# ODHD: On-Demand Helper Data Generation for Reliable NVM-Free Key Derivation from SRAM PUF

Sara Faour, Mališa Vučinić, Filip Maksimovic, Thomas Watteyne, Kristofer Pister

► To cite this version:

Sara Faour, Mališa Vučinić, Filip Maksimovic, Thomas Watteyne, Kristofer Pister. ODHD: On-Demand Helper Data Generation for Reliable NVM-Free Key Derivation from SRAM PUF. ISC 2025 - IEEE International Conference on Information Security And Cryptology, Oct 2025, Ankara, Turkey. hal-05332856

HAL Id: hal-05332856

https://inria.hal.science/hal-05332856v1

Submitted on 27 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
ODHD: On-Demand Helper Data Generation
for Reliable NVM-Free Key Derivation from
SRAM PUF

Sara Faour*, Mališa Vučinić*, Filip Maksimovic*, Thomas Watteyne*, Kristofer Pister†

*Inria, Paris

†University of California, Berkeley

e-mail: first.last@inria.fr*, ksjp@berkeley.edu†

**Abstract**—Physically Unclonable Functions (PUFs) extract secure keys from inherent hardware variations, without storing them in non-volatile memory (NVM). SRAM PUFs leverage existing memory, but suffer from reliability issues due to noise. Current methods address this using complex error correction with NVM-stored helper data or by pre-selecting stable cells through repeated measurements. Avoiding NVM reduces leakage risks and manufacturing costs, benefiting low-end devices without NVM. This paper presents a novel self-contained approach for stabilizing SRAM PUFs without NVM-stored helper data, using a simple decoder and few SRAM measurements.

***Index Terms***—SRAM PUF, secret key, helper data, NVM-free.

# I. INTRODUCTION

Trusted Platform Modules (TPMs) provide a hardware root of trust through secure key storage and cryptographic operations, but increase system cost and complexity. Physical Unclonable Functions (PUFs) present a lightweight alternative by exploiting intrinsic manufacturing variations to generate unique, device-specific responses. SRAM PUFs are widely used to generate device-unique cryptographic keys by leveraging the unpredictable power-up states of SRAM cells. However, environmental variations cause response instability, necessitating techniques to improve reliability.

Fuzzy extractors are a post-processing method widely used for stabilizing noisy PUF responses. They operate in two phases: *enrollment*, where error correction codes (ECCs) generate a secret key and helper data permanently stored in non-volatile memory (NVM); and *regeneration*, where the helper data is used to reconstruct the key from a new noisy response, as shown in the upper part of Fig. 1. While effective in achieving failure rates below $10^{-6}$ for 128-bit keys [1], they require complex ECC decoding and persistent storage of helper data in NVM, which may leak information (e.g. in code-offset constructions) [2]. Additionally, using NVM requires special fabrication processes distinct from standard CMOS, increasing manufacturing costs. Simpler constructions such as repetition codes reduce decoding complexity but suffer from high entropy loss [3]. More advanced soft-decision decoding methods [4] offer improved correction but at high computational cost.

<figure><img src="image_2.png" /><figcaption>Fig. 1. Comparing the enrollment between a fuzzy extractor and our approach.</figcaption></figure>

To reduce error rates before fuzzy extraction, pre-processing techniques such as Temporal Majority Voting (TMV) and Dark Bit (DB) [5] identify stable PUF bits via repeated measurements. TMV uses majority decisions across power cycles, but requires many evaluations for unstable bits. DB improves reliability by storing a mask to exclude such bits. However, these methods often require extensive measurements or non-standard conditions [6], [7]. Spatial Majority Voting (SMV) [8] offers a single-measurement alternative by identifying majority subgroups within responses, but its reliance on helper masks can significantly leak entropy. To reduce such leakage while retaining a simple decoder and single measurement, the Threshold-based Majority Voting Scheme (TMVS) [9] uses fixed codewords and selects sequences with strong agreement, storing only the sequence address and codeword. By requiring more SRAM bits, TMVS lowers entropy loss compared to SMV and repetition codes. Despite these improvements, helper-based methods risk information leakage and incur NVM overhead. This motivates the shift towards helper-less approaches, which avoid storing masks or helper data. Bernardini et al. [10] demonstrate their theoretical feasibility, proposing stable cell selection without
mask storage. However, such methods often require extensive characterization [11], leading to long test times, which is not practical for resource-constrained devices.

We propose On-Demand Helper Data (ODHD<fnref n="1" />), a novel<fnref n="2" /> NVM-free SRAM PUF key generation scheme designed to be self-contained, scalable, and lightweight, thereby avoiding complex error correction and extensive measurements. It requires no hardware changes and is compatible with standard CMOS SRAM. ODHD enables robust key extraction by generating helper data on-demand, without storing it in NVM. Devices can recreate the same helper data at each reboot. Our approach extends the TMVS post-processing technique [9], modifying it for NVM-free operation. Unlike pre-processing methods that pre-select stable bits, we integrate a small number of PUF readings—tens rather than hundreds—into encoding, as illustrated in Fig. 1 (bottom), requiring only simple 1-bit control of the SRAM power supply. We are the first to design an on-demand helper data-based approach.

The remainder of this paper is organized as follows. Section II provides the necessary background. Section III describes our novel NVM-free approach. Section IV concludes this paper and presents avenues for future work.

## II. PRELIMINARIES

### A. SRAM PUF Fundamentals

A typical SRAM cell, such as the 6-transistor design, consists of six transistors ideally meant to behave identically. In practice, process variations at the nanometer scale make each cell unique. On power-up, stable cells consistently initialize to a fixed state ('0' or '1'), while unstable ones vary due to noise and environmental factors such as temperature and voltage. This variability leads to different outputs on repeated power-ups, measured by the Hamming distance $d_H(R, R')$: the number of bits that are different between two responses $R$ and $R'$. The bit error probability $p_e$ reflects the likelihood of bit flips and impacts PUF reliability, typically reduced via stabilization methods. Assuming each SRAM bit is independent and identically distributed (i.i.d.) [12], both the Hamming weight—defined as the number of non-zero bits— and Hamming distance follow a binomial distribution.

### B. Threshold-based Majority Voting Scheme (TMVS)

A naive method for SRAM PUF key generation without helper data is majority voting, where each key bit follows the dominant value in a PUF response. However, when 0's and 1's are nearly balanced—as is typical—even a few bit-flips can change the majority, making it unreliable. Assuming unbiased SRAM memory, the probability $p$ that a cell outputs '1' is $\frac{1}{2}$. We proposed a threshold-based approach, “TMVS” [9], which discards $n$-bit SRAM responses with Hamming weights near $\frac{n}{2}$, where bit flips are most error-prone.

<figure><img src="image_3.png" /><figcaption>Fig. 2. Illustration for the selection region determined by thresholds on the Hamming distance $d_H(R, S)$ distribution. Taken from [9].</figcaption></figure>

The number of bit errors $n_e$ in an $n$-bit response follows a binomial distribution, approximated by a normal distribution with mean $\mu_e = np_e$ and standard deviation $\sigma_e = \sqrt{np_e(1-p_e)}$. Using the empirical rule, the number of flipping bits mainly lies within the interval $[\mu_e - x_\sigma\sigma_e, \mu_e + x_\sigma\sigma_e]$ with a certain probability. With the deviation coefficient $x_\sigma = 6$, the number of bit flips lies within the interval $\mu_e \pm 6\sigma_e$ with very high probability, where only about $1.973 \cdot 10^{-9}$ fall outside this range. Thus, if up to $N_{e,max} = [\mu_e + 6\sigma_e]$ errors can be corrected, nearly all possible errors are captured, leaving an error probability of just $1.973 \cdot 10^{-9}$ (equivalent to a failure probability of $10^{-6}$ for a 128-bit key). To ensure robustness, we select only those SRAM sequences whose Hamming weight deviates from the expected value $np$ by at least $N_{e,max}$. By convention, random variables are uppercase, their realizations lowercase.

**Codebook.** The above condition on Hamming weight is equivalent to checking the Hamming distance to a codeword of $n$ zeros. To increase the probability of selection, multiple codewords ($M$) are used, forming a codebook characterized by $n$ and $x_\sigma$, where at most one codeword satisfies the threshold constraints with respect to a response. Each codeword is designed to correct at least $N_{e,max}$ errors.

**Enrollment.** For each SRAM sequence $R$, the Hamming distance to different codewords is computed. A codeword $S$ is assigned to $R$ if it satisfies one of the following:

$$d_H(R, S) \leq \lfloor \frac{n}{2} \rfloor - N_{e,\max} \triangleq \text{TH}_{\text{low}} \quad (1)$$

$$d_H(R, S) \geq \lfloor \frac{n}{2} \rfloor + N_{e,\max} \triangleq \text{TH}_{\text{high}} \quad (2)$$

If a match is found, the address $x$ of the response and the codeword index are stored as helper data, and the next $R$ starts at $x+n$; otherwise, testing continues from $x+1$. These thresholds imposed on $d_H(R, S)$ are illustrated in Fig. 2, where $d_H(R, S)$ follows a binomial distribution with $p = \frac{1}{2}$.

**Regeneration.** During regeneration, the helper data is used to fetch the assigned codeword $S$. The Hamming distance is recalculated between the regenerated SRAM sequence $R'$ and

<footnote n="1">¹ ODHD sufferers believe they are on a mission to save humanity or uncover hidden truths. Likewise, SRAM-ODHD is on a heroic quest to liberate SRAM PUFs from NVM dependence, unveiling the hidden truth that helper data can be reliably generated on-demand, ensuring consistent key derivation.</footnote>

<footnote n="2">² A patent application related to this work is currently in process.</footnote>
S, and majority voting is applied to derive the key bit as follows:

$$d_H(R', S) \leq \lfloor \frac{n}{2} \rfloor \rightarrow \text{bit key = '0'} \quad (3)$$

$$d_H(R', S) \geq \lfloor \frac{n}{2} \rfloor \rightarrow \text{bit key = '1'} \quad (4)$$

### III. NVM-FREE KEY DERIVATION FROM SRAM PUFs

Helper data generated by TMVS may vary across enrollments. This means that an SRAM sequence chosen in one enrollment may be discarded in another. Such differences occur most often when the assigned codeword S happens to lie near the selection thresholds TH<sub>low</sub> or TH<sub>high</sub>, and in particular when the conditions (1) or (2) are met. As a result, even small variations in the raw PUF readings can lead to different helper data, and consequently, to different extracted secret key bits.

Fig. 3 presents the histogram of the modified Hamming distances, denoted $d_H^*(R, S)$, between a fixed SRAM sequence of $n = 7$ bits and multiple candidate codewords. Our aim here is to redefine the raw Hamming distance $d_H(R, S)$ so that the visualization better highlights which codewords are “close” or “far” in a balanced way.

We introduce $d_H^*(R, S)$ as a shifted version of $d_H(R, S)$, given by the following rule:

$$d_H^*(R, S) = \begin{cases} d_H(R, S) - (\lfloor \frac{n}{2} \rfloor + 1), & \text{if } d_H(R, S) \leq \lfloor \frac{n}{2} \rfloor, \\ d_H(R, S) - (\lfloor \frac{n}{2} \rfloor - 1), & \text{if } d_H(R, S) \geq \lfloor \frac{n}{2} \rfloor. \end{cases}$$

This definition essentially subtracts a constant offset from $d_H(R, S)$, but the offset depends on which side of the midpoint $\frac{n}{2}$ the original distance falls. The result is that values on the lower side are shifted downward, and values on the upper side are shifted upward, placing a gap of two units between them in the new scale.

To see the effect of this transformation more clearly, observe that

$$d_H(R, S) \leq \lfloor \frac{n}{2} \rfloor \iff d_H^*(R, S) \leq -1,$$

meaning that all “close” codewords end up having a strictly negative modified distance. Similarly,

$$d_H(R, S) \geq \lfloor \frac{n}{2} \rfloor \iff d_H^*(R, S) \geq +1,$$

so that “far” codewords map to strictly positive modified distances.

By doing this, we deliberately center the separation between the two groups of distances around zero. This makes the visual gap in the histogram much more pronounced and intuitive: negative values clearly correspond to one cluster (close codewords), positive values to the other (far codewords), and the zero region in between acts as a natural dividing line.

The gray dashed lines in Fig. 3 indicate the shifted thresholds TH<sub>low</sub><sup>*</sup> (bottom) and TH<sub>high</sub><sup>*</sup> (top), which are defined from the original thresholds by

$$\text{TH}_{\text{low}}^{*} = \text{TH}_{\text{low}} - (\lfloor \frac{n}{2} \rfloor + 1),$$

$$\text{TH}_{\text{high}}^{*} = \text{TH}_{\text{high}} - (\lfloor \frac{n}{2} \rfloor - 1).$$

<figure><img src="image_4.png" /><figcaption>Fig. 3. Histogram of Hamming distances between a 7-bit SRAM sequence and multiple codewords, across 10 power cycles indexed 1–10. While some values of $S_1$ and $S_4$ cross the selection threshold (gray dashed lines), averaging (the blue lines) ensures only $S_4$ is consistently reaching threshold despite bit flips.</figcaption></figure>

Because we are working with unbiased SRAM memory, where the bit-flip probability is $p = \frac{1}{2}$, we have the symmetry

$$\text{TH}_{\text{high}} = n - \text{TH}_{\text{low}},$$

which in turn implies

$$\text{TH}_{\text{low}}^{*} = -\text{TH}_{\text{high}}^{*}.$$

This symmetry reinforces the idea that our transformed scale is centered, with thresholds equidistant from zero.

Every group of columns with the same color in Fig. 3 corresponds to the same codeword S. Within each group, each column shows the value of $d_H^*(R, S)$ for a new SRAM measurement of the same 7-bit sequence R. The figure contains a total of 10 measurements, each taken after a complete power-off / power-on cycle (one power reset).

For example, consider the first measurement (index 1). Here, the assigned codeword is $S_4$, because it satisfies constraint (2). In this case, the enrollment records a bit value of ‘1’. However, when we look at the second measurement (index 2), bit flips in R cause the approach to instead assign codeword $S_1$. Since $S_1$ corresponds to the opposite bit value, this leads to a different enrollment bit (‘0’) – an inconsistency we want to avoid.

One way to overcome this instability is to take multiple measurements for the same SRAM sequence, and then base our decision on the average modified Hamming distance rather than on a single noisy measurement. In Fig. 3, these average values are shown as blue horizontal lines. Based on the average values of our example, the codeword $S_4$ should be consistently assigned. To apply this method, we require control over the SRAM bank’s power supply so that multiple power resets can be performed during enrollment.

Formally, for a given codeword S, we define the average modified Hamming distance as

$$\overline{d}_H^*(S) = \frac{1}{N_{\text{res}}} \sum_{i=1}^{N_{\text{res}}} d_H^*(r^i, S),$$

where:

* $N_{\text{res}}$ is the number of power resets performed,
• $r^i$ is the measured n-bit PUF response $R$ at the i-th power reset.

When $|d_H^*(S)|$ is small and close to zero, this indicates a “borderline” SRAM sequence with respect to $S$. In such cases, the sign of $d_H^*$ may flip across measurements, leading to unreliable key extraction. In Fig. 3, this behavior can be seen clearly for codewords $S_2$, $S_3$, and $S_5$.

*Enrollment.* Compared to the original TMVS method, our enrollment process requires $N_{res}$ SRAM measurements, where

$$n_{res} \in \{1, 2, \dots, n_{res,max}\},$$

and $n_{res,max}$ is the maximum allowed number of measurements. The process is as follows:

1) Measure the SRAM sequence $R$ multiple times:

$$\{r^1, r^2, \dots, r^{N_{res}}\}.$$

2) Compute the average modified Hamming distance $\overline{d}_H^*(S)$ for each candidate codeword $S$.

3) Select $R$ if it satisfies the enrollment criterion:

$$\overline{d}_H^*(S) \leq \text{TH}^*_{\text{low}} \text{ or } \overline{d}_H^*(S) \geq \text{TH}^*_{\text{high}}.$$

*Regeneration.* When regenerating the secret key, we use the public helper data from the most recent enrollment. This data can be stored temporarily in any type of memory, and—as in TMVS—we use a majority-voting decoder based on a single SRAM measurement $r'$ of $R'$. The decoding rule is simple:

$$d_H^*(R', S) \leq -1 \Rightarrow \text{bit value '0'};$$

$$d_H^*(R', S) \geq +1 \Rightarrow \text{bit value '1'}.$$

Because the modified distance is centered around zero, there is no ambiguity between the two cases.

*Thresholds.* Our codebook is designed to correct up to $N_{e,max}$ errors. Given a particular codebook with parameters $n$ and $x_\sigma$, we can compute threshold values $th^*_{high,code}$ and $th^*_{low,code}$. When used in the enrollment condition above, these thresholds guarantee that the decoder can handle the targeted error correction capability. Using a threshold higher than $th^*_{high,code}$ increases error tolerance but reduces the number of sequences that pass selection (because the requirement is stricter). On the other hand, using a lower threshold increases the number of valid sequences, and even allows multiple codewords to be assigned to the same sequence, but sacrifices error correction performance.

Overall, our method improves the error rate of TMVS, while moving closer to a design that requires no helper data storage in NVM. Furthermore, the codebook can be hard-coded directly into ROM, eliminating the need for NVM entirely.

## IV. CONCLUSION

In this paper, we propose a novel method for robust key derivation from SRAM PUFs that enables reliable, on-demand helper data generation, eliminating the need for NVM storage. Our approach leverages a codebook (which can be hard coded) and tens of SRAM power cycles for enrollment, followed by

simple majority voting during key regeneration. These results support the development of scalable, self-contained secure hardware, particularly in cost-sensitive applications lacking NVM. In future work, we plan to validate our approach using real datasets and derive the experimental bit error rate.

## ACKNOWLEDGMENT

We would like to express our sincere gratitude to Branko Kerkez for his invaluable guidance and support during the initial stages of this work. This document is issued within the frame and for the purpose of the OpenSwarm project. This project has received funding from the European Union's Horizon Europe Framework Programme under Grant Agreement No. 101093046. Views and opinions expressed are however those of the author(s) only and the European Commission is not responsible for any use that may be made of the information it contains.

## REFERENCES

[1] C. Bösch, J. Guajardo, A.-R. Sadeghi, J. Shokrollahi, and P. Tuyls, “Efficient Helper Data Key Extractor on FPGAs,” in *Cryptographic Hardware and Embedded Systems (CHES)*. Springer, 2008.

[2] Y. Dodis, L. Reyzin, and A. Smith, “Fuzzy extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data,” in *Advances In Cryptology (EUROCRYPT)*. Springer, 2004.

[3] P. Koeberl, J. Li, A. Rajan, and W. Wu, “Entropy Loss in PUF-based Key Generation Schemes: The Repetition Code Pitfall,” in *Hardware-Oriented Security and Trust (HOST)*. IEEE, 2014.

[4] V. Van der Leest, B. Preneel, and E. Van der Sluis, “Soft Decision Error Correction for Compact Memory-Based PUFs Using a Single Enrollment,” in *International Workshop on Cryptographic Hardware and Embedded Systems (CHES)*. Springer, 2012.

[5] F. Armknecht, R. Maes, A.-R. Sadeghi, B. Sunar, and P. Tuyls, “Memory leakage-resilient encryption based on physically unclonable functions,” *Towards Hardware-Intrinsic Security: Foundations and Practice*, 2010.

[6] M. Liu, C. Zhou, Q. Tang, K. K. Parhi, and C. H. Kim, “A Data Remanence Based Approach to Generate 100% Stable Keys from an SRAM Physical Unclonable Function,” in *International Symposium on Low Power Electronics and Design (ISLPED)*. IEEE, 2017.

[7] W. Wang, A. Singh, U. Guin, and A. Chatterjee, “Exploiting Power Supply Ramp Rate for Calibrating Cell Strength in SRAM PUFs,” in *Latin-American Test Symposium (LATS)*. IEEE, 2018.

[8] P. Koeberl, J. Li, and W. Wu, “A Spatial Majority Voting Technique to Reduce Error Rate of Physically Unclonable Functions,” in *International Conference on Trusted Systems (INTRUST)*, 2013.

[9] S. Faour, M. Vučinić, F. Maksimovic, D. C. Burnett, P. Muhlethaler, T. Watteyne, and K. Pister, “TMVS: Threshold-based Majority Voting Scheme for Robust SRAM PUFs,” in *Symposium on Computers and Communications (ISCC)*. IEEE, 2024.

[10] R. Bernardini and R. Rinaldo, “Theoretical Limits of Helperless Stabilizers for Physically Unclonable Constants,” *Transactions on Emerging Topics in Computing*, 2014.

[11] ——, “Analytic and Simulation Results about a Compact, Reliable, and Unbiased 1-bit Physically Unclonable Constant,” *IEEE Transactions on Information Forensics and Security*, 2016.

[12] F. Armknecht, R. Maes, A.-R. Sadeghi, F.-X. Standaert, and C. Wachsmann, “A Formal Foundation for the Security Features of Physical Functions,” in *Symposium on Security and Privacy*, 2011.