FPGA- based True Random Number Generation using Circuit Meta- stability with Adaptive Feedback Control Mehrdad Majzoobi, Farinaz Koushanfar, and Srinivas Devadas 2 Rice University, ECE 2 Massachuse@s InsBtute of Technology, EECS
Random Number Generator (RNG) Pseudo- RNG (PRNG) Seed Source of entropy, i.e., a longer random number from a shorter seed Algorithm How is the PRNG seed generated? Predictable? E.g., Netscape browser [] : srand(bme()) True- RNG No seed Based on a random physical phenomenon 2 [] h@p://www.cs.berkeley.edu/~daw/papers/ddj- netscape.html
Sources of Randomness Thermal Noise Shot Noise Flicker Noise Atmospheric Noise Radio Noise Clock Ji@er Phase Noise Lavarand Developed in 996 Generate randomness from lava lamps Efficiency/Cost? 3 h@p://www.lavarnd.org/
Applications GeneraBng Keys Nonce Seeds Random numbers used in Lo@ery Gaming and Gambling Demand Secure communicabon Servers E.g. Intel is embedding TRNGs in its new generabon processors 4 h@p://spectrum.ieee.org/semiconductors/processors/behind- intels- new- randomnumber- generator/? utm_source=techalert&utm_medium=email&utm_campaign=9
What is the Challenge? Digital FPGAs, PSoC Analog ASICs UnconvenBonal Specialized Hardware Mechanical, OpBcal, etc Source of randomness? ImplementaBon cost The cost of generabng one (entropy) bit Quantum random number generabon * Specialized hardware (high cost) Speed/throughput Power Ease of implementabon Security Biasing a@acks * h@p://www.idquanbque.com/ FPGA More FPGA designs than ASICs Reconfigurable Shorter Time- to- Market Cheaper in low volume 5
Related Work Analog TRNGs Digital TRNGs Clock ji@er Metastability Sampling ring oscillator ji@er [] Sunar, MarBn, SBnson: A provably secure true random number generator with built- in tolerance to acbve a@acks. IEEE Trans. on Computers 58, 9 9 (27) [2] O Donnell, Suh, & Devadas: PUF- based random number generabon: MIT CSAIL CSG Tech. Memo 48 24 Cons of popular ROs Low entropy rate Strong dependence on working condibon Can synchronize on perturbabons or other ROs High power consumpbon 6
This Work Flip- flop metastability circuit/ambient noise sensor Fine delay tuning force metastable operabon At- speed feedback mechanism automabc tuning Robust operabon Resilient against acbve a@acks - biasing Simple design principle Easy to observe how randomness relies on physical phenomena High entropy and throughput per unit area 7
Flip- Blop Metastability Metastability Highly sensibve to noise Flip- flop Delay difference Simultaneous arrival 4~5 ps Setup Margin Hold Margin Metastable Region D Q Probability of Q= C.5 Δ Majzoobi, Koushanfar, and Potkonjak Techniques for Design and ImplementaBon of Secure Reconfigurable PUFs. TRETS. Syst. 2,, ArBcle 5, 29 8
Delay tuning FPGA Lookup table (LUT) Configured SRAM bits A : Control Delay A = A 2 = Switch Matrix slice slice Switch Matrix slice slice Output Switch Matrix slice slice Switch Matrix slice slice O: Programmable delay Line (PDL) Incremental changes in propagabon path Example: 3- input LUT Tree- like network ResoluBon ~ ps O 9 A A 2 A 3
TRNG System Design Monitor bit probabilibes Provide feedback to perform delay tuning Monitor Counter - accumulator Control Linear feedback linear decoding PDL D C Q Control Binary Sequence Monitor Δ p PI proporbonal integral controller Δ b e Δ f Flip-flop G Integral Out
Implementation Coarse and fine delay tuning knobs Synthesize delay within a target range Fine PDL resolubon = 32 x Coarse PDL resolubon Linear Decoding Delay Diff. Δ C Counter Value FF c i A6 A5 A4 A3 A2 A i O c o c i A6 A5 A4 A3 A2 A i c O o Coarse PDL Fine PDL
Random Walk D random walk through counter values C C + x where x = {,- }, C = counter value Prob{x = - } = - Prob{x = } = f(c) The farther from the center the higher the probability of moving toward the center Course Tuning Blocks Fine Tuning Blocks p p p p p p...... Increment Counter Value Decrement Counter Value I b m I t m I b 2 I t 2 I b I t I b n I t n I b 2 I t 2 I b I t...... Decoder DFF D Q C... output inc/dec Binary Counter LSB MSB............... 2 Decoder............
Measurement setup Measuring PDL resolubon External lab funcbon generator Linear sweep from MHz to 5MHz Freq * 34 by internal PLL Xilinx Virtex 5 XC5VLX Record error rate 32x32 array 3
PDL Delay Measurement Delay difference Coarse delay tap ~ps Fine delay tap ~ps/32 ns ns ns _ = 4
Tuning with PDLs Fine tuning stages 32 Coarse tuning stages 32 Measure probability Repeat Bmes Normalize the number of s 5
Operation bit counter (5 LSB/MSB bits control fine/coarse PDLs) The counter value finally se@le around a constant value 562 It walks around the center values Here: 564,563,562,56,56, 559 6
Steady state statistics : decrement : increment How many Bmes a counter value appears What is the output bit probability associated with each counter values? Output: Counter: 564 563 562 56 562 56 56 56 562 56 56 56.4 7
Post- Processing Learning filter Only output values when the counter value equals X X is learned by measuring each bit probability for steady state counter values In this case, X = 56 Van Neumann correcbon 8
Cost Area (32+32)x2 = 28 LUTs for the PDLs FFs = bit counter Decoder = 2 ROMs (5 bit address width 28 bit word) XC5VLXT 7,28 Slices 296 8kb ROM Can fit more than TRNGs Speed Forward path delay = 6.6ns 6 Mbit/sec, 2Mbit/Sec a{er post- processing Overclocking Parallel cores 9
Statistical Test Results NIST suite A{er filtering and post processing 2
Conclusion FPGA based true random number generabon Flip- flop meta- stability Use precise delay tuning Programmable delay line Single LUT To generate high quality random bits Self adjusbng mechanism Resilient to acbve a@acks Throughput of 2MHz with one block Can have TRNG blocks run in parallel Can perform overclocking 2