Low‐cost TRNG IPs

IET Circuits, Devices & SystemsVolume 14, Issue 7 p. 942-946 Research ArticleFree Access Low-cost TRNG IPs Hector Gomez, Corresponding Author hector.gomez@correo.uis.edu.co School of Electrical, Electronics and Telecommunication Engineering, Universidad Industrial de Santander, Bucaramanga, Santander, ColombiaSearch for more papers by this authorJulian Arenas, School of Electrical, Electronics and Telecommunication Engineering, Universidad Industrial de Santander, Bucaramanga, Santander, ColombiaSearch for more papers by this authorElkim Roa, School of Electrical, Electronics and Telecommunication Engineering, Universidad Industrial de Santander, Bucaramanga, Santander, ColombiaSearch for more papers by this author Hector Gomez, Corresponding Author hector.gomez@correo.uis.edu.co School of Electrical, Electronics and Telecommunication Engineering, Universidad Industrial de Santander, Bucaramanga, Santander, ColombiaSearch for more papers by this authorJulian Arenas, School of Electrical, Electronics and Telecommunication Engineering, Universidad Industrial de Santander, Bucaramanga, Santander, ColombiaSearch for more papers by this authorElkim Roa, School of Electrical, Electronics and Telecommunication Engineering, Universidad Industrial de Santander, Bucaramanga, Santander, ColombiaSearch for more papers by this author First published: 21 October 2020 https://doi.org/10.1049/iet-cds.2019.0535Citations: 1AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onEmailFacebookTwitterLinked InRedditWechat Abstract This study presents a low-cost multi-throughput true random number generator (TRNG) intellectual property (IP) based on a variable-length multi-mode ring oscillator. The proposed TRNG implements a multi-throughput feature by bypassing inverter cells in the ring oscillator for reducing the loop delay. This multi-throughput feature offers the advantage of high-performance or low-power operation when needed. These options make the proposed TRNG suitable for end-to-end encryption in highly restricted devices such as Internet of Things sensor nodes. Measurement results show that the proposed TRNG passes national institute of standards and technology (NIST) tests for different throughput operations. The TRNG is embedded in a reduced instruction set computer V (RISC-V)-based system-on-chip (SoC) for periodical-driven applications, and it achieves an energy efficiency of 92 pJ at 3.7 Mbps, occupying in a 180 nm technology. This study also presents a system technique to implement the entropy enhanced TRNGs, using multiple entropy sources. An extraction system provides high-quality random numbers with a sampling method that takes one entropy output to sample the other entropy sources. The system requires few resources, using low-cost TRNG IPs as entropy sources. 1 Introduction Cryptographic protocols require many security primitives where key generation and establishment are some of the most critical objectives. A security system requires high-quality and unpredictable keys where their generation relies on true random number generators (TRNGs). Achieving those system requirements needs that TRNGs present a consistent statistical behaviour as close as possible to a uniform distribution. A TRNG uses physical sources as device noise to extract the entropy. Physical sources exhibit non-uniform or biased statistical behaviour which represents a challenge in generating the high-quality keys. Although intensive computational post-processing might alleviate the associated bias in entropy sources, restrictive applications require more straightforward solutions that have motivated designers to propose fully digital approaches. Digital circuit implementation is commercially attractive, considering its inherent robustness to process and environmental variations providing high-yield low-cost circuits. Although digital TRNGs have been reported [1, 2], there is still a need to apply computing intensive calibration algorithms [2–4], or the limited application of output bits. Based upon reported results so far, the design of TRNGs is still an open field that can be explored to bring improved methods and architecture for robust key generation. Yang et al. [2] proposed an all-digital TRNG where the trade-off between numbers quality and throughput is mentioned. Yang et al. [2] offer a TRNG based on a multi-mode ring oscillator that achieves high quality with a reduced set of bits. The authors also discuss how the operating frequency of the rings affects the statistics of the output data and multiple TRNG with different ring lengths were fabricated to study this compromise. Alternatively, Gomez and coworkers [5] present an entropy source based on Yang et al. work [2] with a variable frequency feature. Gomez et al. reuse the logic for number extraction, and they use a multiplexing scheme to include rings of different lengths in the same TRNG. However, the authors report issues with the output quality due to ring oscillators interfering with each other. This paper introduces a new all-digital multi-throughput approach to provide a smooth and compact solution to analyse the effect of different operating frequencies in the output quality. The proposed TRNG enables its operation for optimal use under different operation modes in a 32-bit reduced instruction set computer V (RISC-V)-based system-on-chip (SoC) for periodical-driven applications. There are two main contributions in this work: (i) the concept of a multi-throughput single entropy source and (ii) clock-independent number generation exploiting the asynchronous nature of the TRGN. We achieve the first feature by using a modified multi-mode ring oscillator to emulate various loop delays in the oscillator to change the operating frequency. This modification enables the reuse of the circuitry used to capture a random number, in contrast to the original approach that designed complete TRNGs with different throughput [2]. Finally, we exploit the TRNG embedding in the RISC-V-based SoC, extracting the generated numbers based on the actual generation time rather than in the clock system, maximising energy efficiency. The whole SoC was taped out in a 180 nm technology, and the TRNG only occupied . This paper also discusses some circuit implementations to boost TRNG entropy using at least two independent entropy sources. 2 Proposed multi-throughput TRNG In most reported digital TRNGs, a master clock samples their output so that if the master clock changes within the operation limits, the throughput will change as well [6, 7]. Yang et al. [2] reported a digital TRNG that depends on a master clock, using a multi-mode ring oscillator as present in Fig. 1a. A trigger signal injects three edges which propagate through the ring, causing an oscillation frequency three times greater than nominal frequency. The high-frequency oscillation collapses to nominal frequency due to jitter accumulation, making the collapsing time unpredictable. Fig. 1b depicts how the TRNG extracts random numbers with a cycle counter and a capture register that is triggered by a phase and frequency detector (PFD). The PFD works as a collapse detector differentiating the time when the frequency of the multi-mode oscillator and a reference ring are similar. Fig. 1Open in figure viewerPowerPoint Multi-mode ring oscillator-based TRNG (a) Conventional multi-mode ring oscillator, (b) TRNG scheme and operation The TRNG in [2] uses a master clock to trigger a pulse generator. As Fig. 1b shows, a positive CLK edge triggers the pulse generator, and a positive stop edge registers the generated random number. One particular feature of Yang et al. [2] work is that output bit's statistical properties depend on the number of stages in the ring oscillator. With short rings, the collapsing time is faster, but with low entropy which would require higher truncation to extract enough entropy. With large rings, TRNG entropy increases, but the circuit throughput decreases. Hence, there exists a trade-off between output bits quality and TRNG throughput. Instead of using many TRNGs with rings of a different number of stages as proposed in [2], this work describes how multiplexing four pairs of ring oscillators with a different number of inverter cells circumvent the need of larger rings. Although the multiplexed scheme might extract multiple entropy sources, the reduction of the ring length might generate some output data biasing at higher frequencies. One promising approach to address the above issues is to achieve different operating frequencies and throughput with a single ring. The conventional multi-mode oscillator uses three similar stages composed by one NAND and an even number of inverters. In contrast, we propose a multi-mode oscillator with a variable delay chain. As Fig. 2 illustrates, each oscillator stage comprises a multiplexing scheme that has a long and a short path. For instance, selecting the green path results in a reduced delay, which causes an increased oscillation frequency. The proposed multiplexing scheme enables chain length control which allows it a multi-throughput operation since both low- and high-frequency modes may be tuned at the same time (see Fig. 3). The proposed TRNG is integrated along with a 32-bit RISC-V core in an SoC for Internet of Things (IoT) sensor nodes. TRNG connects to the core's main bus, through which the core can control the pulse generation and reads the stop signal. Since the number generation is asynchronous, the stop signal acts as a flag for the core. In this way, the throughput is not limited to a master clock but only to the TRNG's collapsing time, saving additional clock circuitry. Fig. 2Open in figure viewerPowerPoint Multi-mode ring oscillator using the proposed variable delay scheme Fig. 3Open in figure viewerPowerPoint Implementation of the multi-mode ring oscillator with multi-throughput operation enabled Fig. 4 shows the final implementation of the multi-throughput approach. The proposed oscillator is composed of two fixed inverters per stage and multiple delay chains in series. Each delay chain has a mux creating two paths, where the long path contains an even number of inverters. The shortest path through the whole ring includes nine inverters plus the muxes resulting in more than 15 delay elements to ensure enough entropy generation [2]. Nevertheless, achieving high-quality output data requires the use of a reduced set of output bits [2]. Fig. 4Open in figure viewerPowerPoint Scheme to enhance the entropy of a multi-mode ring oscillator by creating a dependent trigger from a second multi-mode ring oscillator Fig. 5Open in figure viewerPowerPoint Extraction scheme to capture the highest entropy number between two multi-mode ring oscillators Fig. 6Open in figure viewerPowerPoint General scheme to sample one entropy source using a second entropy source. Choosing a pair of entropy sources can be done in a random way to obfuscate the design or hindering a possible attack Fig. 7Open in figure viewerPowerPoint Micro-photograph of the taped-out multi-throughput TRNG The next section discusses how entropy in low-cost TRNGs can be boosted using at least two entropy sources. Theoretically, uniformly distributed random numbers require at least two entropy sources as proposed by Chattopadhyay and Zuckerman [8]. They developed a theoretical method to extract the best approximation of uniformly random bits. However, a circuit implementation is yet to be proposed, regarding complexity that translates into energy-constrained IoT devices. Therefore, alternative methods are hereby proposed to accomplish a circuital implementation using two or more entropy sources. 3 Enhancing entropy quality with a two sources sample system The use of two or more entropy sources has been considered before, but their use in randomness extractors remains at a theoretical or software level. This dissertation presents some approaches of how to build a TRNG using two or more independent entropy sources at the hardware level. Table 1. Measured NIST randomness test results for six different throughput rates at Throughput, Mbps 1.6 1.8 1.9 2.1 2.4 3.7 P-value Rate P-value Rate P-value Rate P-value Rate P-value Rate P-value Rate frequency 0.181557 99 0.289667 99 0.171867 99 0.350485 100 0.739918 99 0.699313 99 block frequency 0.129620 100 0.137282 100 0.534146 99 0.350485 100 0.013926 100 0.122325 100 cumulative sums 0.834308 100 0.334538 100 0.637119 100 0.122325 98 0.289667 99 0.883171 99 cumulative sums 0.739918 99 0.637119 100 0.991468 99 0.017912 98 0.090936 99 0.964295 99 runs 0.005358 99 0.739918 100 0.978072 100 0.007694 96 0.474986 99 0.080519 98 longest run 0.779188 99 0.262249 99 0.026948 100 0.657933 98 0.224821 99 0.055361 99 rank 0.224821 100 0.013569 99 0.037566 99 0.759756 100 0.035174 99 0.137282 100 FFT 0.851383 98 0.002971 99 0.181557 99 0.867692 98 0.014550 99 0.437274 99 non-overlapping template pass pass pass pass pass pass pass pass pass pass pass pass overlapping template 0.289667 99 0.514124 98 0.834308 99 0.455937 100 0.897763 99 0.514124 99 approximate entropy 0.739918 100 0.401199 99 0.238294 98 0.017912 96 0.040108 98 fail fail universal 0.534146 100 0.739918 99 0.181557 97 0.534146 100 0.000918 98 0.534146 99 random excursions pass pass pass pass pass pass pass pass pass pass pass pass random excursions variant pass pass pass pass pass pass pass pass pass pass pass pass serial 0.437274 97 0.319084 99 0.122325 98 0.145326 99 0.351446 97 fail fail serial 0.719747 100 0.334538 98 0.759756 99 0.224821 96 0.129620 100 0.017912 99 linear complexity 0.983453 99 0.122325 100 0.162606 97 0.574903 97 0.978072 100 0.383827 97 Table 2. Comparison of the proposed TRNG with the classical multi-mode-based TRNG ISSCC14 [2] ASSCC17 [12] ISSCS19 [13] This work technology, nm 65 65 180 180 post-processing flooring XOR LFSR XOR bit rate, Mb/s 2.8 0.05 1 3.7 NIST pass all all all all area, μm2 960 560 N.A.a 8700 efficiency, nJ/bit 0.057 1.85 0.81 0.092 a The authors only report the area of the ring oscillator and not the whole area of the TRNG. Bold values indicates the performance metrics where our proposed design overcomes previously reported works. Fig. 8Open in figure viewerPowerPoint Histogram for three different throughputs using a fixed number of output bits (a) Fast throughput, (b) Medium throughput, (c) Slow throughput The figure depicts the fast throughput histogram has a more biased distribution Fig. 9Open in figure viewerPowerPoint Histogram for a fixed throughput using different amounts of output bits (a) 14 bits per sample, (b) 12 bits per sample, (c) 10 bits per sample The figure depicts how the number's distribution tends to be uniform with output bits reduction Fig. 10Open in figure viewerPowerPoint Histogram for a fixed throughput using different amounts of output bits (a) 8 bits per sample, (b) 6 bits per sample, (c) 4 bits per sample The figure depicts how the number's distribution present a strong bias for the set with fewer output bits Fig. 11Open in figure viewerPowerPoint Low-complex post-processing function using XOR gates Fig. 12Open in figure viewerPowerPoint Energy consumption versus different throughput Another important consideration in the implementation of a randomness extractor is the selection of entropy sources. For a high-quality source, a physical source of noise offers the best alternative. A physical source can be digital based or analogue based, but designers prefer digital entropy sources due to their low-complex implementation and inherent robustness against the process and environmental variations [2]. Moreover, if the digital entropy source is fully synthesisable, the design would achieve portability to other technologies without a negative performance impact. Fig. 5 shows a proposed scheme of a two-source based TRNG. In this work, the approach proposed by Chattopadhyay and Zuckerman is followed, through boosting its deployability with fully synthesised entropy sources as offered in the above section. Fig. 5 depicts how to use the collapsing time of two independent multi-mode oscillators to boost the output quality. One of the counters will go faster than the other, considering the collapsing event of both rings is different. A comparator identifies which counter is faster, using it as the reference for a collapsing event. A more extended collapsing event provides better entropy while the comparison provides a way to filter which ring produces a better quality number. Fig. 4 shows an alternative circuit. The boosting strategy is to trigger a multi-mode oscillator based on the collapsing event of a first oscillator. When the first oscillator collapses, a collapse detector triggers a second multi-mode ring. A counter provides information on the collapsing time of the first ring oscillator plus the information of the collapsing time of the second ring oscillator. In this way, the effective collapsing time increases as the resulting value depends on both oscillators. Fig. 6 shows a general scheme to boost the entropy. If the entropy sources are of low complexity and portable, one can implement a TRNG with many independent entropy sources option. The main idea is to use one entropy source to sample a second one. A sample register captures numbers from the first entropy source based on a pseudo-random bit sequence (PRBS) as the clock, assuming the muxes already selected a pair of entropy sources. The second entropy source seeds the PRBS generator to provide the sampling clock. An additional alternative is to choose both entropy sources randomly. In this proposed scheme, one can select a pair of entropy sources at random using two other sources. In this way, the system avoids correlations between each couple of entropy sources while keeping the low-cost implementation. 4 Measurement results Fig. 7 shows the micro-photograph of the fabricated multi-throughput TRNG, embedded in a RISC-V-based SoC for periodical-driven applications [9]. The TRNG was fabricated in the conventional TSMC 180 nm process, is fully synthesisable, and occupies an area of . Three different throughput configurations are measured, extracting a total of 100 Mbits for each setting in order to apply national institute of standards and technology (NIST) tests [10]. It now remains to be shown whether the proposed multi-throughput scheme affects the statistical behaviour of the original design [2]. Hence, the data distribution is studied using the histogram for generated data with different configurations. Fig. 8 shows histograms for (a) the fastest throughput, (b) a medium throughput and (c) the slowest throughput, using 14 outputs bits. As expected, the fastest throughput presents a more biased distribution, having the following order statistic parameters: . An ideal standard uniform distribution presents a mean of 0.5 and a standard deviation of 0.2886. However, the medium throughput data shows better order statistic parameters than the slowest one, showing a difference with the expected behaviour [2]. We also studied the data distribution behaviour for different sets of output bits for the medium throughput configuration. Fig. 9 presents the histogram of captured data with a fixed throughput configuration and different output sizes (14, 12 and 10 output bits). As the number of output bits decreases, histograms tend to be uniform and the data of the histogram shown in Fig. 9c offers the closest approximation with and . Moreover, Fig. 10 shows histograms with a fewer number of output bits. Unlike the behaviour in Fig. 9, Fig. 10 shows that distributions do not improve with fewer bits. Fig. 10c presents data distribution with a data set of 4 bits, resulting in a deteriorated behaviour compared with a 10-bit data set. So far, the statistical properties of the proposed circuits are not enough to pass NIST tests, even when a reduced amount of output bits. This biased data could be introduced by the muxes, which produce an unbalanced load in some inverters. Muxes might also cause unexpected behaviour where medium throughput data offers better order statistic parameters than the slowest one showed in Fig. 8. The physical position of muxes might also affect the behaviour of the collapsing time, causing a non-uniform distribution of this time. Hence, we applied a simple linear corrector based on an XOR function with a compression ratio of 1/2 [11], for six different throughput configurations. Fig. 11 shows the schematic of the linear corrector, which uses 16 input bits and delivers 8 output bits. The input is divided into two groups of eight bits where the first group provides eight output bits cyclically computed with an XOR operation. Then, these first bits are used to calculate the final output masking them one by one through an XOR operation with the second group of input bits. Table 1 summarises the results for the different throughput configurations after applying the bias correction. We extracted about 100 Mbits for each operating frequency in nominal conditions, resulting in a minimum throughput of 1.6 Mbs and a maximum of 3.7 Mbs. It was expected that for the fastest throughput configuration, the statistical data distribution was good enough to pass all NIST tests. However, output data for the fastest throughput failed to pass in two criteria: the approximate entropy test and one of the serial tests. The resulting behaviour might also be associated with the inclusion of the muxes, causing poor statistical qualities. However, the remaining operating frequencies have good statistical behaviour, passing all NIST tests. The results show the potential of the multi-throughput approach, indicating the ability to generate random numbers at different rates with only one pair of ring oscillators. Despite the initial biasing in raw data, the used linear corrector was enough to generate high-quality output data for most of the output frequencies. Thus, more elaborated post-processing might help to achieve the required quality for all rates. It is necessary to study other classical stages such as Von Neumann corrector to make the full-frequency range passing all NIST tests. The throughput is not a fixed value for a fixed configuration. This variation happens since the number generation relies on the non-deterministic behaviour of the collapsing time, resulting in different generation times for each number. An average value is extracted for the configurations studied in Table 1. A 100 Mbits were captured, and the time was measured with a real-time counter available in the SoC. A similar set-up is also used to estimate the average current during number generation. Fig. 12 illustrates energy consumption versus different TRNG throughput. The TRNG achieves the best energy efficiency for a throughput of 3.7 Mbits with an energy consumption of 92 pJ. Table 2 presents a comparison of the proposed multi-throughput multi-mode TRNG with the classical multi-mode-based TRNG and other related works. The circuit here introduced is not limited by a reference clock, enabling optimisation of the extraction rate. This work achieves similar energy efficiency with a higher bit rate, validating the multi-throughput approach. 5 Summary This work demonstrates a multi-throughput TRNG using a bypassing approach to change the effective loop delay in a multi-mode oscillator. In the conventional multi-mode-based approach, the authors used many TRNGs to test different throughput. In contrast, the proposed TRNG offers a multi-throughput operation reusing the remaining logic which reduces area overhead. The TRNG was taped-out in a 180 nm technology occupying . The TRNG achieves a peak energy efficiency of 0.69 nJ at 2.2 Mbits. The TRNG is integrated along a 32-bit RISC-V-based SoC exploiting the asynchronous nature of the proposed TRNG. A simple linear corrector with a compression ratio of 1/2 was introduced to reduce bias in the output data. This paper also discusses a method to boost entropy for low-cost TRNGs due to physical entropy sources not providing the required quality. A minimum of two sources are required to extract enough entropy, but powerful extractors remain in software or only in theory. Alternative methodologies of how to sample one entropy source with a second one in a fully synthesisable way are also proposed. These methods offer an alternative to classical post-processing schemes with a low-cost implementation. 6 References 1Yang, K., Blaauw, D., Sylvester, D.: ' An all-digital edge racing true random number generator robust against PVT variations', IEEE J. Solid-State Circuits, 2016, 51, (4), pp. 1022– 1031CrossrefPubMedWeb of Science®Google Scholar 2Yang, K., Fick, D., Henry, M.B. et al.: ' 16.3 a 23 Mb/s 23 pJ/b fully synthesized true-random-number generator in 28 and 65 nm CMOS'. 2014 IEEE Int. Solid-State Circuits Conf. Digest of Technical Papers (ISSCC), San Francisco, California, 2014, pp. 280– 281Google Scholar 3Mathew, S.K., Srinivasan, S., Anders, M.A. et al.: ' 2.4 gbps, 7 mW all-digital PVT-variation tolerant true random number generator for 45 nm CMOS high-performance microprocessors', IEEE J. Solid-State Circuits, 2012, 47, (11), pp. 2807– 2821CrossrefWeb of Science®Google Scholar 4Mathew, S., Johnston, D., Newman, P. et al.: ' μRNG: A 300–950 mV 323 Gbps/W all-digital full-entropy true random number generator in 14 nm FinFET CMOS'. ESSCIRC Conf. 2015 – 41st European Solid-State Circuits Conf. (ESSCIRC), Graz, Austria, 2015, pp. 116– 119Google Scholar 5Cartagena, J., Gomez, H., Roa, E.: ' A fully-synthesized TRNG with lightweight cellular-automata based post-processing stage in 130 nm CMOS'. 2016 IEEE Nordic Circuits and Systems Conf. (NORCAS), Copenhagen, Denmark, 2016, pp. 1– 5Google Scholar 6Mathew, S.K., Johnston, D., Satpathy, S. et al.: ' μRNG: a 300–950 mV, 323 Gbps/W all-digital full-entropy true random number generator in 14 nm FinFET CMOS', IEEE J. Solid-State Circuits, 2016, 51, (7), pp. 1695– 1704CrossrefWeb of Science®Google Scholar 7Tang, Q., Kim, B., Lao, Y. et al.: ' True random number generator circuits based on single- and multi-phase beat frequency detection'. Proc. of the IEEE 2014 Custom Integrated Circuits Conf., San Jose, California, 2014, pp. 1– 4Google Scholar 8Chattopadhyay, E., Zuckerman, D.: ' Explicit two-source extractors and resilient functions', Electronic Colloquium on Computational Complexity, 2016, (119), pp. 653– 705Google Scholar 9Duran, C., Wachs, M., Rueda, L.E.G. et al.: ' An energy-efficient RISC-V RV32IMAC microcontroller for periodical-driven sensing applications'. IEEE Custom Integrated Circuits Conf., 2020Google Scholar 10Bassham, L.E., Rukhin, A., Soto, J. et al.: 'A statistical test suite for random and pseudorandom number generators for cryptographic applications', 2010, (April) Google Scholar 11Lacharme, P.: ' Post-processing functions for a biased physical random number generator'. Fast Software Encryption, University of Toulon, France, 2008, pp. 334– 342Google Scholar 12Do, A.T., Liu, X.: ' 25 fj/bit, 5 Mb/s, 0.3 V true random number generator with capacitively-coupled chaos system and dual-edge sampling scheme'. IEEE Asian Solid-State Circuits Conf., Gold Coast, Australia, 2017Google Scholar 13Nica, I.A., Savinescu, V.S., Goras, L.: ' True random number generator using an active inductor based oscillator'. IEEE Int. Symp. on Signals, Circuits and Systems, Sapporo, Japan, 2019, pp. 1– 4Google Scholar Citing Literature Volume14, Issue7October 2020Pages 942-946 FiguresReferencesRelatedInformation