# Barrel Shifter Physical Unclonable Function Based Encryption
## 3 Block Encryption Protocol
### Asymmetric Encryption
#### 3.2.1 Revised Asymmetric Encryption  
In order to ensure the correct routing and commutativity, we modify the original permutation protocol by adding a permutation after each PUF. The primary function of this permutation is routing \(x_{i}\) back to the \(i\)th position from position \(\pi_{key_{1}}(i)\) before sending the message at the end of Step 1. The complementary key, \(\overline{key_{1}}\), that results in the permutation \(\pi_{key_{1}}^{-1}\) is used; it routes bits back to their original position. Mathematically, \((\pi_{key_{1}}\circ(\pi_{key_{1}}=\pi_{key_{1}}^{-1}))=1\) where \(1\) is the identity permutation. Bit shifting to restore the original message bit order is the only function of this permutation. No delay is added. An example of this protocol is shown in Figure 5 with the following detailed description:  
* **Step 1:**\(f_{Bob}\) permutes \(x_{0},x_{1},x_{2},x_{3}\) as in \((1,2,3,0)(x_{0},x_{1},x_{2},x_{3})\). It computes the physical delay encrypted bit vector, \((x_{3}\oplus D(3,0)_{m},x_{0}\oplus D(0,1)_{m},x_{1}\oplus D(1,2)_{m},x_{2} \oplus D(2,3)_{m})\). Before sending it to [PERSON], [PERSON]'s complementary permutation, called permutator in Figure 5 is applied to generate \((x_{0}\oplus D(0,1)_{m},x_{1}\oplus D(1,2)_{m},x_{2}\oplus D(2,3)_{m},x_{3} \oplus D(3,0)_{m})\). In this new permutation protocol, the logical permutation adds no confusion unlike the permutations in AES and Keccak protocols. Confusion is achieved by the permuted physical delay properties of the PUF. Which path delay bits are combined with each input bit is hidden (through confusion) from the adversary through \(key\) driven \(\pi\). * **Step 3:**\(f_{Alice}\) is applied as \((2,3,0,1)(x_{0}\oplus D(0,1)_{m},x_{1}\oplus D(1,2)_{m},x_{2}\oplus D(2,3)_{m},x_{3}\oplus D(3,0)_{m})\), resulting in \((x_{2}\oplus D(2,3)_{m}\oplus d(2,0)_{m},x_{3}\oplus D(3,0)_{m}\oplus d(3,1)_{ m},x_{0}\oplus D(0,1)_{m}\oplus d(0,2)_{m},x_{1}\oplus D(1,2)_{m}\oplus d(1,3)_{m})\). Applying [PERSON]'s complementary permutation results in \((x_{0}\oplus D(0,1)_{m}\oplus d(0,2)_{m},x_{1}\oplus D(1,2)_{m}\oplus d(1,3)_{ m},x_{2}\oplus D(2,3)_{m}\oplus d(2,0)_{m},x_{3}\oplus D(3,0)_{m}\oplus d(3,1)_{ m})\). * **Step 5:** Apply \(f_{[PERSON]}^{-1}\) to \((x_{0}\oplus D(0,1)_{m}\oplus d(0,2)_{m},x_{1}\oplus D(1,2)_{m}\oplus d(1,3)_{ m},x_{2}\oplus D(2,3)_{m}\oplus d(2,0)_{m},x_{3}\oplus D(3,0)_{m}\oplus d(3,1)_{ m})\). Decryption follows a similar process. However, the direction of message transmission is reversed and the inverse permutations are used. Physical invertibility recovers the original forward delay vector in the reverse direction. Figure 4: **(1) [PERSON] applies \(f_{[PERSON]}\) and (2) sends the result to [PERSON]. (3) [PERSON] applies \(f_{[PERSON]}\) and (4) sends the result to [PERSON]. (5) [PERSON] applies \(f_{[PERSON]}^{-1}\) and (6) returns the result to [PERSON]. (7) [PERSON] applies \(f_{[PERSON]}^{-1}\) hoping to recover the message. Unfortunately, \(f^{-1}\) does not subtract delay from the correct bit in (5,7); the correct message is not received by [PERSON]. This scheme fails to be commutative. **Thus, \((1,2,3,0)(2,3,0,1)(x_{0},x_{1},x_{2},x_{3}))\) is rearranged by [PERSON]'s permutator first. This is \((x_{3}\oplus D(3,0)_{m}\oplus d(3,1)_{m},x_{0}\oplus D(0,1)_{m}\oplus d(0,2)_{m}, x_{1}\oplus D(1,2)_{m}\oplus d(1,3)_{m},x_{2}\oplus D(2,3)_{m}\oplus d(2,0)_{m})\). This rearranged result is given to to \(PUF_{1}\) resulting in \((x_{0}\oplus D(0,1)_{m}\oplus d(0,2)_{m}\oplus D^{{}^{\prime}}(0,1)_{m},x_{1} \oplus D(1,2)_{m}\oplus d(1,3)_{m}\oplus D^{{}^{\prime}}(1,2)_{m},x_{2}\oplus D (2,3)_{m}\oplus d(2,0)_{m}\oplus D^{{}^{\prime}}(2,3)_{m},x_{3}\oplus D(3,0)_{m} \oplus d(3,1)_{m}\oplus D^{{}^{\prime}}(3,0)_{m})\). Transmission gates show symmetric delays for forward and backward paths; \(D(i,j)\) always equals \(D^{{}^{\prime}}(i,j)\). Thus, the delay terms cancel.