# Phase Calibrated Ring Oscillator PUF Design and Application
## 3 RO PUF Improvement and Implementation on FPGAs
### RO PUF Design Improvement  
While PUFs have been primarily targeted towards Application-Specific Integrated Circuits (ASIC) designs, in this paper, we explore their potential on FPGAs. According to our tests on the Kintex-7 FPGA [13], the frequency of a five-stage inverter chain RO is approximately 475 MHz when the system clock is 200 MHz. In the crossing timing domain between the ROs and PUF control logic circuit, a high RO frequency adds to the instability of measurements. As with all oscillators, the rate of oscillation is determined by the length of a delay implemented in a loop. Thus, to reduce the frequency, more inverters can be added in the ROs, but this requires more hardware resources. In this work, we choose a design that takes advantage of the Lookup Tables (LUTs) of the Configurable Logic Blocks (CLBs) and the general purpose interconnect [14] on the FPGA. As shown in Figure 2, the first part consists of a four-LUT delay and a one-LUT inverter. The reset signal is to control the enable timing of all LUTs. In the second part, a single inverter in the loop implements a high gain inverting amplifier. The output frequency is divided by two in order to eliminate output glitches. Overall, this architecture only needs six LUTs and a D-type Flip-flop (FD). In order to generate variable length responses, we choose a design as shown in Figure 3. This example uses 128 ROs to provide 128-bit CRPs. Once a challenge is received, it is stored in a shift register. We select the first seven bits from the register as the input of the upper decoder and MUX in order to select an RO from the array. Likewise, another RO is selected using the next seven bits from  
Figure 2: The RO architecture for an FPGA implementation. FD, D-type Flip-flop. the challenge shift register. If the addresses are the same, the second seven-bit address is added by one to avoid selecting the same RO for comparison. Next, we shift the challenge register to select a new RO pair. The shift pattern can be complex for security consideration. To make it easy to understand, we shift one bit to the left each time. If the challenge is 128 bits, we can generate a 128-bit response with 127 shift operations. Alternatively, the shift register can be replaced by a non-cryptographic hash function. Compared to cryptographic hash functions, which have one-way, collision resistant and deterministic properties, a non-cryptographic hash function is significantly faster and low cost. It is also easy implement on FPGAs. Algorithm 1 shows the ElfHashexecution progress in our PUF:  
```
1:procedureHash Shift
2:\(hash\gets 0\)
3:\(x\gets 0\)
4:\(count\gets 0\)
5:loop 1:
6:\(hash\leftarrow(h<<4)+challenge\)
7:\(challenge\gets challenge+1\)
8:if\(x=hash\) and \(0 xF000000\)then
9:\(hash\gets hash\) xor (\(x>>24\))
10:\(hash\leftarrow hash\) and (not \(x\))
11:\(count\gets count+1\)
12:if\(count=128\)then goto loop 1. 13:end hash
```  
**Algorithm 1** ElfHash process. In the traditional design, metastability can exist at the input of the counters. This occurs when the counters receive a clock rising edge for comparison. If the RO output happens to flip when a counter value is changing, the result of the comparison will not be larger, smaller or equal, but instead, a metastable state. We have verified this scenario on our FPGA implementations. Because of the metastability, the bit errors in the responses increase. Note that the counters receive RO output in the asynchronous timing, while their enable and disable are controlled by the system clock. Thus, the counter value becomes invalid if the measurement window closes at the input edge. The comparison result thus drops to the metastability state. Our solution is to use two registers to store the counter values. By involving a register that is in the same clock domain with the comparator, the counter can always provide a valid value before comparison. Therefore, the metastability is safely eliminated. Only larger, small and equal states are measured by the comparator.