 80-bit output is provided after squeezing 4 blocks. Hence, the latency of the first pass is 14,160 clock cycles. In the second pass, since the input has 80 bits (output of the first hash) plus 60 bits of the key, there are 7 input blocks to be absorbed and again 4 output blocks to be squeezed, which means a latency of 7,788 clock cycles. The authentication time is dominated by the HMAC latency. If the module operates at 100 MHz, the HMAC latency is 0.219ms. If the module operates at 100KHz (typical frequency of RFIDs), the latency is 219ms. In the latter case, the power consumption has been estimated in 1.38W (taking into account working activity). The HMAC block occupies 0.032mm2. V. CONCLUSIONS A VLSI module designed in a 90-nm CMOS technology allows authentication between modules in 219ms with a power consumption of 1.38W. Information left by the module is non-sensitive and unpredictable, thus reducing the success of replay and dictionary attacks. A counterfeit module is not able to be authenticated thanks to the use of a SRAM PUF. ACKNOWLEDGMENT This work was partially supported by TEC2014-57971-R, TEC2011-24319 and RTC-2014-2932-8 projects from the Spanish Government (with support from FEDER). M. A. Prada-Delgado is supported by ‘V Plan Propio de Investigación’ from the University of Seville. REFERENCES [1] J. M. Turner, “The keyed-hash message authentication code (HMAC),” Federal Information Processing Standards Publication, 2008. [2] J. Guo, T. Peyrin, and A. Poschmann, “The Photon family of lightweight hash functions,” in CRYPTO’11. Springer, pp. 222–239, 2011. [3] J. Guajardo, S. Kumar, G.J. Schrijen, and P. Tuyls, “FPGA intrinsic PUFs and their use for IP protection” Cryptographic Hardware and Embedded Systems (CHES), pp. 63–80, 2007. [4] I. Baturone, M.A. Prada-Delgado, S. Eiroa, “Method and device to generate identifiers and true random numbers”, Patent Application, Priority Number P201400225, 2014. [5] A. Rukhin et al., “A statistical test suite for random and pseudorandom number generators for cryptographic applications,” NIST Special Publication, vol. 800-22, pp. 1–131, revised April 2010. [6] V. van der Leest, E. van der Sluis, G. Schrijen, P. Tuyls, and H. Handschuh, “Efficient implementation of true random number generator based on SRAM PUFs,” in Cryptography and Security: From Theory to Applications. Springer, pp. 300–318, 2012. [7] S. Eiroa and I. Baturone, “FPGA implementation and DPA resistance analysis of a lightweight HMAC construction based on Photon hash family” 23rd IEEE Int. Conf. on Field Programmable Logic and Applications (FPL), pp. 1–4, 2013.