# Pitfall of the Strongest Cells in Static Random Access Memory Physical Unclonable Functions
## 3 Cloning SRAM Power-on Value  
### Weakness of SRAM PUFs Based on a Repetition Code  
For the repetition code \(C_{rep}(n,k,t)\), the generation polynomial \(\mathrm{G}\) is generally \(\mathrm{G}=\sum_{i=0}^{n-1}x^{i}\)[16]. Taking \(n\)-bit responses \(\mathrm{R}=\sum_{i=0}^{n-1}y_{i}\) as input, \((n-1)\)-bit helper data \(\mathrm{H}=\sum_{i=0}^{n-2}h_{i}\) is generated, where \(h_{i}=y_{0}\oplus y_{i+1}\). There is no helper data generated in position \(y_{0}\), and we can obtain \(h_{0}\) from position \(y_{1}\), \(h_{1}\) from position \(y_{2}\) and so on.  
Figure 3: Structure of a SRAM PUF.  
Due to the linear nature of repetition codes, a certain relationship exists between the helper data and the response \(R\). Figure 4 shows the relationship between response \(R\) of a 32 \(\times\) 32 SRAM array and the generated helper data with repetition code \(C_{rep}(5,1,2)\). The SRAM array has 32 columns and 32 rows, and their power-on values are listed in the left matrix one-by-one as \(x_{0}\), \(x_{1}\), \(\cdots\)\(x_{1023}\). In enrollment phase, the power-on values are measured as response \(R\) and every five elements are sent to \(C_{rep}(5,1,2)\) to obtain 4-bit helper data, and we obtain a total of 819-bit helper data, listed in the right matrix as \(h_{0}\), \(h_{1}\), \(\cdots\), \(h_{818}\). An empty element \(e_{z}\) where \(z\in(0,n-1)\) with initial value zero is inserted at position \(y_{0}\) where helper data is not generated. The right matrix composed by helper data and \(e_{z}\) creates an initial clone matrix \(E\):  
The generation formula of the helper data shows that when \(y_{0}=0\), \(h_{i}=y_{i+1}\), that is, the corresponding response \(R\) and the helper data are the same under this condition. The matrix \(E\) is the same as the response \(R\) when \(y_{0}=0\), and the matrix \(E\) is the opposite of response \(R\) when \(y_{0}=1\).  
From the analysis above, whether the matrix \(E\) is the same as the response \(R\) is determined by the hiding \(y_{0}\). In the worst case, the probability of the equality between \(E\) and response \(R\) is \(1/2^{\frac{n}{n}}\), where \(m\) is the length of response \(R\) and \(n\) is the length of the input data of the selected repetition code. \(q_{y0}\) is the ratio of having 0 in responses, i.e., \(q_{y0}=n_{y0}/m\), \(n_{y0}\) is the number of cells with a power-on value of 0. When \(q_{y0}\) is higher, the probability of having \(y_{0}=0\) is also higher. The similarity between the matrix \(E\) and response \(R\) is higher too, and \(E\) directly leaks most of the information about response \(R\).  
For repetition code \(C_{rep}(n,k,t)\), we can obtain one dimension code \(C_{rep}(n-k+1,1,t)\) by shortening the dimension by \(k-1\) bits. The two codes have the same generator polynomial and error correction capabilities [16], usually a code \(C_{rep}(n,1,t)\) is chosen for fuzzy extractor. According to Equation (2), only 1-bit entropy is left after error correction by repetition code, and the left entropy bit is hiding \(y_{0}\). Ideally, \(p_{0}\) and \(p_{1}\) in position \(y_{0}\) have same value of 50%, but in the real world, the value may be biased to 0 due to manufacturing process variations and changes in power-on environment (temperature, voltage, etc.). \(q_{y0}\) can be considered as the observed value of \(p_{0}\) in position \(y_{0}\). When this bias is heavy, the leftover entropy will decrease to zero. For repetition code \(C_{rep}(5,1,2)\), leftover entropy will be zero when \(q_{y0}>57.4\%\) according to Equations (1) and (2). The responses with high \(q_{y0}\) are considered weak responses.