# A Low-Complexity Start-Stop True Random Number Generator for FPGAs
## 1 Introduction  
Random number generators (RNGs) are widely used in many applications [1]. There are two types of RNGs: pseudo-random number generators (PRNGs), which can be described with a deterministic algorithm, and true random number generators (TRNGs), which produce non-deterministic sequences even if the generator's structure is known. Currently, most systems are digital constructions. Therefore, true random number generators are anticipated to be fully digital and integrated into a single chip using a system that utilizes random numbers. This feature is essential for cryptographic systems because it makes it difficult for attackers to retrieve and manipulate the numbers or sequences produced by the TRNG.  
The most popular fully digital TRNG solutions, easily implementable in FPGAs alongside cryptographic systems, rely on jitter or metastable states [2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 26; 27; 28; 29; 30; 31; 32; 33; 34; 35; 36; 37; 38; 39; 40; 41; 42]. However, the primary disadvantage of existing TRNGs is the need for the further processing of output bits due to biased output sequences and strong correlations between adjacent bits. Consequently, random sequences do not generally pass statistical tests from available packages like Statistical Test Suite described in SP 800-22 by NIST [43], TU01 [44], or DieHarder [45]. Such sequences need to be subjected to post-processing transformation(s), which improve the statistical properties but usually decrease the bit rate. Since statistical tests cannot differentiate between deterministic (PRNG) and non-deterministic (TRNG) generators, an additional mechanism is required to verify the source of the output bits. This determination is challenging, as TRNG signals contain both deterministic and non-deterministic components [11; 12; 46]. Thus, before a given solution is accepted as TRNG, we must assess the amount of true randomness. This assessment can be made directly by measuring, e.g., jitter in signals produced by entropy sources, or we can attempt to find another measure. Examples of the first approach are measurements made with an oscilloscope or a dedicated device. The second approach is represented by tests from NIST SP 800-90B [47]. The min-entropy can be estimated for sources with independent bits with an identical distribution IID, and for sources that fail to produce IID output [47]. Estimating the entropy of a noise source from a single, even long, output sequence may result in anoverestimate. To address this, we performed a sequence of restarts and dedicated tests. These ensured that the distribution of samples in a restart sequence was independent of its position within the sequence. Knowledge of one restart sequence should not aid in predicting subsequent sequences [47]. During normal exploitation of a TRNG, health tests should be applied to detect deviations from the intended behavior of the entropy source as quickly as possible and with high probability [47]. General rules concerning the construction of random number generators can be found in SP 800-90C [48].  
This paper proposes a novel method for producing random numbers with TRNG exploiting ring oscillators (ROs) implemented in an FPGA. The generator uses the concept introduced originally by [PERSON] and [PERSON] [8], described more widely in other publications [10; 16]. Our proposition uses only two ROs and additional phase detectors to increase the true randomness harvested from these oscillators. To increase the security of the proposed TRNG, we postulate producing bits on demand, i.e., starting and stopping the work of a TRNG when random bits are needed by a digital system implemented in the same FPGA.  
Section 2 contains a description of the proposed solution. The results of the tests are presented in Section 3. The paper ends with the conclusions in Section 4.