Download presentation
Presentation is loading. Please wait.
1
ES-TRNG A High-throughput, Low-area
True Random Number Generator based on Edge Sampling Bohan Yang, Vladimir Rožić, Miloš Grujić Nele Mentens and Ingrid Verbauwhede COSIC, KU Leuven
2
Generic TRNG Architecture
ES-TRNG Timing jitter based TRNG Compact implementation Reasonable throughput Security analysis using a stochastic model Entropy Source Digitization Post Processing Online Tests Applications Total Failure Raw Numbers Internal Digital Noise Source 7-Nov-18 COSIC, KU Leuven
3
? Stochastic model oriented security analysis Initialization Vectors
For Cryptographic Applications: The SECURITY of a TRNG depends on its unpredictability. ? which cannot be measured by statistical tests NIST800-22 DIEHARD FIPS 140-1 can be estimated by stochastic model AIS-31 NIST800-90B ? ? 7-Nov-18 COSIC, KU Leuven
4
Timing jitter based TRNG
Noise Free Noise Free Noise A random bit is generated only when measuring the position of a edge. jitter accumulates proportionally to the square root of the accumulation time 1 D Q clk Low throughput Timing Jitter accumulation is slow Elementary TRNG Solution: increasing the sampling resolution! 7-Nov-18 COSIC, KU Leuven
5
How to increase the sampling resolution
Sampling at a higher frequency ? D Q clk D Q clk jitter accumulates proportionally to the square root of the accumulation time Highest sampling frequency is limited by technology, platform, system, power, energy…. 7-Nov-18 COSIC, KU Leuven
6
How to increase the sampling resolution
Using high resolution TDC (Time-to-Digital Converter) 0111 1000 1100 DC-TRNG LUT Resolution: ~ 17 ps GHz) Period: ~ 2.2 ns jitter accumulates proportionally to the square root of the accumulation time 2200 𝑝𝑠÷2÷17 𝑝𝑠÷4≈17 20 V. Rozic, B. Yang, W. Dehaene, and I. Verbauwhede, "Highly Efficient Entropy Extraction for True Random Number Generators on FPGAs," In DAC 2015 7-Nov-18 COSIC, KU Leuven
7
How to increase the sampling resolution
Using high resolution TDC (Time-to-Digital Converter) 0111 1000 1100 DC-TRNG ES-TRNG LUT LUT Resolution: ~ 17 ps GHz) Period: ~ 2.2 ns jitter accumulates proportionally to the square root of the accumulation time 20 2200 𝑝𝑠÷2÷17 𝑝𝑠÷4≈17 V. Rozic, B. Yang, W. Dehaene, and I. Verbauwhede, "Highly Efficient Entropy Extraction for True Random Number Generators on FPGAs," In DAC 2015 7-Nov-18 COSIC, KU Leuven
8
A closer look at ES-TRNG architecture
jitter accumulates proportionally to the square root of the accumulation time 7-Nov-18 COSIC, KU Leuven
9
Technique 1: variable-precision phase encoding
1 1 1 1 Stages [2:0] Valid Raw bit 110,001 1 100,011 111,000 N 101,010 n/a jitter accumulates proportionally to the square root of the accumulation time 1 2 𝑡 𝑓,1 𝑡 𝑓,2 𝑡 𝑟,1 𝑡 𝑟,2 7-Nov-18 COSIC, KU Leuven
10
Technique 1: variable-precision phase encoding
𝑡 𝑓,1 𝑡 𝑓,2 𝑡 𝑟,1 𝑡 𝑟,2 Elementary TRNG jitter accumulates proportionally to the square root of the accumulation time 1 7-Nov-18 COSIC, KU Leuven
11
Technique 2: repetitive sampling
jitter accumulates proportionally to the square root of the accumulation time Dependency between each samples 7-Nov-18 COSIC, KU Leuven
12
ES-TRNG: platform parameters
2.172 ns RO 2 2.740 ns RO 1 𝑡 𝑓,1 𝑡 𝑓,2 𝑡 𝑟,1 𝑡 𝑟,2 35.93 ps 22.25 ps 40.90 ps 24.12 ps jitter accumulates proportionally to the square root of the accumulation time D 𝜎 𝑚 2 𝑡 𝑚 2.9 fs 0.43 7-Nov-18 COSIC, KU Leuven
13
ES-TRNG: design parameters
jitter accumulates proportionally to the square root of the accumulation time Entropy claim! 7-Nov-18 COSIC, KU Leuven
14
Implementation of ES-TRNG on Xilinx FPGA
Compact! 5 DFFs 6 LUTs + 4 LUTs 1 CARRY4 jitter accumulates proportionally to the square root of the accumulation time 7-Nov-18 COSIC, KU Leuven
15
Conclusion Compact Hardware: 10 LUTs + 5 Xilinx Spartan-6 ES-TRNG or 10 LUTs + 6 Intel Cyclone-V Relative High Throughput: 1.15 Xilinx Spartan-6 or 1.07 Intel Cyclone-V Security analysis supported by stochastic model jitter accumulates proportionally to the square root of the accumulation time DC-TRNG & ES-TRNG resources (in progress): 7-Nov-18 COSIC, KU Leuven
16
Q&A 7-Nov-18 COSIC, KU Leuven
17
How many samples you need to capture an edge?
7-Nov-18 Your Name / Affiliation
18
What is the Noise in Ring Oscillators?
Noise Free Positions of transitions Constant Noise Free Gaussian Noise Constant Variable Random Noise Free Gaussian Noise Other Noise Deterministic Variable Random 7-Nov-18 Bohan Yang/ ESAT-COSIC, KU Leuven
19
Why a better resolution leads to a better throughput?
Limited use: CyptoIC workshop Leuven, Why a better resolution leads to a better throughput? 11/15/2017 Bohan / ESAT-COSIC and imec, KU Leuven Bohan Yang, Vladimir Rožić and Ingrid Verbauwhede, ESAT/COSIC, KU Leuven
20
What are platform parameters and design parameters?
FIPS NIST DIEHARD Obsoleted way: Random Number Generator Statistical Tests … PASS/FAIL Overestimating your entropy results in a compromised security Use lower bound ! New method: Quotes from Professor Viktor Fischer, It is quite easy to design a “TRNG” that will pass the statistical tests… Bu….t it is much more difficult to know where the “randomness” comes from and how much true randomness there is… (Knowing that only the true randomness cannot be guessed or manipulated) Now we answered why we need to measure the jitter. What you need when you are measuring something ? You need a ruler. Experiments Stochastic Model (AIS31) DGA NIST B? Assumptions Platform parameters Entropy claim Design 11/15/2017 Bohan / ESAT-COSIC and imec, KU Leuven
21
How to measure the step of delay chain?
By nicoguaro - Own work, CC BY 3.0, ttps://commons.wikimedia.org/w/index.php?curid= Ring Oscillator REG Sys CLK 11/15/2017 Bohan / ESAT-COSIC and imec, KU Leuven
22
How to measure the step of delay chain?
By nicoguaro - Own work, CC BY 3.0, ttps://commons.wikimedia.org/w/index.php?curid= Details are not important…. The delays for rising and falling edge are different Longer delay Higher counts PUF? The Monte-Carlo FPL17 The International Conference on Field-Programmable Logic and Applications (FPL) 11/15/2017 Bohan / ESAT-COSIC and imec, KU Leuven
23
How does jitter accumulate overtime?
Limited use: CyptoIC workshop Leuven, How does jitter accumulate overtime? k k2 Less required jitter, less accumulation time 11/15/2017 Bohan / ESAT-COSIC and imec, KU Leuven Bohan Yang, Vladimir Rožić and Ingrid Verbauwhede, ESAT/COSIC, KU Leuven
24
Is there any other ways to improve throughput of RingOSC based TRNG?
Limited use: CyptoIC workshop Leuven, Is there any other ways to improve throughput of RingOSC based TRNG? Timing Jitter Delay=d0+Δd RANDOM CLK D Q More transitions means: within the same period, more toggles happened( like STR, fabonacci and FIGaRO) More Oscillators More Transitions Efficient Entropy Extraction Samples with better resolution 11/15/2017 Bohan / ESAT-COSIC and imec, KU Leuven Bohan Yang, Vladimir Rožić and Ingrid Verbauwhede, ESAT/COSIC, KU Leuven
25
What is the stochastic model when ringOSC is noise free after tA?
7-Nov-18 Your Name / Affiliation
26
What is the stochastic model when ringOSC is not noise free after tA?
7-Nov-18 Your Name / Affiliation
27
Your Name / Affiliation
Did you verification your model? How can you be sure your model is correct? ….? 7-Nov-18 Your Name / Affiliation
28
Where is the comparison with other TRNGs?
BUT….. Model? Estimated jitter strength? How to compare TRNG fairly? 7-Nov-18 Your Name / Affiliation
29
Bohan Yang/ ESAT-COSIC, KU Leuven
HOW is DC-TRNG working? 60 carry stages 15 slices Osc ClkA 7-Nov-18 Bohan Yang/ ESAT-COSIC, KU Leuven
30
Is there any other applications of random numbers?
Limited use: CyptoIC workshop Leuven, Is there any other applications of random numbers? Lottery Prediction? Games Cryptography Session Keys Signature Parameters Challenges Masking When people ask one of the famous random number generation website about where they get their random number certified by an independent third part. The website provided three organizations, and all of them are working for online gaming industry. Not AIS not EAL, not NIST. Gambler cares about the fairness Scientist cares about TRNG, because they can shift the blame and question on their theorem and experiment to the unpredictable of the random number they are using. Crypto people need the random number, because they don’t know to make their crypto-system deterministic and secure at the same time. The conclusion is Random number people saved the world Stochastic Simulations Numerical Analysis Scientific Computation 11/15/2017 Bohan / ESAT-COSIC and imec, KU Leuven Bohan Yang, Vladimir Rožić and Ingrid Verbauwhede, ESAT/COSIC, KU Leuven
31
Why TRNG? Why not PRNG? Or LFSR?
True Random Number Generator Pseudo-Random Number Generator My questions as well… I will forward your questions to other speakers at CHES during their presentation, why do they need TRN for Post-quantum PK, masking, block ciphers? Isn’t PRNG or LFSR good enough? 11/15/2017 Bohan / ESAT-COSIC and imec, KU Leuven
32
Why should I care about online tests?
Ageing Temperature Active Attacks True Random Number Generator Pseudo-Random Number Generator TRNG -> the root of a cryptographic system TRNG -> the target of attackers Solution: On-line testing 11/15/2017 Bohan / ESAT-COSIC and imec, KU Leuven
33
Timing jitter based TRNG: MURO
Multiple Ring Oscillator TRNG RO 1 RO 2 RO n clk jitter accumulates proportionally to the square root of the accumulation time If ROs are independent, when n is sufficiently large, at least one edge is close to the rising edge of clk. Low accumulated jitter required Large n Conceptually corresponding to sampling a RO with a resolution around 𝑇 𝑛 B. Sunar, W. J. Martin, D. R. Stinson: A Provably Secure True Random Number Generator with Built-in Tolerance to Active Attacks, IEEE TC 2007 K. Wold, C. H. Tan: Analysis and Enhancement of Random Number Generator in FPGA Based on Oscillator Rings, IJRC 2009 7-Nov-18 COSIC, KU Leuven
34
Timing jitter based TRNG: Coherent Sampling
Clk1 Clk2 Clk1 jitter accumulates proportionally to the square root of the accumulation time 𝑇 𝐶𝑙𝑘1 𝑇 𝐶𝑙𝑘2 = 5 7 Clk1 & Clk2 can be generated by PLLs or Free-running RingOSCs. The case above is conceptually corresponding to sampling a RO with a resolution of 𝑇 𝐶𝑙𝑘1 5 (starting phase difference might not be 0) P. Kohlbrenner, K. Gaj: An embedded true random number generator for fpgas. FPGA 2004 V. Fischer, M. Drutarovský: True random number generator embedded in reconfigurable hardware. CHES 2002 7-Nov-18 COSIC, KU Leuven
Similar presentations
© 2025 SlidePlayer.com Inc.
All rights reserved.