Extensive Examination of XOR Arbiter PUFs as Security Primitives for ResourceConstrained IoT Devices Communication security is essential for the proper functioning of the Internet of Things. Traditional approaches that rely on cryptographic keys are vulnerable to sidechannel attacks. Physical Unclonable Functions (PUFs), leveraging unavoidable and irreproducible variations of integrated circuits to produce responses unique for individual PUF devices, are emerging as promising candidates as security primitives to provide keyless solutions. Before a PUF can be adopted for real applications, the PUF must be thoroughly examined to understand its various properties for its application feasibility. In this paper, we study XOR PUFs for broad ranges of values for circuit architecture parameters. XOR PUFs have been extensively studied, and have been shown to be unable to withstand machine learning attacks for 64bit XOR PUFs with less than ten component PUFs. Attack methods employed in existing studies need a large number of challengeresponse pairs (CRPs), which are obtainable only if the PUF has an open access interface. When PUFembedded devices equipped with mutual authentication or response obfuscating techniques, it is difficult for attackers to accumulate large numbers of CRPs. With only a small number of accumulated CRPs available to attackers, small size PUFs, like XOR PUFs with a small number of component PUFs and stages, may become resistant to machine learning attacks. Since smaller sizes mean less resourcedemanding, it is worthwhile to examine such PUFs which have usually been considered unsafe against attacks. Such are thoughts that have been motivating us in this paper to explore the PUF performances for a wide range of values of the PUF architecture parameters.

An Obfuscated Challenge Design for APUF to Resist Machine Learning Attacks Physical unclonable function (PUF) has emerged as a lightweight hardware security primitive for resource constrained devices. The arbiter PUF (APUF) is a typical kind of strong PUF. However, conventional APUF is vulnerable to machine learning (ML) attacks. In this paper, we propose an obfuscated challenge design for APUF (OCAPUF), which exchanges the bit positions in the challenge according to our design rules. The subsequent recovery of the obfuscated challenge by a recovery circuit is guaranteed. Then the corresponding response is produced by the APUF with the real challenge. The goal is to obscure the direct relationship between challenges and responses to prevent ML attacks. Most importantly, the unclonability of the APUF is preserved, and there is almost no increase in hardware complexity while still maintaining a high level of security. Experiment results show that 64bit APUF with obfuscated challenge can resist ML attacks with a maximum prediction rate of 60% using the logistic regression (LR) strategy.