Entropy Extraction in Metastability-based TRNG Presented by Cheng Chung Wang & Hsi Shou Wu

Outline Background Motivation Implementation and analysis Conclusion Discussion

Background TRNG : True Random Number Generators Entropy : Natural Sources Cosmic rays Stray electromagnetics waves Thermal noise

TRNG Background cont’d Process variation and operating condition will impact the output of TRNG circuits Temperature 1 Fabrication defect TRNG Operating voltage

Background cont’d Bias Removal Techniques Post-processing techniques Calibration techniques

Background cont’d Post-processing techniques XOR Von Neumann corrector (entropy extractor)

Background cont’d Calibration Phase of clock signal Charge injection

Motivation Several proposed biased removal circuit. Which one is the best solution? “Action speaks louder than words”

Implementation and analysis TRNG without correction Advanced technology Technology scale down. Need post-processing or calibration to boost entropy

Implementation and analysis With XOR Depend on the max entropy one 1. A dip in entropy of one of the TRNG will make the output dependent entirely on the other TRNG

Implementation and analysis With Von Neumann corrector Enhance entropy a lot Drawback: 1. not generate at const rate! 2. Effective bit rate decrease with technology scaling

Implementation and analysis TRNG with calibration Tune the driving current/delay…

Implementation and analysis TRNG with calibration Increase entropy but remain const output rate 1. A comparison of the different bias removal techniques is shown in the Fig. 12. As seen from the simulation results, the circuit calibration technique provides significantly better correction in entropy as compared to the XOR function, with increasing device mismatch and improvement comparable to the Von Neumann technique, but at a constant bit rate. 2. Table.2 shows the average energy/bit for the basic TRNG and the different bias removal techniques. Although the XOR function incurs a very small overhead in the form of energy, its inefficiency with increasing variability does not make it a suitable candidate for usage in encryption systems designed in DSM technologies. The Von Neumann corrector maintains the entropy very close to one but at a significant energy cost. With increase in device mismatch more number of TRNG bits is needed per effective random bit generated. Hence, the energy per bit increases. Less energy overhead

Implementation and analysis TRNG with calibration Tradeoff between number of bits entropy and energy consumption 1. Use less bit when no need for such high entropy and to decrease energy consumption

Conclusion 1. Modern security systems need on-chip true random number generators. 2. Conventional post-processing techniques are not efficient for simple TRNG Physical calibration techniques are required . provide a greater flexibility for trading off entropy for energy 1. A comparison of the different bias removal techniques is shown in the Fig. 12. As seen from the simulation results, the circuit calibration technique provides significantly better correction in entropy as compared to the XOR function, with increasing device mismatch and improvement comparable to the Von Neumann technique, but at a constant bit rate. 2. Table.2 shows the average energy/bit for the basic TRNG and the different bias removal techniques. Although the XOR function incurs a very small overhead in the form of energy, its inefficiency with increasing variability does not make it a suitable candidate for usage in encryption systems designed in DSM technologies. The Von Neumann corrector maintains the entropy very close to one but at a significant energy cost. With increase in device mismatch more number of TRNG bits is needed per effective random bit generated. Hence, the energy per bit increases.

Discussion Is the referenced model (dual inverter) representative? Will the results change if we also run Monte Carlo simulation in other parameters (temperature or voltage drop)? Would the area overhead be a huge issue? As technology scaled down, dose the experiment result still make sense? Is bit generation rate a more important issue?