wang18efficient

Introduction

• The paper gives a good motivation for using SRAM PUF

• The challenge of using SRAM PUF-based key generation on FPGAs is that high-capacity NVM, such as Flash, is not available on chip. Only expensive one-time-programmable (OTP) memory with limited capacity, such as e-fuses, can be utilized to store helper data. → Relevant to SCuM too: no NVM

• The goal of this work is to reduce the size of the helper data using lossy compression, in order to decrease the required OTP memory size.

• The authors distinguish two types of helper data: helper data due to

  • (1) the syndrome (ECC: repetition code + BCH) and

  • (2) the reliability mask (pre-selection)

• Lossless compression techniques have been proposed to reduce HDS for both code syndrome [12] and reliability mask [13]. The “1-out-of-n” method [20] is able to decrease the overall BER and thus HDS by sacrificing a large number of raw bits.

Helper Data Size in PUF-Based Key Extractors

• The paper introduces the definition of the worst-case BER.

• Remark: we adopt the assumption that individual reliabilities are heterogeneous but independent since SRAM cells generate randomness through independent local mismatches

• Good and brief overview on pre-selection and ECC with probabilistic terms is given

• Hamming distance HD(X,X') follows a Poisson binomial distribution. The paper explains clearly how this metric can be precisely “estimated”.

• Excellent terminology and technical explanation of the calculated metrics BER and HD

• HDS helper data size:

  • for code syndrome HDS = n-k and it increases rapidly with as a function of BER

  • it can be reduced using dark-bit masking (pre-selection) → HDS of the rsulting mask M is n/C, where C is he probability of one cell being labelled as reliable.

• One way to reduce HDS for M is to use standard lossless compression algorithms, such as run-length encoding (RLE) and Huffman encoding.

Lossy Compression for Helper Data Reduction

In this section, the authors describe the joint HDS reduction and BER minimization algorithm. The essential idea is a lossy compression: extra reliable bits can be traded for reduced HDS on reliability masks.

→ Refer to the paper for this technical section.

Efficient method for across temperature HDS reduction

The approach in previous section leads to an optimal HDS reduction but assumes a possibly expensive characterization effort in which the reliability information for each bit of every production PUF chip is extracted across all conditions.

In this section, the authors present a technique based on stochastic modeling of worst-case BERs to drive the lossy compression via measurements performed only under room temperature, while allowing key reconstruction with overwhelmingly high probability. They present a full proof for this method being a good approximation.

Experimental Results

In this section, the authors test the performance of the proposed HDS reduction algorithms and compare them against the direct fuzzy extractor application, in which reliability masking is not used, the lossless compression for mask data reduction [13] and the “1-out-of-n” method [20].

Open

Table 1 compares the performance of different schemes for the case of a 128-bit key with failure rate 10−6.

• the lossy compression method achieves a 30% reduction in mask size compared to lossless compression, at the cost of doubling the number of raw bits. Including the syndrome helper data, the algorithms achieves a 25% reduction in total HDS, requiring 206 bits.

• lower min-entropy rate does not present a challenge to the application of this scheme

• This work focus on the trade-off between number of raw SRAM PUF bits and helper data size for both syndrome and reliability mask.