## 5 Security Analysis
### Discussion on Security Threats  
In the past few years, many PUF designs have been successfully attacked using machine learning (ML) techniques. Thereby, attackers focus on strong PUFs offering a large CRP space [34; 35; 36]. The goal of the attackers is to construct a mathematical clone which behaves like the original PUF. CRPs are eavesdropped during normal operation of the PUF to gather a data basis for model training. However, a full readout of a strong PUF is often not possible due to the huge CRP space. Therefore, the goal is that only a subset of the CRP space must be eavesdropped and is sufficient to gain a trained model that is highly predictive in terms of estimating other not yet occurred CRPs.  
From an attacker's point of view, the herein presented analog PUF is comparable to the ring oscillator architecture, due to their similarities of the internal pairwise selection circuitry and bit generation. In the presented configuration, our design forms a weak PUF with just a single CRP. In general, applying modeling attacks is not applicable in the context of weak PUFs, since the data basis for model training is small. For that reason, a full readout of the PUF is more appropriate.  
With regard to cryptographic key derivation, the uniformity of the PUF response bits is connected with the unpredictability of the responses. If the PUF response bits are biased towards 0 or 1, it is easier for an attacker to guess the response. In general, the assumed distributions of noise and PUF responses is often normal rather than uniform [37]. This connotes a potential security threat for the herein proposed analog PUF. To counter this issue, fuzzy extractors can be used to generate unique keys suitable for cryptographic applications [38; 39]. To protect the challenge and response interfaces from the outside world, weak PUFs are often surrounded by additional obfuscation logics such as hash functions. This configuration is often referred to as controlled PUF [40]. Figure 11 shows how to turn the proposed weak PUF into a controlled PUF environment, also including a fuzzy extractor to generate stable and uniform keys, e.g., for cryptography.  
However, when scaling up the herein presented analog PUF circuit, the CRP space can also be increased and the PUF becomes a candidate for a strong PUF design. As a consequence, the investigation of modeling attacks becomes more attractive to spot vulnerabilities towards the PUF's unpredictability and physical unclonability. In this context, commonly used attack scenarios come into account, such as side-channel attacks to eavesdrop CRPs [41]. In the next step, these CRPs can be used to train a mathematical model of the PUF's internal behavior using machine learning techniques. Another option is to create a sorted list of PUF core inverter output voltages, similar to the approach proposed for RO-PUFs by [PERSON] et al. in [42].  
In this paper, the focus lies on the design, fabrication, and evaluation of an analog PUF platform. Therefore, performing and discussing modeling attacks on the presented analog PUF design in more detail will be part of our future work.  
Figure 11: Exemplary controlled PUF environment to obfuscate the PUF interfaces. An integrated fuzzy extractor ensures stable and uniform PUF keys.