# Key Recovery for Content Protection Using Ternary PUFs Designed with Pre-Formed ReRAM
## 5 Implementation with SRAM and ReRAM Devices
### Comparative Analysis of SRAM versus ReRAM Schemes  
SRAM PUFs are widely available, cheap, easy to use, and fast [43]. This is a perfect technology to use to implement the methods presented in this paper, namely, key recovery, content delivery, and digital file protection. SRAM PUFs are a perfect fit for a range of applications that are not directly exposed to side-channel attacks, and applications where the risk of the device being infiltrated by an opponent, is low. Examples of areas of application include the protections of the IoTs at home, in the office, and in other areas that are relatively safe. One of the tradeoffs of using SRAM PUFs is the additional cost of enrollment that is needed to operate at low BER. The repetitive power off/on cycles are time-consuming. A remedy for this is to use powerful error-correcting schemes and to accept higher BERs. The ReRAM technology is not yet as pervasive as SRAMs; however, its potential to design tamper-resistant solutions is observable, particularly in the pre-forming  
Figure 12: The size of the buffer (\(\gamma\)-axis) that is required to produce a BER at 1 ppm for 256-bit long keys generated from a pair of ReRAM circuits. The lowest buffer is observed with currents of 800 nA, from 0 \({}^{\circ}\)C to 80 \({}^{\circ}\)C (\(X\)-axis). In this case, 288 cells are required to produce a 256-bit long key with BER at 1 ppm. Figure 13: Modelling the time in days to complete the crypto-analysis of pairs of ReRAM devices. The time to completion increases exponentially, proportional to the size of the array and to the number of possible injected currents. range. A comparison between the two technologies, based on the analysis presented in this section, is summarized in Table 2.
* Entropy: number of cells or pairs: The entropy of SRAM-based cryptosystems is proportional to the size of the array; however, the cost of enrollment also increases at the same rate. The differential protocol comparing the resistance value between the cells belonging to small 4 Kb ReRAM arrays involves 16 million possible pairs. With 8 different levels of possible currents, as tested in this study, the number of possible pairs reach 126 M. This number is scaled linearly by increasing the number of levels of current and with the square of the size of the array. * Bit error rates of the responses: The BERs of SRAM PUFs are reduced by increasing the number of power off/on cycles at different temperatures. As shown in Figure 10, BERs in the 2 \(10^{-6}\) range is possible at a cost of enrollment cycles lasting multiple hours, which lacks practicality. Conversely, the way to reduce the BERs of two ReRAM arrays, driven by the differential protocol, is to increase the size of the buffer, which does not require longer enrollment times. Considering the difficulty in quantifying extremely low BERs, an extrapolation of the data reported in Figure 12, points to BERs in the \(1\,10^{-8}\) range, with buffer sizes large enough and with the appropriate screening of unstable cells. * Enrollment cycles: One of the values of the differential protocol is to cut the enrollment time. There is no need to test the pairs of ReRAM cells upfront during enrollment, testing each array thoroughly is enough to generate the initial response from a look-up table. In the analysis performed in this study, eight thousand cells were tested during the enrollment of 15 min, rather than the 128 million possible pairs. The measurement of the resistance of a cell is analog; therefore, unlike reading an SRAM cell, there is no need to repeat the measurements to quantify the proportion of \"0\" or \"1\". * Response cycles: Generating responses from the SRAM PUF is extremely fast after powering on the device. Minimizing latencies of the response generation of pre-formed ReRAM PUF has been a challenging task due to the high resistance values that could reach 10 M\(\Omega\). In the differential protocol, there is no need to measure these values, the only information needed is to find which cell has the higher resistance value of the two.