# Key Recovery for Content Protection Using Ternary PUFs Designed with Pre-Formed ReRAM
## 5 Implementation with SRAM and ReRAM Devices
### Description and Analysis of the ReRAM Implementation  
The two ReRAM circuits were designed with 1.2 volt I/Os, which require voltage shifters and pin experenders to be connected to the ChipKit. Such an interface is complex and slows down the engineering board. We anticipate that the final iteration of this technology will be based on 3.3 volt I/Os. The decision to design the board with two 4 Kbit ReRAM circuits, rather than one, allowed faster read cycles of about 10 ms for a 256-bit long key, and higher tamper resistance. To increase entropy, the responses were generated by injecting a small electric current that can randomly vary from 100 nA and 800 nA every 100 nA, in pairs of cells, each located in separate arrays of 4 k cells. The number of possible challenge-response pairs in this experiment was 8 \(\times\) 4096 \(\times\) 4096 = 128 million. The response was a \"0\" when the first cell had a resistance lower than the second cell, and a \"1\", in the opposite configuration. To reduce BERs, the cells having similar resistance values should be removed. Examples of the experimental results, leveraging the differential pre-formed ReRAM-based system, are shown in Figure 11. These results represent 30 successive key generation cycles, lasting 2 s each, and after this, there was a quick enrollment of both ReRAM arrays at room temperature for 80 read cycles. Figure 10: BER of the SRAM PUF (\(\gamma\)-axis). The enrollment consisted of 1000 power off/on cycles at 0 \({}^{\circ}\)C, 20 \({}^{\circ}\)C, 40 \({}^{\circ}\)C, 60 \({}^{\circ}\)C, and 80 \({}^{\circ}\)C. The responses were generated at 0 \({}^{\circ}\)C, 20 \({}^{\circ}\)C, 40 \({}^{\circ}\)C, 60 \({}^{\circ}\)C, and 80 \({}^{\circ}\)C (\(X\)-axis), for each temperature of enrollment. Shown in green, the enrollment was conducted at multiple temperatures, and the BERs were low regardless of temperature during response generation. The starting point for the protocol is that 512 pairs of cells are randomly selected, of which 256 pairs act as a buffer, keeping the remaining 256 pairs further apart in resistance values. The 256-bit long keys generated from the look-up table are on the left, those from the ReRAM-PUF are on the right, followed by the count of errors. Here, we only observed one error, during the key generation cycle number 26, which could be due to the instability of the ReRAM or noise in the electronic system. Such BERs are within the capability of a light version of the RBC, using keys located at a Hamming distance of zero or one. In Figure 12, an experiment to quantify the effect of the size of the buffer is presented. To generate 256-bit long keys, 256 + **k** pairs were selected, with **k** being the number of extra pairs, with the lowest differences in resistance values, that were removed. The goal was to remove enough pairs to generate 256-bit keys with BERs in the part per million (ppm) range. The size of the buffer **k** can be lowered when the cell-to-cell differences in resistance values are large enough, and predictable, compared with fluctuations due to the measurement scheme. In our experiment, we designed circuits with high accuracy in the differential read, with latencies below 100 us per read-cycle. The lowest buffer sizes, around 29 pairs, were observed at room temperature and 800 nA. The largest buffer sizes, around 35 pairs, were observed at 80 \({}^{\circ}\)C and 100 nA. The protocols presented in the experimental section of this paper used 256 pairs as a buffer, which was anticipated to generate BERs way below 1 ppm. Many other parameters besides the ReRAM PUFs impacts BERs at such low levels; therefore, the exact quantification of the BERs is not easy and will be the subject of future research. The differential protocol we developed for the two ReRAM circuits also protects the system against an opponent trying to read the resistance values of the ReRAM arrays. After enrolment, the two circuits can be mounted in such a way that only differential measurements can be conducted.