# A Unified PUF and Crypto Core Exploiting the Metastability in Latches
## 2 Transport Layer Security  
Transport Layer Security (TLS) is used in end-to-end connections for computer networks, providing the cyber security requested by websites, as shown in Figure 1. TLS version 1.2 [34] showed an increase in the percentage of use in websites from 2016 to 2021. However, the new release of TLS was published in 2018, removing some insecure ciphers. TLS 1.3 [30] reported a five times greater amount of usage in the last year, demonstrating the relevance of the new approach. In addition, ChaCha20 is introduced in this TLS version, providing a different solution than a cipher based on AES. The new authenticated encryption with additional data (AEAD) is constructed with ChaCha20 and Poly1305 primitives for cipher and message authentication codes, respectively.  
Figure 2 illustrates a typical TLS handshake procedure. The handshake describes the series of steps for exchanging information between a _client_ and a _server_. The handshake sends a _client hello_ to the _server_, including the TLS version, the cipher suites, and the supported client public key. Next, the server sends a _server hello_ with a certificate and cipher suites selected in response to the _client hello_. The _client_ verifies the certificate provided by the _server_, authenticating the owner of the domain. Finally, the _server_ decrypts  
the _master_ key provided by the _client_, establishing a secure symmetric encryption. The data are exchanged using the AES-GCM, AES-CCM, or ChaCha20-Poly1305 defined in the cipher suites used in the hello process.  
Figure 3 shows the ChaCha20-Poly1305 AEAD procedure. The procedure starts with the generation of the one-time key (OTK) used in the Poly1305 message authentication code (MAC) process of the AEAD. Conventionally, ChaCha20 generates an OTK using the values of the key and nonce with a counter and plaintext initialized in zero. In addition, the OTK can also be created using a linear-feedback shift register (LFSR) [35]. Next, the additional authenticated data (AAD) with an arbitrary length is introduced in the Poly1305. Then, the encryption/decryption process is applied to the _plaintext_ or _ciphertext_. However, sometimes the _plaintext_ or _ciphertext_ in step 3 is not a full block with 512 bits, requiring  
Figure 1: Percentage of use of Transport Layer Security version 1.2 and 1.3 in websites [32].  
Figure 2: Transport Layer Security 1.3 handshake protocol [32].  
an output filter in the ChaCha20. When the encryption/decryption process is finished, a final block is introduced in Poly1305, containing the lengths of data processed and the introduced AAD. Finally, the MAC is generated.  
Figure 4 illustrates the typical and proposed PUF-based OTK generation. The proposed OTK generation uses a PUF unified with a crypto core, obtaining the counter's initial value. In the proposed OTK generation, the ChaCha20 takes the key, nonce, zero-initialized _plaintext_ and the counter value obtained in the PUF response, mitigating the potential risks caused by the initial value change in the counter in the zero-initialized counter. After 20 rounds of ChaCha20, the first 256 bits of the _CipherText_ is the OTK.