# Barrel Shifter Physical Unclonable Function Based Encryption
## 3 Block Encryption Protocol
### Asymmetric Encryption  
Encrypting without a shared key is ideal. In the first version of the design, each PUF \(f_{PUF_{1}}\) and \(f_{PUF_{2}}\) is a permutation network keyed by \(key_{1}\) and \(key_{2}\), respectively. Key \(key_{1}\) selects a permutation \(\pi_{key_{1}}\) from a large set of possible permutations--Keccak permutation [20; 21] could be used for instance. The implementation, however, needs to be physically and logically reversible consisting of transmission gates. We assume that, for a permutation \(\pi_{key_{1}}\) which maps \(i\)th input bit to the \(i\)'th output bit and \(j\)th input bit to \(j\)'th output bit, we capture the exact delays for each input-output path. Let \(D(i,i^{{}^{\prime}})\) denote the delay of the path from input \(i\) to output \(i^{{}^{\prime}}\) for \(\pi_{key_{1}}\) in \(f_{PUF_{1}}\). Let \(D(j,j^{{}^{\prime}})\) be defined likewise. We will describe how we can capture these delays by using timer capture and edge detector functions in Section 5. For each PUF, the output bit \(y_{i}\) can be expressed as an entanglement function \(e(x_{\pi_{key}^{-1}(j)},D(\pi_{key}^{-1}(j),j))\). Here, \(e\) is an entanglement function between the input bit \(x_{\pi_{key}^{-1}(j)}\) routed to output \(j\) and the delay of this path from \(\pi_{key}^{-1}(j)\) to \(j\). The delay \(D(\pi_{key}^{-1}(j),j)\) can be quantized to any resolution of \(k\) bits. If we use all of the \(k\) bits of \(D(\pi_{key}^{-1}(j),j)\) to do encryption at the \(j\)th output bit, we expand the \(n\)-bit input to an \(nk\)-bit output. Assuming we want to retain the same output resolution of \(n\)-bits, one option would be to perform an XOR (\(\oplus\)) of the \(m\)th bit of \(D(\pi_{key}^{-1}(j),j)\) with the input bit \(x_{\pi_{key}^{-1}(j)}\) to generate \(y_{j}\) leading to the entanglement function \(y_{j}=e(x_{\pi_{key}^{-1}(j)},D(\pi_{key}^{-1}(j),j)_{m})\). XOR is a good choice because it is commutative and associative. Figure 3 shows a encryption flow chart using XOR as the entanglement function. Since the least significant bit (LSB) and 2 nd LSB of \(D(\pi_{key}^{-1}(j),j)\) is likely least correlated with the delay of other paths, we have used them in entanglement. The corresponding simulation results are shown in Section 6. Let us assume that the delays of the permutation function \(\pi_{key_{1}}\) in \(f_{PUF_{1}}\) are denoted by \(D(\pi_{key_{1}}^{-1}(j),j)\) for a path from input \(\pi_{key_{1}}^{-1}(j)\) to output \(j\) and the delays of the permutation function \(\pi_{key_{2}}\) in \(f_{PUF_{2}}\) are denoted by \(d(j,\pi_{key_{2}}(j))\) for a path from input \(j\) to output \(\pi_{key_{2}}(j)\). Assume that \(\pi_{key_{1}}^{-1}(j)=i\), \(\pi_{key_{2}}(j)=k\); then, the output \(z_{k}=(x_{i}\oplus D(i,j)_{m})\oplus d(j,k)_{m}\) is generated. The \(m\)th least significant bit of \(PUF_{2}\)'s delay captured by the \(d\) function is XORed with \(f_{PUF_{1}}\)'s output. Clearly, the RHS of expression \(z_{k}=(x_{i}\oplus D(i,j)_{m})\oplus d(j,k)_{m}\) is commutative due to commutativity of operator \(\oplus\)--it does not matter whether \(f_{PUF_{1}}\) is applied first or \(f_{PUF_{2}}\) is applied first. However, this commutativity statement is only correct for a specific bit routing; it does not apply to encrypted data. In the following examples, we use a \"shift\" function instead of an arbitrary permutation. A \"shift\" function is denoted as \(\pi=(i_{0},i_{1},\ldots,i_{n-1})\), which means that bit 0 goes to bit position \(i_{0}\) or \(0\mapsto i_{0}\); \(1\mapsto i_{1};\ldots;(n-1)\mapsto i_{n-1}\). For [PERSON]'s PUF, with permutation \(\pi=(i_{0},i_{1},\ldots,i_{n-1})\), the delay for a path from input bit position \(l\) to output bit position \(i_{l}\) (\(l\mapsto i_{l}\)) is quantized as \(D(l,i_{l})\). The \(m\)th bit of this quantized delay is denoted as \(D(l,i_{l})_{m}\). Similarly, for [PERSON]'s PUF, with permutation \(\pi^{\prime}=(j_{0},j_{1},\ldots,j_{n-1})d(l,j_{l})_{m}\) represents the \(m\)th bit of the quantized delay for path \(l\mapsto j_{l}\).