A Unified Multibit PUF and TRNG based on Ring Oscillators for Secure IoT Devices

IoT-25817-2022 1 Abstract— Physically Unclonable Functions (PUFs) and True Random Number Generators (TRNGs) are cryptographic primitives very well suited for secure IoT devices. This paper proposes a circuit, named multibit-RO-PUF-TRNG, which offers the advantages of unifying PUF and TRNG in the same design. It is based on counting the oscillations of pairs of ring oscillators (ROs), one of them acting as reference. Once the counter of the reference oscillator reaches a fixed value, the count value of the other RO is employed to provide the TRNG and the multibit PUF response. A mathematical model is presented that supports not only the circuit foundations but also a novel and simple calibration procedure that allows optimizing the selection of the design parameters. Experimental results are illustrated with large datasets from two families of FPGAs with different process nodes (90 nm and 28 nm). These results confirm that the proposed calibration provides TRNG and PUF responses with high quality. The raw TRNG bits do not need post-processing and the PUF bits (even 6 bits per RO) show very small aliasing. In the application context of obfuscating and reconstructing secrets generated by the TRNG, the multibit PUF response, together with the proposal of using error-correcting codes and RO selection adapted to each bit, provide savings of at least 79.38% of the ROs compared to using a unibit PUF without RO selection. The proposal has been implemented as an APB peripheral of a VexRiscv RV32I core to illustrate its use in a secure FPGA-based IoT device. Index Terms— Hardware Security, Physical Unclonable Functions, Ring Oscillators, True Random Number Generators. I. INTRODUCTION ECURITY of IoT devices is crucial for the IoT ecosystem. If attackers succeed in compromising IoT devices severe damages can be provoked. Physically Unclonable Functions (PUFs) are lightweight cryptographic primitives very well suited to authenticate IoT devices that operate under power and area constraints [1]. An electronic PUF inside the device hardware generates an output bit sequence as response to an input (so-called challenge). The response of a PUF to a given challenge should show uniqueness (varies from device to device), reliability (remains stable over device lifetime), and Manuscript received 21 May 2022; revised 25 July 2022; accepted 10 November 2022. Date of current version 21 November 2022. This research was conducted thanks to Grant PDC2021-121589-I00 funded by MCIN/AEI/10.13039/501100011033 and the “European Union NextGenerationEU/PRTR”, and Grant PID2020-119397RB-I00 funded by MCIN/AEI/ 10.13039/501100011033. The work of Roberto Román was supported by VI Plan Propio de Investigación y Transferencia through the University of Seville. (Corresponding author: Iluminada Baturone). unpredictability (due to exploiting the random variations introduced during the semiconductor fabrication process) [2]. Hence, a PUF response can be used as device identifier (ID). Several lightweight authentication protocols have been reported that employ PUF IDs [3]-[7]. PUFs allow preserving the secrecy of IDs by generating them whenever needed. This is cheaper than storing them in secure non-volatile memories. Moreover, PUFs provide device counterfeiting and tampering because fake and manipulated PUFs are not able to generate the genuine IDs. These features of PUFs have been exploited to ensure the trustworthiness of the hardware of IoT devices and also to guarantee the security of their software [7]. A True Random Number Generator (TRNG) is another cryptographic primitive required by cryptographic protocols to generate secret keys, nonces, initialization vectors, etc. TRNGs exploit the random variations introduced by physical noise sources to generate an unpredictable output bit sequence that changes every time it is generated (note that the PUF response should not change at every measurement). Among the electronic PUFs studied in greater depth, those that predominate in IoT devices are delay-based PUFs and memory-based PUFs. The first ones, such as arbiters and PUFs based on ring oscillators (RO PUFs), are more popular in IoT devices with FPGAs [5]. The second ones, such as PUFs based on static random access memories (SRAM PUFs), are more suitable for IoT devices with microcontrollers whose embedded memories are not initialized [6]-[7]. Among the digital TRNGs, those widely employed are based on metastable circuits and oscillators. The latter provide higher entropy with simpler designs, although at a slower speed (which can be enough for many IoT applications). Like RO PUFs, TRNGs based on ROs are more popular in devices with FPGAs [8]-[9]. Approaches that unify PUF and TRNG in the same design offer the advantages of being simpler than separate designs. Unified solutions based on memory cells (comprising crosscoupled inverters like SRAMs or other gates) have been already reported in [10]-[13]. In [10]-[12], the memory cells whose start-up values are stable are used for PUF and those unstable are used for TRNG responses. In [13], the random behavior of Iluminada Baturone, Roberto Román, and Ángel Corbacho are with the Instituto de Microelectrónica de Sevilla, (IMSE-CNM), Universidad de Sevilla, CSIC, Sevilla, 41092, SPAIN (e-mail: {lumi, roman}@imse-cnm.csic.es, and angel.corbacho[email protected]). Copyright (c) 2022 IEEE. Personal use of this material is permitted. However, permission to use this material for any other purposes must be obtained from the IEEE by sending a request to pubs[email protected]. Color versions of one or more of the figures in this article are available online at http://ieeexplore.ieee.org A Unified Multibit PUF and TRNG based on Ring Oscillators for Secure IoT Devices Iluminada Baturone, Roberto Román, and Ángel Corbacho S IoT-25817-2022 2 the SRAM bitline discharge rate is used as common principle, harnessing noise for TRNG responses and chip-specific local variations for multibit PUF responses. Solutions based on ROs have also been reported in [14]-[16]. The solution in [14] is not a truly unified design but rather a merge between two different RO structures, one for PUF and the other for TRNG. The solutions in [15] and [16] are unified designs based on RO pairs whose oscillations are counted simultaneously by two counters, until one of them overflows. A weakness of the work in [15] is that the authors explain empirically instead of mathematically the reasons why several bits are suitable for generating true random sequences and others for generating PUF sequences and do not explain how to select the value that fixes overflow. The PUF proposed in [16] is not multibit. The multibit PUF and TRNG proposed in [17]-[18] is based on comparing the number of oscillations of pairs of TERO (Transient Effect Ring Oscillator) cells, which are metastable structures composed of two cross-coupled branches that enter a transient oscillating state before reaching a stable state. The problem of TERO cells is that their design in FPGAs is very challenging since the two branches should be identical and symmetrical. In addition, the time during which oscillations are counted has a great impact on the PUF performance and a methodology to determine it is not obvious. Moreover, a problem of many RO-based TRNGs and PUFs is that active attacks that inject electromagnetic signals can synchronize temporarily the ROs, which is known as locking phenomenon. The consequence is a statistically manipulated output in TRNGs and a denial-of-service (DoS) in PUFs [19]- [20]. One major issue for PUFs is that efficient methods based on side-channel passive attacks have been reported to clone RO-PUFs and TERO-PUFs, breaking their security [20]. This paper presents a multibit PUF and TRNG circuit based on ring oscillators (multibit-RO-PUF-TRNG) that offers the following advantages over existing works: - A unified structure that employs a very simple circuitry to act as a multibit PUF and TRNG, without requiring a challenging design. - A multibit PUF with high uniqueness and reliability, which can be increased with an effective RO selection procedure. - A mathematical model that stablishes the foundations of how to select the parameters to optimize the throughput and randomness of the PUF and TRNG responses as well as the uniqueness and reliability of the multibit PUF response. - A simple calibration procedure that is carried out prior to the IoT device deployment and that uses simple Health Tests that evaluate continuously the behavior of the TRNG response. - A multibit PUF and TRNG that is not sensitive in first approximation to locking phenomenon and, moreover, that is resistant to reported side-channel passive attacks, particularly to the easiest attacks based on electromagnetism emanation. The application of the proposal to generate, obfuscate, and reconstruct secret cryptographic keys for cryptographic protocols is detailed. The performance of the proposal is illustrated with two large datasets of RO frequencies from 90- and 28-nm FPGAs provided in [21] and [22], respectively. These two datasets were available online, provided by their authors. Hence, our results can be reproduced. The paper is organized as follows. Section II describes briefly the interest of using PUFs and TRNGs to manage secret keys and summarizes the related work. Section III presents the multibit-RO-PUF-TRNG circuit, its mathematical model, and its design and calibration procedure, in particular to manage secret keys. Section IV validates the proposal with results obtained from two large experimental datasets of FPGAs. The advantages of using the proposal for secure IoT devices instead of other circuits from the literature are discussed in Section V. Finally, conclusions are given in Section VI. II. PRELIMINARIES AND RELATED WORK A. PUFs and TRNGs for Managing Secret Keys Both PUFs and TRNGs are required for the secure management of secret keys. In the one side, the needed secret keys should be generated inside the hardware of the IoT device by the TRNG. It is not convenient to provide secret keys from outside the device. Of course, the TRNG can be also employed to generate nonces and initialization vectors needed by other cryptographic operations. In the other side, PUF responses are employed to obfuscate and later reconstruct the secret keys. Let us denote 𝑅𝑙𝑘 the PUF response to a given challenge of a PUF instance l at the k-th measurement. A well-known way to obfuscate a secret with a PUF response is the Code-Offset Construction [23]. In an enrollment phase, a secret S obtained from a TRNG is encoded into a sequence P with an errorcorrecting code (𝑃=𝑒𝑛𝑐𝑜𝑑𝑒(𝑆)). The sequence P is XORed with a binary PUF response 𝑅𝑙0 to generate helper data, PD, which can be public (𝑃𝐷=𝑅𝑙0⊕𝑃). The PUF response 𝑅𝑙0, should not have any correlation or bias so that no information about the secret S could be leaked from the helper data. During verification, a new PUF response is taken, 𝑅𝑙𝑘, which is XORed with the helper data to obtain a noisy version of P, 𝑃′=𝑅𝑙𝑘⊕ 𝑃𝐷=𝑅𝑙𝑘⊕𝑅𝑙0⊕𝑃. Since some bit flipping can appear in the PUF response, 𝑅𝑙𝑘⊕𝑅𝑙0 is not zero but small and the errorcorrecting code is employed to recover S from P’, 𝑆= 𝑑𝑒𝑐𝑜𝑑𝑒(𝑃′) [2], [24]. Assuming that the probability distribution that models the occurrence of exactly e bit errors in the n bits provided by a PUF to obfuscate a secret bit is a binomial distribution, and knowing that the bit error probability in the PUF response is 𝑝𝑒, the failure probability, 𝑃𝑓𝑎𝑖𝑙, in reconstructing a bit of the secret key when using an error-correcting code with n-bit codewords and capacity to correct up to E errors is given by: 𝑃𝑓𝑎𝑖𝑙(𝑒>𝐸)=1−∑(𝑛 𝑏)𝑝𝑒𝑏∙(1−𝑝𝑒)𝑛−𝑏 𝐸 𝑏=0 (1) Fixing 𝑃𝑓𝑎𝑖𝑙 to 10-6 (a typical value found in many works [24]), 𝐸 to 𝑛2 ⁄−1 (using a simple repetition error-correcting code, suitable for resource-constrained IoT devices), and knowing pe (from the PUF reliability), the value of n can be obtained. If the secret S has 𝑠 bits, the length N of the PUF response to employ should meet that ⌊𝑁 n⌋≥𝑠, where ⌊𝑥⌋ rounds IoT-25817-2022 3 𝑥 to the nearest integer smaller than or equal to 𝑥. B. RO PUFs ROs usually consist of an odd number of inverters connected in cascade and forming a closed-loop, which makes them oscillate freely when enabled. The first PUF based on ROs (ROPUF) was proposed in [25]. The RO-PUF is composed of pairs of identically laid-out ROs whose oscillations are counted by counters. Only one bit is generated from the comparison of the counter results of a pair, because the bit codifies which RO in the pair is faster. Later, several works focused on improving the uniqueness, reliability, and efficiency of RO-PUFs [26]-[34]. In order to improve uniqueness, the work in [26] proposes to avoid systematic variations of the fabrication process by placing the ROs as close as possible to each other and picking physically adjacent pairs of ROs to obtain output bits. However, this solution is not enough because the internal routing and components of the ROs and the rest of the circuitry in the FPGA cause that many pairs generate the same output bits in all the devices, as shown in [27] and [28]. The solution proposed in [28] is to subtract the device-population-wide mean frequency of each RO in the pair from the sampled frequency before generating a PUF bit. In [16], a PUF bit response is obtained by comparing the binary counter result of a RO pair with a reference binary word. The work in [29] clusters the ROs into groups and normalizes the frequency of each RO by the frequency of a reference RO or by the mean frequency of all the ROs in the same group. In order to improve reliability, the work in [25] proposes to select the pairs whose ROs have maximum differences in frequencies. In an initialization or registration step, the bit vector indicating these selections is saved in a binary mask to generate later a reliable output with the same pairs. The authors also state that other masking schemes based on RO’s frequencies are also possible, as studied in [30] and [26]. The problem of these selection processes is the reduction of PUF uniqueness and entropy, as depicted in [27] and [31], because the frequencies of ROs show systematic bias, as commented above. It is better a selection process based on PUF output bits (already improved for uniqueness). The classification method presented in [10] is based on evaluating the PUF output bits several times in a registration phase, saving a binary mask to identify the challenges to generate the stable output bits. Recently, a PUF architecture that combines a process mismatch amplifier in an oscillator collapse topology has been presented to improve reliability and provide a fast response [32]. This proposal is adequate for full-custom designed circuits but not for FPGAs. In order to improve efficiency, several works focused on generating more than only a single bit with a pair of ROs [33]. The work in [33] uses the basic RO-PUF construction proposed in [25], but instead of taking into account only the sign bit of the comparison (i.e. which RO has greater frequency), they define four intervals with equal probability and obtain 2-bit responses from each RO pair. As commented above, the problem is that RO frequencies show systematic bias. On the other hand, since a multibit response reduces PUF reliability, the proposal in [33] is to activate the neighboring ROs that are not being compared to introduce a background noise that affects the frequency of the RO pairs under comparison. However, this increases the power consumption. The multibit PUF proposed in [34] and used in [15] employs pairs of ROs without no specific constraints on their placement. The oscillations of the two ROs are counted simultaneously with two counters. As soon as one of the counters overflows, the resulting value in the other counter is selected. Since this value is binary, a statistical analysis of all the bits is carried out to select for the multibit PUF response the bits showing high stability in multiple measurements and high entropy in multiple devices. In [35], this solution is compared with two others that use a stable reference oscillator to fix the oscillation time of the pair of ROs, concluding that the three presented solutions offer similar performance. The work in [29] proposes a multibit RO-PUF in which the normalized frequencies of the ROs are sorted and then grouped in such a way that the amount of ROs assigned to each group are almost the same. The works in [29] and [34]- [35] do not present any RO selection procedure to increase the reliability of the multibit PUF response. A drawback of many RO PUFs is that no mathematical model is provided to support the design but the validation is done experimentally only [15], [22], [28], [29], [33]. Recently, a major problem reported for RO PUFs, including TERO PUFs, is their vulnerability to electromagnetic analysis, which makes them clonable [20]. C. RO TRNGs RO TRNGs in FPGAs mostly use the jitter as physical noise source. The jitter is the frequency/phase instability of the oscillating signals generated by the ROs. In order to validate the jitter as noise source, several works focused on modelling and observing it. In [36], the jitter is modelled as the delay variations accumulated during one half oscillation period in the gates of the RO, which are caused by deterministic and nondeterministic sources. They consider the local nondeterministic source as the Gaussian source that should be exploited by a RO TRNG. They validate experimentally its jitter model by using a counter that counts the rising edges of the RO output signal during a fixed measurement time controlled by an external quartz reference clock, thus measuring the accumulated jitter. The RO-TRNG proposed in [15] uses two ROs whose oscillations are counted simultaneously by two counters during a fixed measurement time controlled by the overflow of the counter of the fastest RO. The LSBs of the counter of the slowest RO are used to generate random sequences after being post-processed by Von Neumann or XOR correction. The authors do not propose any calibration technique to select the size of the counters and do not explain mathematically how many LSBs are adequate to generate true random sequences. The authors in [37] present a mathematical model that describes how the bits of the binary-coded count value of RO oscillations during a fixed measurement time are related to the deterministic and non-deterministic jitter. Since the LSBs are related to the Gaussian non-deterministic jitter, they should be IoT-25817-2022 4 the output of the TRNG. The authors propose an auto-calibrated TRNG based on measuring the standard deviations of the count values to fix the measurement time and obtain the highest TRNG speed. Although an external quartz reference clock, as proposed in [36], can fix the measurement time, the authors in [37] conclude that using two theoretically identical ROs as oscillators is better for calibration. As depicted in [36], deterministic jitter accumulates faster than Gaussian jitter. Hence, there are TRNGs faster than those presented in [36]-[37], but electromagnetic attacks have been reported on some of them [19]. Recently, a high-throughput TRNG has been proposed that is based on two symmetrically designed slow ROs (which employ current starved inverters biased in the weak inversion region) and an ultra-high-speed counter (which employs dynamic ratioed logic instead of static CMOS logic) [38]. This proposal is adequate for full-custom designed circuits but not for FPGAs. III. THE PROPOSAL OF MULTIBIT-RO-PUF-TRNG A. The Core of the Circuit The core of the proposed multibit-RO-PUF-TRNG circuit is composed of two oscillators, 𝑅𝑂𝑖 and 𝑅𝑂𝑗, and two counters, as shown in Fig. 1. When the core is activated (the signal 𝐼𝑛𝑖𝑡 is ‘1’), both oscillators oscillate simultaneously and stop when the counter of 𝑅𝑂𝑗 reaches a value 𝑁𝑟𝑒𝑓 that is conveniently set in a calibration step. From the counter of 𝑅𝑂𝑖, the count value 𝑁𝑖𝑗 is obtained, which is assigned to the pair 𝑖𝑗. The least significant bit (LSB) in 𝑁𝑖𝑗 is taken for the TRNG response since it measures the random physical internal noise. Since the random noise in the manufacturing process is assumed to follow a Gaussian distribution (as supported by the model explained in the following subsection), let us call 𝑁𝑖𝑗𝑟𝑒𝑓 the average of the count value 𝑁𝑖𝑗 in a group of 𝐿 PUF instances and 𝜎𝑃𝑈𝐹 the standard deviation, which are conveniently set in the calibration step. From the comparisons of the count value 𝑁𝑖𝑗 with the values that divide the probability distribution function of the manufacturing noise into 2𝑚𝑃𝑈𝐹 areas with the same probability (which take into account 𝑁𝑖𝑗𝑟𝑒𝑓 and 𝜎𝑃𝑈𝐹), 𝑚𝑃𝑈𝐹 bits are taken for the PUF response. For example, if 22= 4 areas with the same probability are considered, as illustrated in Fig. 2, the following comparisons illustrate how to obtain 2 bits (𝑏1 and 𝑏2) for the PUF response 𝑏1= { 1 if 𝑁𝑖𝑗> 𝑁𝑖𝑗𝑟𝑒𝑓,𝑏2={0 if 𝑁𝑖𝑗> 𝑁𝑖𝑗𝑟𝑒𝑓 +0.6745∙𝜎𝑃𝑈𝐹 1 if 𝑁𝑖𝑗≤ 𝑁𝑖𝑗𝑟𝑒𝑓 +0.6745∙𝜎𝑃𝑈𝐹 0 if 𝑁𝑖𝑗≤ 𝑁𝑖𝑗𝑟𝑒𝑓,𝑏2={1 if 𝑁𝑖𝑗 > 𝑁𝑖𝑗𝑟𝑒𝑓 −0.6745∙𝜎𝑃𝑈𝐹 0 if 𝑁𝑖𝑗≤ 𝑁𝑖𝑗𝑟𝑒𝑓 −0.6745∙𝜎𝑃𝑈𝐹 The expression above and Fig. 2 illustrate the use of a 2-bit Gray code. A Gray code is recommended instead of other codes to improve the reliability of the bits in the PUF response. Using N pairs of oscillators, a TRNG sequence of 𝑁 bits and a PUF sequence of 𝑁∙ 𝑚𝑃𝑈𝐹 bits are generated. A simple way to obtain N pairs of oscillators generating independent bits is to use 𝑁+1 ROs. It is better to activate the pairs of oscillators in series to reduce the power consumption and the resources employed (the pairs can be multiplexed to use only two counters). B. Mathematical Model Supporting the Proposal If 𝑅𝑂𝑗 has an oscillation frequency 𝑓𝑗 (𝑓𝑗=1/𝑇𝑗), the oscillation time interval of the pair 𝑖𝑗 between initialization and stop signal is 𝑡𝑟𝑒𝑓=𝑁𝑟𝑒𝑓 𝑓𝑗=𝑁𝑟𝑒𝑓∙𝑇𝑗 (2) If the oscillation frequency of 𝑅𝑂𝑖 is 𝑓𝑖 (𝑓𝑖=1/𝑇𝑖), its counter reaches the following value at stop signal 𝑁𝑖𝑗=⌊𝑡𝑟𝑒𝑓∙𝑓𝑖⌋=⌊𝑁𝑟𝑒𝑓∙𝑇𝑗∙𝑓𝑖⌋ (3) The period of an oscillator can be modelled as 𝑇𝑖=𝑇𝑜𝑖+∆𝑇𝑔𝐷+∆𝑇𝑙𝐷+∆𝑇𝑔𝑁+∆𝑇𝑙𝑁=𝑇𝑜𝑖+∆𝑇𝑖 (4) where 𝑇𝑜𝑖 is the oscillator nominal period . ∆𝑇𝑔𝐷 is the jitter produced deterministically by global causes (e.g. temperature, power supply voltage, and placement and routing of the oscillator). ∆𝑇𝑙𝐷 is the jitter produced deterministically by local causes (e.g. local temperature and power supply voltage variations, and local variations of the manufacturing process). ∆𝑇𝑔𝑁 is the jitter produced by global non-deterministic Fig. 2. Gaussian distribution of the counter values in RO pairs due to manufacturing noise, with 4 areas of the same probability depicted. Fig. 1. Block diagram of the multibit-RO-PUF-TRNG core proposed. IoT-25817-2022 5 variations (e.g. power supply noise and electromagnetic interference signals), and ∆𝑇𝑙𝑁 is caused by local nondeterministic variations due to semiconductor noise. Hence, the frequency of an oscillator can be modelled as 𝑓𝑖≅1 𝑇0i−∆𝑇i 𝑇0i2=𝑓0i∙(1−∆𝑇𝑖 𝑇0𝑖)=𝑓0i∙(1−𝛿i) (5) Substituting 𝑇𝑗 by (4) and 𝑓𝑖 by (5) in (3), it follows that 𝑁𝑖𝑗=⌊𝑁𝑟𝑒𝑓∙𝑇𝑜𝑗∙(1+∆𝑇𝑗 𝑇𝑜𝑗)∙𝑓0i∙(1−∆𝑇𝑖 𝑇0𝑖)⌋≅ ⌊𝑁𝑟𝑒𝑓∙𝑓0i 𝑓𝑜𝑗∙(1+∆𝑇𝑗 𝑇𝑜𝑗−∆𝑇𝑖 𝑇0𝑖)⌋=⌊𝑁𝑟𝑒𝑓∙𝑓0i 𝑓𝑜𝑗∙(1+𝛿j−𝛿i)⌋ (6) If 𝑅𝑂𝑗 and 𝑅𝑂𝑖 have the same configuration (𝑓𝑜𝑗 =𝑓𝑜𝑖= 𝑓𝑜 ), 𝑁𝑖𝑗 will be 𝑁𝑖𝑗=⌊𝑁𝑟𝑒𝑓∙(1+∆𝑇𝑗𝑔𝐷−∆𝑇𝑖𝑔𝐷 𝑇𝑜+∆𝑇𝑗𝑙𝐷−∆𝑇𝑖𝑙𝐷 𝑇𝑜+∆𝑇𝑗𝑔𝑁−∆𝑇𝑖𝑔𝑁 𝑇𝑜+ ∆𝑇𝑗𝑙𝑁−∆𝑇𝑖𝑙𝑁 𝑇𝑜)⌋=⌊𝑁𝑟𝑒𝑓∙(1+𝛿𝑖𝑗 𝑔𝐷+𝛿𝑖𝑗 𝑙𝐷+𝛿𝑖𝑗 𝑔𝑁+𝛿𝑖𝑗 𝑙𝑁)⌋ (7) Non-deterministic variations affecting globally to the ROs, like those provoked by the injection of electromagnetic signals, are avoided with the difference ∆𝑇𝑗𝑔𝑁−∆𝑇𝑖𝑔𝑁, thus reducing locking phenomenon. If the pair of ROs is implemented in a PUF instance 𝑙 and a measurement k is taken, the value of 𝑁𝑖𝑗, now renamed as 𝑁𝑖𝑗𝑘𝑙, can be expressed as follows 𝑁𝑖𝑗𝑘𝑙=⌊𝑁𝑟𝑒𝑓∙(1+𝛿𝑖𝑗 𝑔𝐷+𝛿𝑖𝑗𝑙 𝑙𝐷+𝛿𝑖𝑗𝑘 𝑁)⌋ (8) The relative and differential variations due to global and deterministic causes, 𝛿𝑖𝑗 𝑔𝐷, are considered independent of the PUF instance and the measurement, those due to local and deterministic causes, 𝛿𝑖𝑗𝑙 𝑙𝐷, are considered independent of the measurement, and those due to non-deterministic causes, 𝛿𝑖𝑗𝑘 𝑁, are considered independent of the PUF instance. Considering that ∑𝛿𝑖𝑗𝑘 𝑁 𝐾 𝑘=1 is zero (the noise has no bias), the average of the count values after several measurements is 𝑁𝑖𝑗𝑙      =1 𝐾∑𝑁𝑖𝑗𝑘𝑙 𝐾 𝑘=1 =⌊𝑁𝑟𝑒𝑓∙(1+𝛿𝑖𝑗 𝑔𝐷+𝛿𝑖𝑗𝑙 𝑙𝐷)⌋ (9) If the average ∑𝛿𝑖𝑗𝑙 𝑙𝐷/𝐿 𝐿 𝑙=1 is named 𝛿𝑖𝑗 𝑙𝐷     (local and deterministic differential variations may have bias), the average of the count values in the 𝐿 instances is 𝑁𝑖𝑗𝑟𝑒𝑓 =𝑁𝑖𝑗     =1 𝐿∑𝑁𝑖𝑗𝑙      𝐿 𝑙=1 =⌊𝑁𝑟𝑒𝑓∙(1+𝛿𝑖𝑗 𝑔𝐷+𝛿𝑖𝑗 𝑙𝐷     )⌋ (10) Assuming that 𝛿𝑖𝑗𝑙 𝑙𝐷=𝛿𝑖𝑗 𝑙𝐷     +∆𝑇𝑖𝑗𝑙 𝑙𝐷 𝑇0 and substituting 𝑁𝑖𝑗𝑟𝑒𝑓 in (9) 𝑁𝑖𝑗𝑙      =⌊𝑁𝑖𝑗𝑟𝑒𝑓 +𝑁𝑟𝑒𝑓∙∆𝑇𝑖𝑗𝑙 𝑙𝐷 𝑇0⌋ (11) The term 𝑁𝑖𝑗𝑟𝑒𝑓 includes the influence of all the variations produced deterministically by global causes as well as the possible constant bias of the local deterministic variations. The term 𝑁𝑟𝑒𝑓∙∆𝑇𝑖𝑗𝑙 𝑙𝐷 𝑇0 includes the influence of the local deterministic variations without biasing, which is the term that should be measured by the PUF. Equation (11) confirms (as shown in Fig. 2) that the count values 𝑁𝑖𝑗𝑙      deviate from the average 𝑁𝑖𝑗𝑟𝑒𝑓 with a standard deviation that we call 𝜎𝑃𝑈𝐹. In addition, it explains why our proposed multibit PUF provides equiprobable bits by dividing the probability distribution function of the manufacturing noise into areas with the same probability. Substituting (10) in (8), we have 𝑁𝑖𝑗𝑘𝑙=⌊𝑁𝑖𝑗𝑟𝑒𝑓+𝑁𝑟𝑒𝑓∙∆𝑇𝑖𝑗𝑙 𝑙𝐷 𝑇0+𝑁𝑟𝑒𝑓∙𝛿𝑖𝑗𝑘 𝑁⌋=⌊𝑁𝑖𝑗𝑟𝑒𝑓 +𝑁𝑟𝑒𝑓∙ ∆𝑇𝑖𝑗𝑙 𝑙𝐷 𝑇0+𝑁𝑟𝑒𝑓∙∆𝑇𝑖𝑗𝑘 𝑁 𝑇0⌋ (12) The term 𝑁𝑟𝑒𝑓∙∆𝑇𝑖𝑗𝑘 𝑁 𝑇0, which depends on the measurement 𝑘, includes the influence of the local Gaussian non-deterministic variations, which are the variations that should be exploited by a TRNG. Considering in a first-order estimation that all the inverting delay stages of a RO introduce a nominal propagation delay of 𝜏, as in the simplified models in [36] and [39], the nominal period of a RO with 𝑀 delay stages can be approximated as 𝑇𝑜=2∙𝑀∙𝜏 (13) Assuming that the local deterministic variations without biasing in the M stages are uncorrelated (because they are supposed to be independent), the variations ∆𝑇𝑖𝑗𝑙 𝑙𝐷 are normally distributed with mean zero and standard deviation √𝑀∙𝜎𝑙𝐷, where 𝜎𝑙𝐷 is the standard deviation considering only one stage. Hence, using (13), the term 𝑁𝑟𝑒𝑓∙∆𝑇𝑖𝑗𝑙 𝑙𝐷 𝑇0 to be measured for the PUF response is proportional to 𝑁𝑟𝑒𝑓 √𝑀∙𝜎𝑙𝐷 2∙𝜏. Assuming that the inverting stages in the ROs have a given nominal propagation delay 𝜏 and are implemented in a manufacturing process with a given 𝜎𝑙𝐷 (due to, mainly, random dopant fluctuations, lineedge roughness, and oxide thickness variations [39]), ROs with a small number of stages, M, are desirable for the PUF response. Similarly, the variations ∆𝑇𝑖𝑗𝑘 𝑁 are normally distributed with mean zero and standard deviation √𝑀∙𝜎𝑁, where 𝜎𝑁 is the standard deviation considering only one stage and due to, mainly, white semiconductor noise. Hence, using (13), the term 𝑁𝑟𝑒𝑓∙∆𝑇𝑖𝑗𝑘 𝑁 𝑇0 to be measured for the TRNG response is IoT-25817-2022 6 proportional to 𝑁𝑟𝑒𝑓 √𝑀∙𝜎𝑁 2∙𝜏. The work in [40] provides a compact expression for uncertainty in the propagation delay of an inverting stage, which can be considered generic enough for CMOS designs. This expression shows that (𝜎𝑁)2 depends on the manufacturing technology and is directly proportional to the temperature and nominal propagation delay and inversely proportional to the power supply voltage 𝑉𝐷𝐷 and the average pullup and pulldown current 𝐼 at the inverting stage. Assuming that the RO inverting stages are designed with a given nominal propagation delay 𝜏 and work with a given 𝑉𝐷𝐷 and 𝐼 in a manufacturing process with given noise coefficients, it is also desirable to have a small number of stages in the ROs for the TRNG response. Since local non-deterministic variations are usually one order of magnitude inferior to local deterministic ones [15], [21], [22], 𝑁𝑟𝑒𝑓 should be large enough to make the term 𝑁𝑟𝑒𝑓∙∆𝑇𝑖𝑗𝑘 𝑁 𝑇0 influential. In any case, 𝑁𝑟𝑒𝑓 should be large enough to reduce the discretization noise introduced by the rounding operator ⌊𝑥⌋. According to the model above, if there are no variations, all the count values 𝑁𝑖𝑗𝑘𝑙 and the references 𝑁𝑖𝑗𝑟𝑒𝑓 coincide with 𝑁𝑟𝑒𝑓. C. Design and Calibration Procedure An issue to consider in the design of the multibit-RO-PUF- TRNG proposed are the recommendations in [41], which state that the raw data (before any possible conditioning) provided by a TRNG should be tested to detect quickly and with a high probability any failure in the noise source. Two of these tests, named Health Tests, are recommended: the Repetition Count test and the Adaptive Proportion test. The first one quickly detects catastrophic failures that cause the noise source to provide the same single output value for a long time. The second one detects when some value begins to occur much more frequently than expected. Following these recommendations, it is assumed that these two approved Health Tests evaluate continuously the TRNG response. A first parameter to select in the design is 𝑁𝑟𝑒𝑓. In the one side, the value of 𝑁𝑟𝑒𝑓 should be large enough to measure true local non-deterministic variations and to reduce the discretization noise. In the other side, the throughput of the circuit decreases as 𝑁𝑟𝑒𝑓 increases (since 𝑡𝑟𝑒𝑓 is proportional to 𝑁𝑟𝑒𝑓, as shown in (2)). In order to optimize the selection of 𝑁𝑟𝑒𝑓, we propose a calibration procedure that starts with a large value of 𝑁𝑟𝑒𝑓, named as 𝑁𝑡𝑜𝑝. The two Health Tests are applied to the B bits of the count value 𝑁𝑖𝑗𝑘𝑙 of a pair 𝑖𝑗. Each test is applied several times, each one taking into account 1,024 successive samples since the entropy source is binary. The percentage of tests passed by each bit is evaluated from the least (LSB) to the most significant bit (MSB) in the 𝑁𝑖𝑗𝑘𝑙, until the first bit that fails the tests is found. Let us assume that bit is the qth LSB. If the percentage of passed tests is not complete but relatively high (e.g. equal or greater than 95%), the value of 𝑁𝑟𝑒𝑓 is selected as ⌊𝑁𝑡𝑜𝑝 2𝑞−2 ⁄⌋. If the percentage of passed tests is not complete and relatively low (e.g. smaller than 95%), the value of 𝑁𝑟𝑒𝑓 is selected as ⌊𝑁𝑡𝑜𝑝 2𝑞−3 ⁄⌋. This calibration selects a resolution for 𝑁𝑟𝑒𝑓 that ensures the LSB passes the statistical tests (and probably the second LSB too). The idea is that it is much faster to obtain several random bits in successive measurements than several bits in one measurement. This calibration procedure is simpler than that proposed in [37]. Of course, the values of 𝑁𝑟𝑒𝑓 can be adjusted finer around these coarser values but even with these values, the results are quite interesting, as shown in the Section IV. According to (12), the influence of the local nondeterministic variations together with the rounding operator can cause some bits of the PUF response flip from one measurement to another. This happens to pairs whose count values 𝑁𝑖𝑗 are close to the values that divide the probability distribution function of the manufacturing noise. Following the classification method presented in [10], our proposal is that the manufacturer of the IoT devices should evaluate the multiple bits provided by each RO pair at several measurements to select which pairs are adequate to generate them because they never showed bit flipping. Then, the proportion of pairs selected to generate each bit is calculated. For example, a proportion 𝑝𝑖 of pairs is selected for the bit, 𝑏𝑖. Then, using the selected pairs for each bit, the error probabilities associated to the generation of each bit (pe in (1)) are calculated. Finally, using (1), the lengths of the repetition codes for each bit are computed (repetition codes are used for simplicity). For example, the length of the repetition code is 𝑛1 for the first bit, 𝑏1, provided by the pairs of ROs for the PUF response; the length is 𝑛2 for the second bit, 𝑏2, and so on. Note that we treat each bit independently. Let us assume that the multibit-RO-PUF-TRNG is an Intellectual Property (IP) module whose number (𝑁+1) of ROs can be selected by the manufacturer. For the adequate selection of 𝑁, the manufacturer has to consider the number of bits, 𝑠, of the secrets to generate and obfuscate in the application context (as explained in the end of Subsection II.A for the unibit case without classification). Since the manufacturer knows the proportions 𝑝𝑖 and the lengths 𝑛𝑖 of the repetition codes for each bit, due to the evaluation carried out as described above, the number 𝑁 of RO pairs should meet that: ⌊𝑁∙𝑝1 𝑛1⌋+⋯+⌊𝑁∙𝑝𝑚𝑃𝑈𝐹 𝑛𝑚𝑃𝑈𝐹 ⌋≥𝑠 (14) Hence, in order to minimize the use of FPGA resources and the power consumption, the best value for 𝑁 is the minimum that verifies Equation (14). Once the values of 𝑁 and 𝑁𝑟𝑒𝑓 are selected, the manufacturer generates the bit stream that contains the multibit-RO-PUF- TRNG (and the rest of the system to implement in the FPGA) and downloads it in the IoT devices. Then, the manufacturer calculates the values 𝑁𝑖𝑗𝑟𝑒𝑓 as the average of the count values 𝑁𝑖𝑗𝑙      in a group of 𝐿 PUF instances (according to Equation (10)) and also calculates their standard deviation 𝜎𝑃𝑈𝐹. The values with which to compare the 𝑁𝑖𝑗 (as shown in Fig. 1 and 2) are obtained from 𝑁𝑖𝑗𝑟𝑒𝑓 and 𝜎𝑃𝑈𝐹. This solution to improve PUF IoT-25817-2022 7 uniqueness is simpler than that in [28] and [29]. Finally, the binary masks to identify which RO pairs are adequate to generate the 𝑚𝑃𝑈𝐹 bits of each PUF are obtained with the classification procedure applied to each PUF instance. Once the calibration step finishes, the IoT devices contain the instances of the multibit-RO-PUF-TRNG implemented with the number (𝑁+1) of ROs, the parameters 𝑁𝑟𝑒𝑓, the values depending on 𝑁𝑖𝑗𝑟𝑒𝑓 and 𝜎𝑃𝑈𝐹, and the binary masks. IV. EXPERIMENTAL RESULTS Two open-sourced datasets were used for the evaluation of the proposed multibit-RO-PUF-TRNG, the dataset of Maiti et al. [21] and that of Hesselbarth et al. [22]. The first one contains data from 193 Xilinx SPARTAN3E S500 FPGAs of 90 nm, each one having 512 five-stage ROs placed in a 16x32 array in the middle of the FPGA. They provide 100 measurements for each RO. Herein, this dataset is referred to as Dataset90nm. On the other hand, the dataset of Hesselbarth et al. uses 217 Xilinx Artix-7 XC7A35T FPGAs of 28 nm. This dataset, herein referred to as Dataset28nm, is divided into 4 groups. As an example, we chose for our experiments the group called “leftlower” that comprises 1600 three-stage ROs that occupy one slice, using the two slice variants on the Artix-7. They provide also 100 measurements per RO. Among the data provided for 15 different evaluation times, we made the experiments with the longest one of 10.0 ms to reduce the quantization noise. In order to obtain the PUF and TRNG responses, we used whenever needed the conversion from frequencies to counter values (Equation (3)) and to time of measurements (Equation (2)). A. Results on Calibration and TRNG Responses The mean of the count values found in the datasets was 256866 in decimal (which in binary requires 18 bits) for the Dataset90nm and 2270084 (which in binary requires 22 bits) for the Dataset28nm. As explained in the calibration procedure, these are the values selected for 𝑁𝑡𝑜𝑝. Then, the two approved Health Tests in [41] (the Repetition Count and the Adaptive Proportion Tests) were applied to each bit of the count value 𝑁𝑖𝑗𝑘𝑙 of the proposed multibit-RO-PUF-TRNG, using 𝑁𝑟𝑒𝑓= 𝑁𝑡𝑜𝑝 and bitstreams with 1,024 bits. The number of tests was limited by the quantity of data available per FPGA. The percentages of tests passed by each bit are shown in Table I. Looking from the LSB to the MSB, the first bit that fails the tests in the Dataset90nm is the 11th MSB (equivalently the 8th LSB). Since the percentage of passed tests by this bit is relatively low, the value of 𝑁𝑟𝑒𝑓 is selected as ⌊𝑁𝑡𝑜𝑝 28−3 ⁄⌋, that is, 𝑁𝑟𝑒𝑓 = 8027 = ⌊256866 25⌋, which reduces the resolution of the counters from 18 to 13 bits and increases the throughput of the multibit-RO-PU-TRNG in 25. Looking from the LSB to the MSB, the first bit that fails the tests in the Dataset28nm is the 14th MSB (equivalently the 9th LSB). Since the percentage of passed tests by this bit is relatively high, the value of 𝑁𝑟𝑒𝑓 is selected as ⌊𝑁𝑡𝑜𝑝 29−2 ⁄⌋, that is, 𝑁𝑟𝑒𝑓 = 17735= ⌊2270084 27⌋, which reduces the resolution of the counters from 22 to 15 bits and increases the throughput in 27. While the Health Tests are carried out during the operation of the multibit-RO-PUF-TRNG (i.e.on-line), the tests widely used off-line to verify the randomness of a TRNG are taken from the NIST test suite [42]. In particular, the NIST Frequency (Monobit), Block Frequency (with M=20), Cumulative Sums (in forward and backward modes), Runs, Longest Run of ones in a block, and Approximate Entropy statistical tests were applied as well as the minimum entropy was calculated to the bits of the count values 𝑁𝑖𝑗𝑘𝑙, using the values commented above for 𝑁𝑟𝑒𝑓. The minimum entropy of a bit b in n sequences made of q times that bit is calculated as H 𝑚𝑖𝑛 𝑇𝑅𝑁𝐺[𝑏]=−1 𝑛∑𝑙𝑜𝑔2(𝑝𝑚𝑎𝑥[𝑏])∙100 𝑛 𝑖=1 (15) where 𝑝𝑚𝑎𝑥[𝑏] is the maximum probability of the bit b taking logic value ’0’ or ’1’ in the q times. In order to apply the typical significance level of =0.01 in these tests, 100 sequences generated by the proposed multibit- TABLE II NIST TEST RESULTS AND HMIN FOR DATASET90NM AFTER CALIBRATION 3rd LSB 2nd LSB LSB P-val Prop. P-val Prop. P-val Prop. Frequency 0.00 0.50 0.80 0.99 0.29 1.00 BlockFrequency 0.00 0.00 0.68 1.00 0.08 1.00 CumSum(f) 0.00 0.35 0.08 0.99 0.07 0.99 CumSum(b) 0.00 0.32 0.01 0.99 0.24 1.00 Runs 0.00 0.05 0.53 1.00 0.24 0.96 LongestRun 0.00 0.32 0.21 0.99 0.49 1.00 ApprEntropy 0.00 0.01 0.29 0.98 0.02 0.99 H 𝑚𝑖𝑛 𝑇𝑅𝑁𝐺 83.05 94.60 95.04 TABLE III NIST TEST RESULTS AND HMIN FOR DATASET28NM AFTER CALIBRATION 3rd LSB 2nd LSB LSB P-val Prop. P-val Prop. P-val Prop. Frequency 0.04 0.95 0.30 1.00 0.23 1.00 BlockFrequency 0.00 0.79 0.76 0.98 0.05 0.99 CumSum(f) 0.00 0.96 0.76 1.00 0.23 1.00 CumSum(b) 0.00 0.95 0.03 1.00 0.55 0.99 Runs 0.00 0.56 0.38 0.97 0.53 0.99 LongestRun 0.00 0.90 0.06 1.00 0.68 0.99 ApprEntropy 0.00 0.77 0.40 1.00 0.46 1.00 H 𝑚𝑖𝑛 𝑇𝑅𝑁𝐺 93.51 95.44 94.81 TABLE I PERCENTAGES OF CONTINUOUS HEALTH TESTS PASSED BY EACH BIT IN THE 𝑁𝑖𝑗𝑘𝑙 Bit position 1st (MSB) … 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th … 18th 19th … 22nd (LSB) Dataset90nm 0 … 0 4.08 14.29 26,53 46,94 75,51 100 100 100 100 … 100 - - Dataset28nm 0 … 0 0 0 0 0 5.16 7.10 29.68 98.71 100 … 100 100 … 100 IoT-25817-2022 8 RO-PUF-TRNG in each FPGA were analyzed in both datasets (n=100 in (15)). Each sequence has 500 measurements of these bits (q=500 to evaluate 𝑝𝑚𝑎𝑥 in (15)), obtained from the 100 measurements of 5 RO pairs (the data available in Dataset90nm limit this number of bits). The results are shown in Table II and Table III for one of the FPGAs in both datasets and the three least significant bits of the count values 𝑁𝑖𝑗𝑘𝑙. The statistical tests passed are shown filled in grey. As can be seen, the LSB (and even the 2nd LSB) passes the entire tests, providing a high value of minimum entropy. This confirms that the values of 𝑁𝑟𝑒𝑓 selected by the proposed calibration are adequate to ensure the TRNG performance with a high throughput. B. Results on PUF Reponses The metrics most usually employed to evaluate PUF performance are based on the average Hamming distances (𝐻𝐷     ) evaluated on PUF responses of different PUF instances (𝐻𝐷     𝑖𝑛𝑡𝑒𝑟 𝑃𝑈𝐹) or different measurements of the same PUF response (𝐻𝐷     𝑖𝑛𝑡𝑟𝑎 𝑃𝑈𝐹 ). Considering that each of the L devices provides a PUF response with 𝑁∙ 𝑚𝑃𝑈𝐹 bits, we have evaluated the performance of each of the 𝑚𝑃𝑈𝐹 bits separately, as follows: 𝐻𝐷     𝑖𝑛𝑡𝑒𝑟 𝑃𝑈𝐹[𝑏]= 2 𝐿∙(𝐿−1)∑ ∑ 𝐻𝐷(𝑅𝑙[𝑏],𝑅𝑚[𝑏]) 𝑁 𝐿 𝑚=𝑙+1 𝐿−1 𝑙=1 ∙100 (16) 𝐻𝐷     𝑖𝑛𝑡𝑟𝑎 𝑃𝑈𝐹 [𝑏]= 1 𝐿∙𝐾∑ ∑ 𝐻𝐷(𝑅𝑙    [𝑏],𝑅𝑙𝑘[𝑏]) 𝑁∙100 𝐾 𝑘=1 𝐿 𝑙=1 (17) with b ranging from 𝑏1 to 𝑏𝑚𝑃𝑈𝐹. The first one measures PUF uniqueness/randomness and the second, its reliability. Their ideal values are, respectively, 50% and 0%. In order to measure more in depth PUF uniqueness/randomness, we also measure the bit aliasing: 𝐵𝐴𝑃𝑈𝐹[𝑏]=1 𝐿∑𝑅𝑙[𝑏]∙100 𝐿 𝑙=1 (18) Its ideal value is 50%. We have measured 𝑈𝐵𝐵𝐴 𝑃𝑈𝐹[𝑏] as the percentage of the N RO pairs that provide the bit b with a 𝐵𝐴𝑃𝑈𝐹[𝑏]∈[45%,55%]. The ideal value of 𝑈𝐵𝐵𝐴 𝑃𝑈𝐹[𝑏] is 100%, which means that the bit b provided by our proposed PUF takes approximately the same times a value ‘0’ or ‘1’ in the L devices. In addition, the NIST Frequency (Monobit), Block Frequency (with M=20), Cumulative Sums (in forward and backward modes), Runs, Longest Run of ones in a block, and Approximate Entropy statistical tests were applied as well as the minimum entropy was calculated to also evaluate the uniqueness/randomness of the PUF responses, as was done with the TRNG responses. The minimum entropy of each bit b provided by N RO pairs in L devices is calculated as H 𝑚𝑖𝑛 𝑃𝑈𝐹[𝑏]=−1 𝑁∑𝑙𝑜𝑔2(𝑝𝑖𝑗,𝑚𝑎𝑥[𝑏])∙100 𝑁 𝑖𝑗=1 (19) where 𝑝𝑖𝑗,𝑚𝑎𝑥[𝑏] is the maximum probability of the bit b provided by the RO pair ij taking logic value ’0’ or ’1’ in the L devices. Using the values of 𝑁𝑟𝑒𝑓, 𝑁𝑖𝑗𝑟𝑒𝑓, and 𝜎𝑃𝑈𝐹 as resulting from the calibration, Table IV shows the metrics above and the proportion of passing sequences for the NIST tests evaluated on 6 bits provided by our proposed PUF (𝑚𝑃𝑈𝐹= 6). The results shown correspond to the Dataset90nm, so that 𝐿 is 193 and 𝑁 is 511. The randomness was evaluated in the number of devices since we want to evaluate the randomness of the manufacturing variability, so that 511 sequences with 193 bits were evaluated for 𝑏1 to 𝑏6. All the NIST statistical tests were passed for the typical significance level of =0.01. Concerning reliability, it is worse as the bit distinguishes finer areas dividing the probability distribution function of the manufacturing noise, as expected. Note that 𝑏1 distinguishes between 2 areas, 𝑏2 distinguishes between 2 areas within each of the 2 areas already distinguished by 𝑏1, and so on. C. Robustness against Changes in Operating Conditions The results shown above correspond to parameters 𝑁𝑟𝑒𝑓, 𝑁𝑖𝑗𝑟𝑒𝑓, and 𝜎𝑃𝑈𝐹 calibrated at nominal operating conditions (1.2V and 25ºC). The results obtained by using those values under other operating conditions were also analyzed. For this purpose, we used the Dataset90nm, which offers data for additional FPGAs under different temperatures and power supply voltages, and the Dataset28nm, which offers data for additional FPGAs under different temperatures. We obtained no significant variations in the randomness, uniqueness, and reliability results. As example, Fig. 3 illustrates the 𝐻𝐷     𝑖𝑛𝑡𝑟𝑎 𝑃𝑈𝐹 (defined in Equation (17)) obtained for the bits 1 to 4 provided by our proposal when using 𝑁=63 pairs of ROs, 𝐾=100 measurements per pair, 𝐿=40 PUF instances, and 𝑅𝑙  the reference response of each instance evaluated as the mean of the 𝐾 measurements in the corresponding operating condition, with the Dataset90nm. It can be seen how the results obtained with the parameters calibrated at each operating condition (b1_O to b4_O) differ only slightly from the results obtained with the calibration at only nominal conditions (b1_N to b4_N), considering variations of the power supply (Fig. 3(a)) and of the temperature (Fig. 3(b)). Hence, for simplicity, the parameters can be calibrated using only nominal conditions. D. Error-Correcting Codes and RO Selection The RO selection described in Subsection III.C was applied to the 1,599 RO pairs of each FPGA provided in the Dataset28nm. A number of 1, 20 and 40 measurements were considered to evaluate bit flipping in 6 bits of the PUF response. Table V shows the proportions 𝑝𝑖 of pairs selected to generate each bit. It can be seen that the proportions decrease as more bits are generated and more measurements are taken. Using the TABLE IV PERFORMANCE OF THE PROPOSED MULTIBIT-RO-PUF-TRNG ACTING AS 6-BIT PUF USING DATASET90NM AFTER CALIBRATION b1 b2 b3 b4 b5 b6 𝐻𝐷     𝑖𝑛𝑡𝑟𝑎 𝑃𝑈𝐹 0.94 1.49 2.69 5.28 10.53 20.86 𝐻𝐷     𝑖𝑛𝑡𝑒𝑟 𝑃𝑈𝐹 50.17 50.09 50.04 49.99 50.00 49.98 UB𝐵𝐴 𝑃𝑈𝐹 99.02 91.98 88.26 83.17 85.13 83.17 H 𝑚𝑖𝑛 𝑃𝑈𝐹 95.28 93.37 92.81 91.71 92.23 91.83 Frequency Prop. 1.00 1.00 1.00 0.99 0.99 0.98 BlockFreq. Prop. 1.00 1.00 0.99 0.99 0.99 0.98 CumSum(f) Prop. 1.00 1.00 1.00 0.99 0.99 0.98 CumSum(b) Prop. 1.00 1.00 1.00 0.99 0.99 0.98 Runs Prop. 0.99 0.99 1.00 0.99 1.00 0.99 LongestRun Prop. 0.99 1.00 0.99 0.99 0.99 0.99 ApprEntrop. Prop. 0.99 0.98 0.98 0.98 0.98 0.99 IoT-25817-2022 9 selected pairs, 𝐻𝐷     𝑖𝑛𝑡𝑒𝑟 𝑃𝑈𝐹 is maintained around the 50% while the 𝐻𝐷     𝑖𝑛𝑡𝑟𝑎 𝑃𝑈𝐹 is improved significantly (no selection corresponds to only 1 measurement). Estimating the error probabilities of each bit (pe in Equation (1)) as the 𝐻𝐷     𝑖𝑛𝑡𝑟𝑎 𝑃𝑈𝐹 , and using Equation (1), the lengths of the repetition codes, 𝑛𝑖, for each bit were computed (each bit is analyzed independently). If the ROs are selected as proposed, the bit sizes of the codewords needed for the obfuscation of one secret bit decrease compared to the situation of no RO selection. This reduces in turn the number (𝑁+1) of ROs needed to obfuscate a secret key of a fixed size, as depicted in Equation (14). Using the best value of 𝑁 in Equation (14), Fig. 4 compares the number of ROs needed for the obfuscation of a secret of 128, 192 and 256 bits, using our construction as unibit PUF without selection and using it as a multibit PUF with 6 bits per RO pair after a selection process with 20 and 40 measurements. The combination of the multibit PUF along with the selection of the RO pairs result in savings of at least 79.38% of ROs. Since the RO pairs are usually activated sequentially, this further improves greatly the throughput of the proposed multibit-RO-PUF-TRNG. V. THE MULTIBIT-RO-PUF-TRNG IN SECURE IOT DEVICES The system programmed in the FPGA of an IoT device usually contains a processor or microcontroller and peripherals. As example, we have implemented into a Xilinx Artix-7 XC7A35T FPGA a Murax SoC that includes a VexRiscv RV32I core (CPU), a JTAG debugger, 32 kB of on-chip RAM, an APB bus for peripherals [43], and one timer, one UART, and the proposed multibit-RO-PUF-TRNG as peripherals. The latter contains 168 three-stage ROs, adequate to obfuscate a secret key of 128 bits, as shown in Figure 4, organized into 167 pairs, whose outputs are multiplexed to two counters. The counter acting as the reference stops when the bit 15 takes the value ‘1’, since 𝑁𝑟𝑒𝑓 equal to 16,384 was proven adequate to measure Gaussian noise in a technology of 28 nm. The output, 𝑁𝑖𝑗, of the other counter goes to the CPU through the APB bus. Since the proposed multibit-RO-PUF-TRNG does not require a challenging design of the ROs, we did not fix their placement and routing. The occupation of the multibit-RO-PUF-TRNG together with the interface with the APB bus is 4,325 slice LUTs (20.79 % of the FPGA LUTs) and 122 slice registers (0.29 % of the FPGA registers). The evaluation time per RO was measured with the timer of the Murax as 41.44 s in average, which means an oscillation frequency of 395.33 MHz in average. The power consumption estimated by Vivado 2018.1 for the peripheral is 2 mW (each RO pair is activated sequentially). Since each RO is able to provide 6 bits for the PUF response, the throughput is 24.1 Kbps for the TRNG (5.30 ms to generate a true random seed of 128 bits) and 144.8 Kbps for the PUF response (6.92 ms to obfuscate or reconstruct a 128- bit secret). Our PUF throughput is higher than the 14.1 Kbps reported in [22] and 0.8 Kbps in [21]. The occupation of the TABLE V MULTIBIT PUF RESPONSE AFTER RO SELECTION USING DATASET28NM No. measur. b1 b2 b3 b4 b5 b6 𝑝𝑖 1 1.00 1.00 1.00 1.00 1.00 1.00 20 0.98 0.96 0.93 0.86 0.72 0.45 40 0.97 0.95 0.91 0.82 0.65 0.33 𝐻𝐷     𝑖𝑛𝑡𝑒𝑟 𝑃𝑈𝐹 1 50.15 49.86 49.93 49.95 49.97 49.98 20 50.01 49.98 50.00 49.97 49.90 49.53 40 50.01 49.99 49.99 49.98 49.86 49.44 𝐻𝐷     𝑖𝑛𝑡𝑟𝑎 𝑃𝑈𝐹 1 0.70 1.13 2.10 4.05 8.07 16.10 20 0.21 0.33 0.63 1.35 3.21 8.30 40 0.11 0.17 0.33 0.71 1.80 4.67 𝑛𝑖 1 7 7 9 13 19 37 20 5 5 7 9 11 19 40 5 5 5 7 9 13 Fig. 4. Number of ROs needed to obfuscate a secret key with 128, 192 and 256 bits, using Dataset28nm. (a) (b) Fig. 3. 𝐻𝐷     𝑖𝑛𝑡𝑟𝑎 𝑃𝑈𝐹 using Dataset90nm of 4 bits/RO provided by the multibit-RO-PUF-TRNG when (a) the power supply varies and (b) the temperature varies. The results b1_N to b4_N correspond to parameters calibrated at nominal conditions and used at other operating conditions. The results b1_O to b4_O correspond to parameters calibrated and used at each operating condition.