# Secure ECDSA SRAM-PUF Based on Universal Single/Double Scalar Multiplication Architecture
## 3 The Proposed Secure SRAM-PUF Scheme Based on Custom ECDSA
### The Proposed Secure SRAM-PUF Scheme  
The proposed secure SRAM-PUF scheme is illustrated in Algorithm 2. Considering the utilization of ECDSA to safeguard the error probability signature in the ROM, all error probabilities can be signed as a message during the registration stage. The algorithm of the ECDSA-PUF in the registration phase closely resembles the auxiliary data soft-decision algorithm. However, in addition to calculating \(w\) and \(P\), it also necessitates completing the ECDSA signature. ```
0: SRAM, a private key \(d\), a public key \(H\), and the order of the elliptic curve \(n\). 0: A stable SRAM-PUF response \(y\). 1: Registration stage:
2:for\(j=0\) to \(100\)do
3: SRAMs power on to obtain one \(y_{j}\);
4:endfor
5: SRAMs power on to obtain \(y\);
6:for\(j=0\) to \(100\)do
7:for\(i=0\) to \(Bit\_Length(y)\)do
8:if\(y[i]\
eq y[i]\)then
9:\(P_{i}=P_{i}+1\);
10:endif
11:endfor
12:endfor
13: Choose one RM code \(c\);
14:\(w=c\oplus y\);
15:\((x_{p},s^{-1}(mod\ n))=cusECDSA\_SIG(d,\{P,w\})\);
16:\((X,Z)=cusECDSA\_VER(d,m,x_{p},NULL,s^{-1}(mod\ n))\);
17:\(x_{p}Z=x_{p}\times Z\ mod\ p\);
18: Save \(w\), \(P\), \(x_{p}Z\), \(s^{-1}\) to the ROM;
19: Recovery stage:
20:\(x_{p}Z=Bit\_Extension(x_{p}Z)\);
21:\(w^{\prime}=w\oplus x_{p}Z\);
22: SRAMs power on to obtain \(y^{\prime}\);
23:\(c^{\prime}=w\oplus y^{\prime}\oplus x_{p}Z\);
24:\(c=RM\_Decode(c^{\prime},P)\);
25:\((X,Z)=cusECDSA\_VER(d,m,x_{p},x_{p}Z,s^{-1}(mod\ n))\);
26:\(X=Bit\_Extension(X)\);
27:\(y=c\oplus w\oplus X\). ```  
**Algorithm 2** The Proposed Secure SRAM-PUF Scheme  
**Return:**\(y\). Once the signature is completed, the signatures are stored in the ROM. During the recovery phase, the RM code soft judgment is performed, as well as the ECDSA verification. If the verification fails, the RM code soft judgment PUF output becomes invalid. However, directly verifying the data in the ROM and using a single-bit signal to determine whether the verification passes poses a problem. This single-bit signal line directly influences the generation of SRAM-PUF, which is crucial in the circuit. Therefore, if an attacker locates this single-bit signal in the netlist or circuit layout and modifies it, the ECDSA signature verification attack can be executed, thus altering the validity of the PUF. To prevent the single-bit signal from determining the security of the entire chip, we integrate multi-bit signals throughout the algorithm. Only if the signature is verified can the correct SRAM response be obtained. Once any value in the ROM is changed, the verification will not pass, which cannot get the internal values to generate the correct response. As the ECDSA-PUF's signature and verification are \"self-signed and self-verified\" as initiated by the designer, a simpler ECDSA protocol can be customized to further expedite ECDSA-PUF by omitting the time-consuming part of signature verification. Hence, the acceleration speed of the PUF is boosted. The content of the custom ECDSA protocol will not be disclosed to the public, thereby increasing the difficulty for attackers. Consequently, we propose a custom ECDSA signature \(cusECDSA\_SIG\) and verification \(cusECDSA\_VER\). In the standard ECDSA, we calculate \(x_{p}\) and compare it with the signature \(r\). However, in the proposed custom cases, we calculate \(X\) and compare it with \(x_{p}Z\pmod{n}\). Hence, the time required for modular inversion is saved. In the registration phase, power-on and power-off cycles are repeated to tally the error probability \(P\) and calculate the auxiliary data \(w\). Subsequently, the custom signature function (Algorithm A6) is executed on \(P\) and \(w\). Two distinctions exist between this function and the standard ECDSA signature. First, the signature \(s\) needs to calculate the modulo inverse \(s^{-1}\pmod{n}\). This calculation occurs in the registration phase and is conducted by computers, not during chip hardware calculation in the recovery phase. Hence, this part's calculation is completed before leaving the factory and does not impinge on PUF generation time.