# Barrel Shifter Physical Unclonable Function Based Encryption
## 3 Block Encryption Protocol
### Asymmetric Encryption
#### 3.2.1 Revised Asymmetric Encryption
The result after applying \(f_{Bob}^{-1}\) is equal to \((x_{0}\oplus d(0,2)_{m},x_{1}\oplus d(1,3)_{m},x_{2}\oplus d(2,0)_{m},x_{3} \oplus d(3,1)_{m})\). * **Step 7**: \(f_{[PERSON]}^{-1}\) is applied. First, [PERSON]'s permutator will rotate the bits giving \((x_{2}\oplus d(2,0)_{m},x_{3}\oplus d(3,1)_{m},x_{0}\oplus d(0,2)_{m},x_{1} \oplus d(1,3)_{m})\). Rotated bits are then given to \(PUF_{2}\) in the reverse direction resulting in \((x_{0}\oplus d(0,2)_{m}\oplus d^{{}^{\prime}}(0,2)_{m},x_{1}\oplus d(1,3)_{m} \oplus d^{{}^{\prime}}(1,3)_{m},x_{2}\oplus d(2,0)_{m}\oplus d^{{}^{\prime}}( 2,0)_{m},x_{3}\oplus d(3,1)_{m}\oplus d^{{}^{\prime}}(3,1)_{m})\). The delay terms cancel. [PERSON] receives the original message \((x_{0},x_{1},x_{2},x_{3})\) sent by [PERSON]. The original protocol in Section 3.2 subtracted the delay from the incorrect bit in the inverse permutation. The protocol shown in this section solves the original problem. However, it contains a fatal flaw; using \(\oplus\) for entanglement creates a linear relationship between messages in-flight between [PERSON] and [PERSON]. An eavesdropper can retrieve the original message from the in-flight messages. Consider Figure 5 as an example. The first bit in original message is \(x_{0}\). The encrypted first bit sent from [PERSON] to [PERSON] in Step 2 is \(B^{\prime}=x_{0}\oplus D(0,1)\). Then, from [PERSON] to [PERSON] in Step 4, \(B^{\prime\prime}=x_{0}\oplus D(0,1)\oplus d(0,2)\). The decrypted first bit sent from [PERSON] to [PERSON] in Step 6 is \(B^{\prime\prime\prime}=x_{0}\oplus d(0,2)\). \(B^{\prime}\), \(B^{\prime\prime}\) and \(B^{\prime\prime\prime}\) are all public messages. An eavesdropper can extract the original message by:  
1. Inferring [PERSON]'s PUF delay information by taking XOR of \(B^{\prime\prime}\) and \(B^{\prime\prime\prime}\). \(B^{\prime\prime}\oplus B^{\prime\prime\prime}=x_{0}\oplus D(0,1)\oplus d(0,2) \oplus x_{0}\oplus d(0,2)=D(0,1)\). 2. Then the original message can be extracted by an XOR of \(B^{\prime}\) and [PERSON]'s PUF's delay, \(B^{\prime}\oplus D(0,1)=x_{0}\oplus D(0,1)\oplus D(0,1)=x_{0}\). Figure 5: Invertible and Commutative PUF protocol: \(PUF_{1}(f_{Bob})\) and \(PUF_{2}(f_{Alice})\) illustrate the PUF composition and how barrel shifter PUF is used for encryption and decryption processes. Assume both \(PUF_{1}\) and \(PUF_{2}\) are two-stage BS-PUFs, \(key_{1}(PUF_{1})\) is \((1,0)\), \(key_{2}(PUF_{2})\) is \((0,1)\). For \(PUF_{1}\), bit \(x_{0}\) (\(x_{1}\)) goes to output bit position \(y_{1}\) (\(y_{2}\)). The encrypted bit output at \(y_{1}\) (\(y_{2}\)) is \(x_{0}\oplus D(0,1)_{m}\) (\(x_{1}\oplus D(1,2)_{m}\)). \(D(i,i^{{}^{\prime}})_{m}\) is the \(m\)th least significant bit of the delay from input bit \(i\) to the output bit \(i^{{}^{\prime}}\). A permutator is added after each PUF to shift each bit back to its original position after encryption. In order to eliminate this problem, BS-PUF must permute bits in public messages, which we could not do and yet preserve commutativity and invertibility. One possible solution that allows permuted public messages while preserving commutativity and invertibility is to let [PERSON] and [PERSON] share the same key.