# Secure ECDSA SRAM-PUF Based on Universal Single/Double Scalar Multiplication Architecture
## Appendix A Soft-Decision SRAM-PUF Based on Reed-Muller Codes
Thus, we have another similar relation:

\[x=\frac{x_{1}y_{2}+x_{2}(x_{1}+y_{1})+x_{1}x_{2}^{2}+x_{1}^{2}x_{2}}{x_{1}^{2} +x_{2}^{2}}. \tag{16}\]Comparing Equation (4) and Equation (5), we also simplify the expression of PA as

\[x_{3}=x+\frac{x_{1}x_{2}}{(x_{1}+x_{2})^{2}}=x+\frac{2x_{1}^{2}+x_{1}x_{2}}{(x_{1 }+x_{2})^{2}}=x+\left(\frac{x_{1}}{x_{1}+x_{2}}\right)^{2}+\frac{x_{1}}{x_{1}+x _{2}}. \tag{11}\]

Considering simplified expressions for PD and PA not involving \(y\)-coordinates, the calculation of \(y\)-coordinates during the iteration of PA and PD in ECSM can be eliminated, as shown below. \[\left\{ \begin{array}{ll}PD:&x_{PD}=x_{1}^{2}+\frac{b}{x_{1}^{2}}\\ PA:&x_{PA}=x+\left(\frac{x_{1}}{x_{1}+x_{2}}\right)^{2}+\frac{x_{1}}{x_{1}+x_{2 }}\end{array} \right.\text{ \ \ for }P_{2}=P+P_{1} \tag{12}\]

Executing PA and PD in affine coordinates requires multiple inversions during the iteration. Inversions over \(GF(2^{m})\) are time-consuming. Therefore, we can map the points from affine coordinates \((x,y)\) to Lopez-Dahab (LD) projective coordinates \((X,Y,Z)\). As a result, we only need to calculate multiplications, additions, and squares in each iteration, leaving only one inversion at the end of ECSM. The expressions of PA and PD in LD projective coordinates are:

\[\left\{ \begin{array}{ll}X_{PA}=x_{P}(X_{1}Z_{2}+X_{2}Z_{1})^{2}+X_{1}X_{2} \cdot Z_{1}\cdot Z_{2}\\ Z_{PA}=(X_{1}Z_{2}+X_{2}Z_{1})^{2}\end{array} \right. \tag{13}\]

\[\left\{ \begin{array}{ll}X_{PD}=X_{1}^{4}+bZ_{1}^{4}\\ Z_{PD}=X_{1}^{2}Z_{1}^{2}\end{array} \right. \tag{14}\]

In the end, the recovery of \(y\) and coordinate conversion is presented as:

\[\left\{ \begin{array}{ll}x_{Q}=\frac{X_{1}}{Z_{1}}\\ y_{Q}=y_{P}+\frac{(x_{P}+x_{Q})[(X_{1}+x_{P}Z_{1})(X_{2}+x_{P}Z_{2})+(x_{P}^{2}+ y_{P})Z_{1}Z_{2}]}{x_{P}Z_{1}Z_{2}}.\end{array} \right. \tag{15}\]

With the simplified PA and PD expressions in Equations (13) and (14), the Montgomery-ladder-based ECSM algorithm is given in Algorithm 14. Note that the recovery of \(y\) in the Montgomery-ladder-based ECSM algorithm adopts Equation (15). ```
0:\(k=(k_{t-1},\cdots,k_{1},k_{0})_{2}\) with \(k_{t-1}=1\), \(P=(x_{P},y_{P})\). 0:\(Q=kP\). 1: Set \(P_{1}\leftarrow(x_{P},1),P_{2}\leftarrow(x_{P}^{4}+b,x_{P}^{2})\). 2:for\(i=t-2\) to \(0\)do
3:if\(k_{i}=1\)then
4:\(P_{1}\leftarrow PA(P_{1},P_{2})\),
5:\(P_{2}\gets PD(P_{2})\),
6:else
7:\(P_{2}\gets PA(P_{1},P_{2})\),
8:\(P_{1}\gets PD(P_{1})\),
9:endif
10:endfor
11:Recover \(y\) in affine coordinates. Return\(Q\). ```
**Algorithm 14** The Montgomery Ladder ECSM Algorithm

Meanwhile, if only one single PA is executed, then we should adopt the single PA algorithm in LD coordinates as shown in Algorithm 15 rather than Equation (13). ```
0:\(P_{1}=(X_{1},Y_{1},Z_{1})\) and \(P_{2}=(X_{2},Y_{2},Z_{2})\). 0:\(P_{3}=(X_{3},Z_{3})\) and \(x_{p}\). 1:\(X_{1}\gets X_{1}Z_{2},X_{2}\gets X_{2}Z_{1}\)
2:\(Y_{1}\gets Y_{1}Z_{2},X_{2}\gets Y_{2}Z_{1}\)
3:\(X_{1}\gets X_{1}+X_{2}\)
4:\(Y_{1}\gets Y_{1}+Y_{2}\)
5:\(Y_{1}\gets Y_{1}Y_{2},Z_{1}\gets Z_{1}Z_{2},X_{2}\gets X_{1}^{2}\)
6:\(Y_{1}\gets Y_{1}Z_{1},Z_{3}\gets Z_{1}X_{2},X_{1}\gets X_{1}+Z_{1}\)
7:\(X_{1}\gets X_{1}X_{2}\)
8:\(X_{3}\gets Y_{1}+X_{1}\)
9:\(x_{p}\gets X_{3}/Z_{3}\)
```
**Algorithm A5** The Single PA Algorithm

## Appendix C Differential Addition Chain

In a DAC, each sum in the chain has already been accompanied by a difference: i.e., whenever a new element \(C_{new}=C_{1}+C_{2}\) is formed by adding two existing elements \(C_{1}\) and \(C_{2}\), the difference of two elements \(C_{1}-C_{2}\) was already in this chain. We can efficiently calculate ECDSM with a two-dimensional DAC, as shown in Figure A2. The left side of Figure A2 lists all elements in the two-dimensional DAC, and the right side provides flags for each loop. We only need to precompute the flag signal for each round before initiating the main loop of PA and PD iterations. These flag signals are used to determine the two-dimensional DAC.