# Secure ECDSA SRAM-PUF Based on Universal Single/Double Scalar Multiplication Architecture
## Appendix A Soft-Decision SRAM-PUF Based on Reed-Muller Codes
Firstly, calculate the likelihood estimate \(L\) for each bit based on Equation (A1). Subsequently, substitute the likelihood estimates into Algorithm A3 for recursion, ultimately obtaining the likelihood estimate \(L^{*}\) for each bit after decoding. ```
0:\(L\), \(r\), and \(m\). 0:\(L^{*}\). 1:Define \(F(a,b)=sign(a\times b)\times min(|a|,|b|)\);
2:Define \(G(s,a,b)=\lfloor\frac{1}{2}(sign(s)\times a+b)\rfloor\);
3:SoftDecision_Decode_RM(L,r,m);
4:if\(r=0\)then
5:\(L^{*}=SoftDecision\_Decode\_Rep(L,2^{m})\);
6:elseif\(r=m\)then
7:\(L^{*}=L\);
8:else
9:\(L^{(1)}_{i}=F(L_{2i-1},L_{2i}),i=1,\ldots,2^{m-1}\);
10:\(L^{(1)*}=SoftDecision\_Decode\_RM(L^{(1)},r-1,m-1)\);
11:\(L^{(2)}_{i}=G\left(L^{(1)*}_{i},L_{2i-1},L_{2i}\right),i=1,\ldots,2^{m-1}\);
12:\(L^{(2)*}=SoftDecision\_Decode\_RM(L^{(2)},r,m-1)\);
13:\(L^{*}=\left(F\left(L^{(1)*}_{1},L^{(2)*}_{1}\right),L^{(2)*}_{1},\ldots,F\left( L^{(1)*}_{2*-1},L^{(2)*}_{2*-1}\right),L^{(2)*}_{2*-1}\right)\);
14:endif
15:Return:\(X\) and \(Z\). ```

**Algorithm A2** Soft-Decision Repeat Code

The RM code encompasses two parameters: the order \(r\) and the frequency \(m\), where \(r\) determines the recursion complexity, and \(m\) determines the length of the code word \(2^{m}\). An RM (\(r\), \(m\)) code can be decomposed into an RM (\(r-1\), \(m-1\)) code and an RM (\(r\), \(m-1\)) code. When \(r=0\), the RM code becomes a repetitive code, and when \(r=m\), the RM code lacks error correction capability. For RM codes, the decoding processing is similar to repeat codes. Firstly, calculate the likelihood estimate \(L\) for each bit based on Equation (A1). Subsequently, substitute the



## Appendix B Elliptic Curve Cryptography Arithmetic

ECDSA consists of two stages: the signature generation stage and the signature verification stage. The signature generation stage includes one ECSM (\(Q=kP\)), where both \(P\) and \(Q\) are two points over a given elliptic curve, and \(k\) is a scalar. The signature verification stage requires an ECDSM. ECDSM (\(kP+lQ\)) consists of two ECSMs and a point addition (PA). The three-level hierarchy of ECC cryptosystems is illustrated in Figure 11. Both ECSM and ECDSM can be computed by calculating PA and point doubling (PD) iteratively. PA (\(P_{PA}=P_{1}+P_{2}\)) and PD (\(P_{PD}=2P_{1}\)) are defined geometrically by the chord-and-tangent rule over finite fields. Due to the carry-free property, the arithmetic over binary finite fields \(GF(2^{m})\) is more suitable for hardware implementation. Over \(GF(2^{m})\), a non-supersingular elliptic curve \(\mathbb{E}\) is defined as shown in Equation (1) with parameters \(a\) and \(b\). \[\mathbb{E}:y^{2}+xy=x^{3}+ax^{2}+b. \tag{12}\]

Given \(P_{1}=(x_{1},y_{1})\) and \(P_{2}=(x_{2},y_{2})\), PA and PD are as follows:

\[P_{PA}(x_{PA},y_{PA})=P_{1}+P_{2}=\left\{ \begin{array}{l}x_{PA}=\lambda^{2}+ \lambda+x_{1}+x_{2}+a\\ y_{PA}=\lambda(x_{1}+x_{PA})+x_{PA}+a\end{array} \right. \tag{13}\]

\[P_{PD}(x_{PD},y_{PD})=2P_{1}=\left\{ \begin{array}{l}x_{PD}=\gamma^{2}+\gamma +a=x_{1}^{2}+\frac{b}{x_{1}^{2}}\\ y_{PD}=x_{1}^{2}+\gamma x_{PD}+x_{PD}\end{array} \right. \tag{14}\]

where \(\lambda=\frac{y_{1}+y_{2}}{x_{1}+x_{2}}\) and \(\gamma=x_{1}+\frac{y_{1}}{x_{1}}\). Note that the result of the \(x\)-coordinate in PD can be further simplified as \(x_{1}^{2}+\frac{b}{x_{1}^{2}}\), which is an intrinsic property of the elliptic curve over \(GF(2^{m})\). If we introduce the differential addition chain (DAC) to guarantee the relation \(P_{2}=P_{1}+P\) in the iteration, then the expression of PA can be further simplified as \(x_{3}=x+\left(\frac{x_{1}}{x_{1}+x_{2}}\right)^{2}+\frac{x_{1}}{x_{1}+x_{2}}\), and the derivation is shown below. From Equation (2), we have

\[x_{PA}=\frac{x_{1}y_{2}+x_{2}y_{1}+x_{1}x_{2}^{2}+x_{1}^{2}x_{2}}{x_{1}^{2}+x_ {2}^{2}} \tag{15}\]

by simplifying the numerator with \(2b=2y^{2}+2 xy+2x^{3}+2 ax^{2}\), since the items with even coefficients can be eliminated over \(GF(2^{m})\). With the relation \(P=P_{2}-P_{1}\), we can obtain \(-P_{1}=(x_{1},x_{1}+y_{1})\).