Entropy Estimation of Physically Unclonable Functions via Chow Parameters

TL;DR

This paper estimates the entropy of physically unclonable functions (PUFs) using Chow parameters, extending previous methods to larger systems and providing insights into their security properties.

Contribution

It introduces a novel approach leveraging Chow parameters to estimate PUF entropy for larger systems, up to n=10, improving upon prior estimations.

Findings

Shannon entropy of PUFs is close to the maximum entropy.

Entropy increases quadratically with the number of delay elements.

The method extends entropy estimation to larger PUFs beyond previous limits.

Abstract

A physically unclonable function (PUF) is an electronic circuit that produces an intrinsic identifier in response to a challenge. These identifiers depend on uncontrollable variations of the manufacturing process, which make them hard to predict or to replicate. Various security protocols leverage on such intrinsic randomness for authentification, cryptographic key generation, anti-counterfeiting, etc. Evaluating the entropy of PUFs (for all possible challenges) allows one to assess the security properties of such protocols. In this paper, we estimate the probability distribution of certain kinds of PUFs composed of $n$ delay elements. This is used to evaluate relevant R\'enyi entropies and determine how they increase with $n$. Such a problem was known to have extremely high complexity (in the order of $2^{2^n}$) and previous entropy estimations were carried out up to $n=7$. Making the link with the theory of Boolean threshold functions, we leverage on the representation by Chow parameters to estimate probability distributions up to $n=10$. The resulting Shannon entropy of the PUF is close to the max-entropy, which is asymptotically quadratic in $n$.

Figures

Tables

Table 1. TABLE I: Exact values of H 0 subscript 𝐻 0 H_{0}

$n$	# PUFs	$H_0$ (bits)
1	2	1
2	4	2
3	14	3.8074…
4	104	6.7004…
5	1882	10.8781…
6	94572	16.5291…
7	15028134	23.8411…
8	8378070864	32.9640…
9	17561539552946	43.9974…
10	144130531453121108	57.0001…

Table 2. TABLE II: Confidence intervals at the 95% level for H 1 subscript 𝐻 1 H_{1}                                                                                                                                     (exact values up to n = 4 𝑛 4 n=4 ).

$n$	PUF Sample size	$H_1$ (bits)
1	—	1
2	—	2
3	—	3.6655…
4	—	6.2516…
5	${10}^{10}$	10.0134 – 10.0156
6	${10}^{10}$	15.1903 – 15.1925
7	${10}^{10}$	21.9856 – 21.9879
8	$2\cdot {10}^{10}$	30.5628 – 30.5645
9	$2\cdot {10}^{10}$	41.0367 – 41.0384
10	$3\cdot {10}^{12}$	53.4737 – 53.4740

Table 3. TABLE III: Confidence intervals at the 95% level for H 2 subscript 𝐻 2 H_{2}                                                                                                                                    (exact values up to n = 4 𝑛 4 n=4 )

$n$	PUF Sample size	$H_2$ (bits)
1	—	1
2	—	2
3	—	3.5462…
4	—	5.7105…
5	${10}^{10}$	8.4551 – 8.4568
6	${10}^{10}$	11.5977 – 11.6023
7	${10}^{10}$	14.8819 – 14.89805
8	$2\cdot {10}^{10}$	18.5201 – 18.5753
9	$2\cdot {10}^{10}$	22.0309 – 22.4067
10	$3\cdot {10}^{12}$	25.9070 – 26.1983

Table 4. TABLE IV: Confidence intervals at the 95% level for H ∞ subscript 𝐻 H_{\infty}                                                                                                                                    (exact values up to n = 4 𝑛 4 n=4 )

$n$	PUF Sample size	$H_{\infty }$ (bits)
1	—	1
2	—	2
3	—	3.2086…
4	—	4.5850…
5	${10}^{10}$	6.1006 – 6.1008
6	${10}^{10}$	7.7352 – 7.7354
7	${10}^{10}$	9.4731 – 9.4735
8	$2\cdot {10}^{10}$	11.3020 – 11.3024
9	$2\cdot {10}^{10}$	13.2123 – 13.2132
10	$3\cdot {10}^{12}$	15.1899 – 15.1901

Equations

$$f_x(c)=\mathrm{sgn}(c\cdot x)$$

$$p=\sum _{c\mid f(c)=1}c$$

$$p_i\mathrm{mod}2$$

$$\equiv 2^{n-1}\mathrm{mod}2\equiv 0\mathrm{mod}2.$$

$$\text{smashoperator}[]\sum _{c\mid f_x(c)=1}c=\text{smashoperator}[]\sum _{c\mid f_y(c)=1}c.$$

$$\sum _{\begin{array}{c}c\mid f_x(c)=1,\\ f_y(c)=-1\end{array}}c=\sum _{\begin{array}{c}c\mid f_x(c)=-1,\\ f_y(c)=1\end{array}}c,$$

$$\text{smashoperator}[]\sum _{c\mid f_x(c)\ne f_y(c)}{f}_x(c)c=0.$$

$$\sum _{c\mid f_x(c)\ne f_y(c)}{f}_x(c)c\cdot x=\sum _{c\mid f_x(c)\ne f_y(c)}|c\cdot x|=0$$

$$H_0(n)\le n^2(\forall n\ge 2).$$

$$p_i=\sum _{c\mid f(c)=1}{c}_i\le \sum _{\begin{array}{c}c\mid f(c)=1,\\ c_i=1\end{array}}1\le 2^{n-1}$$

$$H_0(n)>\frac{(n-2{)}^2}{2}(\forall n\ge 2).$$

$$f_{x^{\prime }}(c^{\prime })=\{\begin{array}{ll}{f}_x(c_1,\dots ,c_n)& \text{mbox}if{c}_n=c_{n+1}\\ \mathrm{sgn}({\sum }_{i=1}^n{c}_i{x}_i-2c_n{x}_{n+1})& \text{mbox}otherwise.\end{array}$$

$$H_0(n)>\frac{(n-1)(n-2)}{2}+H_0(2)>\frac{(n-2{)}^2}{2}.$$

$$p_i=\sum _{c\mid f(c)=1}{c}_i=|E_i^{+}|-|E_i^{-}|.$$

$$\varphi (c{)}_j=\{\begin{array}{ll}{c}_j,& j\ne i\\ -c_j,& j=i\end{array}$$

$$\sum _{j=1}^n\varphi (c{)}_j{x}_j$$

$$=\underset{>0}{\underbrace{\sum _{j=1}^n{c}_j{x}_j}}+\underset{\ge 0}{\underbrace{2x_i}}>0.$$

$$p_j-p_i$$

$$=2\sum _{c\mid f(c)=1,c_j=-c_i}{c}_j$$

$$=2\sum _{c^{\prime }\mid f^{\prime }(c^{\prime })=1}{c}_j^{\prime }=2p_j^{\prime }\ge 0.$$

$$G_n=S_n\times \{-1,+1{\}}^n$$

$$(g\cdot x{)}_i=s_i{x}_{\sigma (i)}.$$

$$({\sigma }_1,s^1)\cdot ({\sigma }_2,s^2)=({\sigma }_1\circ {\sigma }_2,(s_i^1{s}_{{\sigma }_1(i)}^2{)}_i).$$

$$({\sigma }_1,s^1)\cdot (({\sigma }_2,s^2)\cdot x)$$

$$=(s_i^1{s}_{{\sigma }_1(i)}^2{x}_{{\sigma }_1({\sigma }_2(i))}{)}_i$$

$$=({\sigma }_1\circ {\sigma }_2,(s_i^1{s}_{{\sigma }_1(i)}^2{)}_i)\cdot x$$

$$=(({\sigma }_1,s^1)\cdot ({\sigma }_2,s^2))\cdot x.$$

$$g\cdot f_x=f_{g\cdot x}.$$

$$\sum _{c\mid f_{g\cdot x}(c)=1}{c}_i$$

$$=\sum _{c\mid f_x(c)=1}{s}_i{c}_{\sigma (i)}=s_i{p}_{\sigma (i)}=(g\cdot p{)}_i.$$

$$|\operatorname{Orb}(f)|=2^{n}n!\Bigl{(}2^{m_{p}(0)}\prod_{k\in\mathbb{Z}}{m_{p}(k)!}\Bigr{)}^{-1}.$$

$$|\mathrm{Orb}(f)|=\frac{|G_n|}{|\mathrm{Stab}(f)|}=\frac{|\{\pm 1{\}}^n|\times |S_n|}{|\mathrm{Stab}(f)|}=\frac{2^{n}n!}{|\mathrm{Stab}(f)|}$$

$$p_1\ge p_2\ge \cdots \ge p_n\ge 0.$$

$$x_1^{\prime }\ge x_2^{\prime }\ge \dots \ge x_n^{\prime }\ge 0.$$

Full text

In this paper, we estimate the probability distribution of certain kinds of PUFs composed of $n$ delay elements. This is used to evaluate relevant Rényi entropies and determine how they increase with $n$. Such a problem was known to have extremely high complexity (in the order of $2^{2^{n}}$) and previous entropy estimations were carried out up to $n=7$. Making the link with the theory of Boolean threshold functions, we leverage on the representation by Chow parameters to estimate probability distributions up to $n=10$. The resulting Shannon entropy of the PUF is close to the max-entropy, which is asymptotically quadratic in $n$.

I Introduction

Physically unclonable functions, or PUFs, are electronic devices that are used to produce unique identifiers. Small variations of the manufacturing process are exploited so that any two devices, built according to the same description, will likely produce different identifiers. Moreover, since such process variations are intrinsically random, they cannot be controlled to replicate the behavior of another device, hence the name physically unclonable functions. PUFs find many applications: the identifier can be used to generate a unique cryptographic key, which cannot be easily extracted from the device; it can be recorded during manufacturing into a whitelist to prevent counterfeiting or overproduction; and it can also be employed in the implementation of challenge-response protocols at a low cost. This is especially valuable on devices where implementing asymmetric cryptography primitives is too computationally expensive.

There are several ways to build PUFs. SRAM-PUFs [1] exploit the states of SRAM cells after powering up, while ring-oscillator (RO) PUFs [2] exploit delay differences of signals in electronic circuits. In this paper, we analyze another delay PUF, called loop-PUF, first proposed in [3]. Our analysis will also be valid for the RO-sum PUF [4], which shares essentially the same mathematical model, as well as the arbiter PUF [5]. In the remainder of this paper, we will write PUF as a short-hand for loop-PUF, RO-sum PUF or arbiter PUF.

I-A Modelization and Notations

A PUF of size $n$ generates one identifier bit, or response bit, when queried with a challenge $c=(c_{1},\ldots,c_{n})\in\left\{\pm 1\right\}^{n}$, a sequence of $n$ values $+1$ or $-1$. The PUF is characterized by $n$ weights, denoted by $x=(x_{1},\ldots,x_{n})\in\mathbb{R}^{n}$ that represent delay differences of the PUF circuit. As explained in [6], for each challenge $c\in\left\{\pm 1\right\}^{n}$, the response bit of the PUF of parameters $x=(x_{1},\ldots,x_{n})$ is equal to $\operatorname{sgn}(c\cdot x)=\operatorname{sgn}(c_{1}x_{1}+\cdots+c_{n}x_{n})\in\left\{\pm 1\right\}$.

The base for all logarithms in this paper is equal to $2$, and all entropies are given in bits.

Due to manufacturing process variations, the weights $x_{i}$ are modeled as realizations of random variables $X_{i}$. In [6], a Gaussian model was analyzed, where the Gaussian nature of the variables $X_{i}\sim\mathcal{N}(0,1)$ is justified by simulations of process variations in electronic circuits [7].

More generally, our analysis is valid for any $X=(X_{1},X_{2},\ldots,X_{n})$ whose components $X_{i}$ are i.i.d. continuous variables with symmetric densities about [math] (whose support contains [math]). The i.i.d. assumption is justified by the fact that delays are caused by “identical” circuit elements that lie in different locations in the circuit and can, therefore, be considered independent. In particular, each $x_{i}$ is the difference between two delays caused by such “identical” independent elements, which justifies the symmetry assumption. Simulations in Section V will be made in the Gaussian model, for which the weight distribution is centered isotropic.

I-B Problem Statement

The security of PUFs is related to Rényi entropies $H_{\alpha}$ of various orders $\alpha$ [8].

The min-entropy $H_{\infty}=\log(1/P_{\max})$ is related to the maximum (worst-case) probability $P_{\max}$ of successfully cloning a given PUF. Therefore, min-entropy $H_{\infty}$ should be as large as possible to ensure a given worst-case security level.

The collision entropy $H_{2}=\log(1/P_{\text{eq}})$ is related to the average probability $P_{\text{eq}}$ that two randomly chosen PUFs have the same identifier. Therefore, $H_{2}$ should also be as large as possible to ensure a given average security level against collision.

The classical Shannon’s entropy $H_{1}$ is known to provide a resistance criterion against modeling attacks—which predict the response to a new challenge given previous responses to other challenges [9]. Again $H_{1}$ should be as large as possible.

The max-entropy $H_{0}$ is simply the logarithm of the total number of PUFs. $H_{0}$ upper bounds all the other entropies $H_{\alpha}$. Theoretically, it is possible to choose a non i.i.d. weight distribution such that all PUFs are equiprobable, yielding $H_{\alpha}=H_{0}$ for every $\alpha$. In this case it is sufficient to count PUFs. In practice, however, due to the assumption of i.i.d. weights (typically Gaussian), the upper bound $H_{0}$ will not be attained. Therefore, it is important to derive a efficient method to estimate the various Rényi entropies.

Estimating the various Rényi entropies typically requires estimating the entire PUF probability distribution. However, because a PUF of size $n$ is determined by $2^{n}$ response bits, there can be as many as $2^{2^{n}}$ PUFs of size $n$. The naive complexity increases very rapidly with $n$, in the order of $2^{2^{n}}$.

I-C Outline

In this paper, we link the analysis of PUFs to the theory of Boolean Threshold Functions (BTF) and build an algorithm that accurately estimates the PUF probability distribution and entropies up to order $n=10$. Our algorithm relies on determining equivalent classes of PUFs with the same probability, and then estimating the probability within each class. The classes are determined using Chow parameters from BTF theory. The remainder of the paper is thus organized as follows. Section II recalls known results from the theory of BTFs which we adapt to PUFs. The key results on the equivalence classes are proved in Section III. Section IV describes the simulation algorithm that allows us in Section V to determine the PUF distributions and entropies up to order $10$. Finally, Section VI concludes.

II The Chow Parameters of PUFs

Definition 1** (PUF)**

Let $x\in\mathbb{R}^{n}$ be such that for all $c\in\{\pm 1\}^{n}$, $c\cdot x\neq 0$. The PUF of size $n$ and weight sequence $x$ is the function $f_{x}:\left\{-1,+1\right\}^{n}\to\left\{-1,+1\right\}$ defined as

[TABLE]

where $c\cdot x=\sum_{i=1}^{n}{c_{i}x_{i}}$ is the usual scalar product.

This definition coincides with so-called “self-dual” BTFs of $n$ variables [10]. BTFs have been studied since the 1950’s as building blocks for Boolean circuits [11] and also find applications in machine learning [12]. Leveraging the correspondence between PUFs and BTFs, we adapt fundamental results from BTF theory to conveniently characterize PUFs.

II-A All PUFs are Attainable

Recall that in our framework, the PUF parameters $x\in\mathbb{R}^{n}$ are realizations of a random vector $X\in\mathbb{R}^{n}$. Under this probabilistic model a PUF becomes a randomized mapping $f_{X}$ such that $f_{X}(c)=\operatorname{sgn}(c\cdot X)$ for any (deterministic) challenge $c\in\{\pm 1\}^{n}$.

Lemma 1

For every PUF $f_{x}$, we have $\mathbb{P}(f_{X}=f_{x})>0$.

In other words, every PUF $f_{x}$ can be reached by a realization of weights $X$ with positive probability (even though one has $\mathbb{P}(X=x)=0$).

Proof:

By assumption all components of $X$ are i.i.d. with symmetric density of support $S$ containing [math]. Hence the support $S^{n}$ of the density of $X$ is an $n$-dimensional manifold containing the origin in its interior. Let $x\in\mathbb{R}^{n}$ be fixed and let $C_{x}$ be the cone (scale-invariant set) of all $y\in\mathbb{R}^{n}$ such that $f_{x}=f_{y}$. This cone $C_{x}$ has apex [math] and contains the intersection of all half-spaces $\{y\mid\operatorname{sgn}(c\cdot y)=\operatorname{sgn}(c\cdot x)\}$ where $c\in\{\pm 1\}^{n}$. Therefore, it is a $n$-dimensional manifold which intersects $S^{n}$ with positive volume. Hence $\mathbb{P}(f_{X}=f_{x})=\mathbb{P}(X\in C_{x}\cap S^{n})>0$. ∎

II-B Chow Parameters Characterize PUFs

First introduced by Chow [13] and later studied by Winder [11] who gave them their name, the so-called Chow parameters uniquely define a Boolean threshold function. Their definition is especially simple for PUFs:

Definition 2** (Chow parameters)**

The Chow parameters $p=(p_{1},\dots,p_{n})\in\mathbb{Z}^{n}$ of a PUF $f$ of size $n$ is defined as

[TABLE]

where the vector sum is carried out componentwise.

We remark that for $n\geq 2$, all Chow parameters are even integers. This is due to the fact that a sum of even number of elements $\pm 1$ must be even. More precisely,

[TABLE]

Theorem 1** (Chow’s theorem [13])**

Two PUFs with the same Chow parameters are identical.

For completeness, we give a new proof of Chow’s theorem rewritten in our PUF framework. Such proof turns out to be very simple.

Proof:

Let $f_{x}$ and $f_{y}$ be two PUFs with identical Chow parameters:

[TABLE]

Simplifying this expression by $\displaystyle\smashoperator[]{\sum_{\begin{subarray}{c}c\mid f_{x}(c)=1,\\ f_{y}(c)=1\end{subarray}}^{}}{\;c}$, we obtain

[TABLE]

which is equivalent to

[TABLE]

Taking the scalar product with $x$, we get

[TABLE]

which implies $c\!\cdot\!x=0$ whenever $f_{x}(c)\neq f_{y}(c)$. Now we assumed that $c\cdot x$ is never zero by Def. 1. Thus $f_{x}=f_{y}$. ∎

II-C Consequence on the Max-Entropy

An upper bound on the max-entropy can be easily deduced from Chow’s theorem.

Corollary 1

There are no more than $2^{n^{2}}$ PUFs of size $n$, i.e., the max-entropy of the PUF of size $n$ satisfies

[TABLE]

A more refined version, which can be rewritten as $H_{0}(n)\leq(n-1)^{2}+1$ for $n>1$, can be found in [14, Corollary 10.2]. The proof of (9) is again particularly simple for PUFs.

Proof:

The Chow parameters $p_{i}$, $i=1\ldots n$, satisfy

[TABLE]

and similarly, $p_{i}\geq-2^{n-1}$. Since there are $2^{n-1}+1$ even integers between $-2^{n-1}$ and $2^{n-1}$, there can only be $(2^{n-1}+1)^{n}\leq 2^{n^{2}}$ different values taken by the Chow parameters. The conclusion follows from Chow’s Theorem 1. ∎

A lower bound on $H_{0}$ is also easily found from the representation of Definition 1, as given by the following Proposition. The corresponding bound for the number of BTFs was first established independently by Smith [15] and Yajima et al. [16] in the 1960s.

Proposition 1

The max-entropy satisfies

[TABLE]

Proof:

Recall from Lemma 1 that every PUF $f_{x}$ can be reached by a realization of weights $X$ with positive probability. Hence it is sufficient to consider all $f_{x}$ for all $x\in\mathbb{R}^{n}$ in order to lower-bound the total number of PUFs.

Let $f_{x}$ a PUF of size $n$. Applying some small perturbation on $x$ if necessary (without affecting $f_{x}$) we may always assume that all the $c\cdot x$ ($c\in\left\{\pm 1\right\}^{n}$) take distinct values.

Now let $x_{n+1}\in\mathbb{R}$ be such that $2x_{n+1}$ is different from all the $c\cdot x$, and define $x^{\prime}=(x_{1},\cdots,x_{n-1},x_{n}-x_{n+1},x_{n+1})$. For any challenge $c^{\prime}=(c_{1},\ldots,c_{n},c_{n+1})$, we have

[TABLE]

Depending on how many of the $2^{n-1}$ values of $c\cdot x$ are smaller/larger than $2c_{n}x_{n+1}$, we can construct $2^{n-1}+1$ different PUF functions of size $n+1$. Hence each PUF of size $n$ gives rise to more than $2^{n-1}$ PUFs of size $n+1$. Therefore, $H_{0}(n+1)>n-1+H_{0}(n)$. The result follows by finite induction:

[TABLE]

∎

More recently, Zuev [17] has shown that, asymptotically, $H_{0}(n)>{n^{2}(1-\frac{10}{\ln(n)})}$. Therefore, for the max-entropy, we have that $H_{0}(n)\sim n^{2}$. As a result, instead of evaluating the probabilities of $2^{2^{n}}$ different PUFs, we will only have to evaluate about $2^{n^{2}}$.

As apparent in the proof of Zuev [17, Theorem 1] although through different geometrical considerations on normal vectors of hyperplanes, we can further reduce the number of PUFs to be considered down by a factor of about ${2^{n}n!}$. Section III will derive the exact compression factor using the equivalence classes on Chow parameters.

II-D Order and Sign Stability of Chow Parameters

An important property of the Chow parameters $p$ is that their share the same signs and relative order as the weights $x$.

Lemma 2

Let $f=f_{x}$ be a PUF with weight $x\in\mathbb{R}^{n}$, and $p\in\mathbb{Z}^{n}$ be the corresponding Chow parameters. Then

• •

$x_{i}\geq 0\implies p_{i}\geq 0$* and $x_{i}\leq 0\implies p_{i}\leq 0$.*

• •

$x_{i}\leq x_{j}\implies p_{i}\leq p_{j}$.

A similar result was shown by Chow in [13], although with another definition of Chow parameters. Again we give a simplified proof in the PUF framework.

Proof:

We first prove that $x_{i}\geq 0\implies p_{i}\geq 0$, the other case $x_{i}\leq 0\implies p_{i}\leq 0$ being similar. Suppose that $x_{i}\geq 0$. Let $E_{i}^{+}$ (resp. $E_{i}^{-}$) be the set $\{c\mid f(c)=1,c_{i}=1\}$ (resp. $\{c\mid f(c)=1,c_{i}=-1\}$). By definition,

[TABLE]

We show the existence of an injective mapping from $E_{i}^{-}$ to $E_{i}^{+}$. Consider the one-to-one mapping $\phi:\{\pm 1\}^{n}\rightarrow\{\pm 1\}^{n}$ defined by

[TABLE]

For any $c\in E_{i}^{-}$, $c_{i}=-1$, $\phi(c)_{i}=+1$ and

[TABLE]

Therefore, $f(\phi(c))=1$ and $\phi(c)\in E_{i}^{+}$. Hence, the bijection $\phi$ induces an injection from $E_{i}^{-}$ to $E_{i}^{+}$. This implies that $|E_{i}^{+}|\geq|E_{i}^{-}|$ hence $p_{i}\geq 0$.

To prove the second part, assume that $x_{i}\leq x_{j}$ for $j\neq i$. Let $f^{\prime}:\{\pm 1\}^{n-1}\rightarrow\{\pm 1\}$ be a PUF given by $f^{\prime}(c^{\prime})=\operatorname{sgn}(c^{\prime}\cdot x^{\prime})$, where $c^{\prime}\in\{\pm 1\}^{n-1}$ is obtained from $c$ by dropping $c_{i}$, $x^{\prime}_{\ell}=x_{\ell}$ for any $\ell\neq j$, and $x^{\prime}_{j}=x_{j}-x_{i}\geq 0$. Say the Chow parameters of $f^{\prime}$ is $p^{\prime}$. According to the first part of this lemma, we have $p^{\prime}_{j}\geq 0$. Now, expand the expression of $p_{j}-p_{i}$ as

[TABLE]

∎

III Equivalence Classes and Chow Parameters

Since the $X_{i}$ are i.i.d. symmetric random variables, the joint probability distribution of the weights $X=(X_{1},\dots,X_{n})$ is invariant under permutations and sign changes. Therefore, all PUFs $f_{x}$ that can be obtained from one another by permuting or changing signs of their weights $x_{1},x_{2},\ldots,x_{n}$ can be clustered together into equivalence classes of PUFs with the same probability $\mathbb{P}(f_{X}=f_{x})$.

We now establish several properties of these equivalence classes for PUFs, known as “self-dual” classes [10] in the context of BTFs. Zuev [17] had already mentioned $2^{n}n!$ elements per class in a special case. Our generalization (Theorem 3) is mentionned in a different form in [18, § 3.1.2] for calculating the total number of BTFs, yet we couldn’t find formal proofs published in the literature.

We give a formal definition of the equivalence classes by the action of the group

[TABLE]

where $S_{n}$ is the symmetric group of order $n!$. An element $g=(\sigma,s)\in G_{n}$ is determined by the permutation $\sigma\in S_{n}$ and the sign changes $s\in\{-1,+1\}^{n}$.

Proposition 2

For any $x=(x_{1},\dots,x_{n})\in\mathbb{R}^{n}$ and $g=(\sigma,s)\in G_{n}$ define $g\cdot x:G_{n}\times\mathbb{R}^{n}\to\mathbb{R}^{n}$ such that

[TABLE]

This defines a group action of $G_{n}$ on $\mathbb{R}^{n}$, where the inner product in $G_{n}$ is defined by

[TABLE]

Proof:

$G_{n}$ is clearly a group with identity $e=(id,(1,\cdots,1))$. For any $(\sigma_{1},s^{1}),(\sigma_{2},s^{2})\in G_{n}$ and $x\in\mathbb{R}^{n}$,

[TABLE]

This shows that $g\cdot x$ defines a group action of $G_{n}$ on $\mathbb{R}^{n}$. ∎

Thus we can say that the group $G_{n}$ acts on the PUFs of size $n$, the action being defined as

[TABLE]

In keeping with Lemma 2, we now show that the group action is carried over to Chow parameters:

Theorem 2

Let $f_{x}$ a PUF of Chow parameters $p$, and let $g\in G_{n}$. The Chow parameters of $f_{g\cdot x}$ is $g\cdot p$.

Proof:

Let $g=(\sigma,s)\in G_{n}$. For any challenge $c$, we have that $f_{x}(g^{-1}\cdot c)=f_{g\cdot x}(c)$. Thus,

[TABLE]

∎

Changing the signs of the weights or permuting them is reflected by the same operation on the Chow parameters. This allows us to compute the size of the equivalence classes:

Theorem 3

Let $f$ be a PUF with Chow parameters $p$. Let $m_{p}(k)$ be the number of Chow parameters equal to $k\in\mathbb{Z}$, and let $\operatorname{Orb}(f)=\{g\cdot f\mid g\in G_{n}\}$ the orbit of $f$ by $G_{n}$, that is, the equivalence class containing $f$. Then

[TABLE]

Proof:

By applying the well-known orbit-stabilizer theorem (see for instance [19, p. 89]), we have

[TABLE]

where $\operatorname{Stab}(f)=\{g\in G_{n}\mid g\cdot f=f\}$ is the stabilizer of $f$. The size of the orbit of $f$ can therefore be deduced from the size of its stabilizer. Now the latter can be easily computed: Let $g=(\sigma,s)\in G_{n}$ such that $g\cdot f=f$. Since $g\cdot p=p$, we have $\sigma(i)=j\iff p_{i}=p_{j}$ and $s_{i}=-1\iff p_{i}=0$. The number of such $g$ is exactly $2^{m_{p}(0)}\prod_{k\in\mathbb{Z}}{m_{p}(k)!}$. ∎

IV Monte-Carlo Algorithm

As seen in the introduction to the previous section, all PUFs in one equivalence class have the same probability. It follows that the probability of any particular PUF can be deduced from the probability of the class to which it belongs. Therefore, to determine the various entropies, it suffices to find a method that estimates the probabilities of the various equivalence classes.

In this section, we propose an algorithm that exploits a definition of a canonical PUF in any equivalence class in such a way that for given any PUF, it is trivial to determine the corresponding canonical PUF. As expected, only about ${2^{n^{2}}}/{2^{n}n!}$ probabilities need to be estimated, instead of approximatively $2^{n^{2}}$.

Definition 3** (Canonical PUF)**

A canonical PUF of $n$ variables is a PUF whose Chow parameters satisfy

[TABLE]

The canonical form of a PUF $f$ is the canonical PUF belonging to the same class, i.e., $f^{\prime}=g\cdot f$ where $g\in G_{n}$ is such that $f^{\prime}$ is canonical.

This notion was first introduced by Winder [11] and is related to the concept of “prime” functions independently studied by Chow [13].

Proposition 3** (Unicity of the canonical PUF)**

*Two canonical PUFs in the same class are equal. *

Proof:

Since $f$ and $f^{\prime}$ are in the same equivalence class, their Chow parameters are identical up to sign changes and order. Since both are canonical, the signs and order are fixed. Their Chow parameters are thus identical and $f=f^{\prime}$. ∎

Proposition 4

Let $x=(x_{1},\ldots,x_{n})$ be a weight sequence of a PUF $f=f_{x}$, and let $g\in G_{n}$ such that $g\cdot x=(x^{\prime}_{1},\ldots x^{\prime}_{n})$ satisfies

[TABLE]

Then $g\cdot f$ is the canonical form of the PUF $f$.

Proof:

Let us denote by $p$ (resp $p^{\prime}$) the Chow parameters of $f$ (resp $g\cdot f$). The PUF obtained from weights $x^{\prime}$ is $g\cdot f$. From Lemma 2, the $p^{\prime}_{i}$ satisfy the same ordinal relations and have the same signs as the $x^{\prime}_{i}$. Therefore, $f^{\prime}$ is a canonical PUF. ∎

These results allow us to efficiently estimate the PUF distribution by Monte-Carlo methods, as described in Algorithm 1. Such an algorithm can be used for any i.i.d. weight distribution with symmetric densities (not necessarily Gaussian).

V Entropies Estimation

In this section, we present the simulation results in the Gaussian case where the weights $X_{i}$ are i.i.d. $\sim\mathcal{N}(0,1)$. Exact values were already determined up to $n=4$ in [20].

V-A Estimating the Max-Entropy $H_{0}$

According to Lemma 1, every PUF can be attained by some realization of weights. Therefore, the max-entropy of the PUF distribution is simply the logarithm of the total number of PUFs with $n$ weights. This number is equal to the total number of BTFs of $n-1$ variables and has been computed up to $n=10$ in [18, § 3.1.2], see Table I.

V-B Estimating the Shannon Entropy $H_{1}$

For any PUF $f$, let $[f]$ denote the equivalence class of $f$ with cardinality $|[f]|$, $\mathbb{P}(f)$ its probability, $F_{n}$ the set of all PUFs and $F_{n}/G_{n}$ the quotient group induced by the action of the group $G_{n}$. Then, letting $\mathbb{P}([f^{\prime}])=\sum_{f\in[f^{\prime}]}{\mathbb{P}(f)}$, one has

[TABLE]

In other words, the Shannon entropy of the PUF distribution is simply the sum of the entropy of the equivalence classes and the average of their logarithmic size. The latter term can be estimated using the unbiased empirical mean, where a confidence interval can be determined using Student’s t-distribution [21]. The former term, however, is an entropy, for which no unbiased estimator exists [22]. The NSB estimator [23] has a reduced bias and a low variance. However, because we generated much more PUFs than equivalence classes (by a factor of at least 100000), the plug-in estimator, based on the empirical frequency estimates, performs quite well: Its bias can be upper bounded as described in [22] and was found to be less than $0.01$ bit. The results are summarized in Table II.

V-C Estimating the Collision Entropy $H_{2}$

The collision entropy was estimated using an unbiased estimator adapted from [24, § 1.4.2]. Let $N_{[f]}$ be the number of PUF samples that belong to the equivalence class of $[f]$ among a number of Poisson-distributed PUFs with parameter $N$, and $N_{[f]}^{\underline{2}}=N_{[f]}\cdot(N_{[f]}-1)$. We can compute

[TABLE]

where we used the fact that $\mathbb{E}[\frac{N_{[f]}^{\underline{2}}}{N^{2}}]=\mathbb{P}([f])^{2}$ from [24, § 2.2]. It follows that

[TABLE]

is an unbiased estimator for the power-sum $\sum_{f\in F_{n}}{\mathbb{P}(f)^{2}}$. As can be also checked, the variance of this estimator admits the same upper bound as the one described in [24, § 1.4.2]. This allows us to determine confidence intervals for the collision entropy as shown in Table III.

V-D Estimating the Min-Entropy $H_{\infty}$

In order to determine the min-entropy of the PUF distribution, one needs to estimate the probability of the most likely PUF. Our experiments, as well as those of Delvaux et al. [25], strongly suggest that for a Gaussian distribution of the weights, the most likely PUFs are the $2n$ PUFs corresponding to the Boolean functions $c_{i}$ and $\overline{c_{i}}$, $i=1...n$.

The maximum likelihood estimator of that probability is simply the sample frequency, which is an unbiased estimator. A confidence interval for this estimator can be obtained using the Wilson score interval [26], which yields a confidence interval for the min-entropy $H_{\infty}$.

Because we have already determined that there are exactly $2n$ PUFs in the equivalence class of the most likely PUF, we only need to estimate a confidence interval on the sample frequency of the equivalence class. Once such an interval was obtained, for instance $[p_{-},p_{+}]$, then the confidence interval for the min-entropy is given by

[TABLE]

The confidence intervals of the min-entropy are presented in Table IV.

The results of the simulation, up to $n=10$, are presented in Figure 1. The results show that the Shannon entropy is close to the max-entropy, which as seen in Section II is asymptotically equivalent to $n^{2}$ as $n$ increases.

VI Conclusions and perspectives

While it had been previously shown [6] that the entropy of the loop-PUF of $n$ elements could exceed $n$, the exact values were only known for very small values of $n$. Making the link with BTF theory using Chow parameters, we have extended these results to provide accurate approximations up to $n=10$. Our results suggest that the entropy of the loop-PUF might be quadratic in $n$: This would be a very positive result for circuit designers, since it implies that the PUF has a very good resistance to machine learning attacks. However, because the min-entropy and collision entropy are much smaller (on the order of $n$) the resistance to cloning may not be as high as expected.

Two interesting theoretical aspects of the PUF entropy are still open: First, to what extent does the entropy of the PUF stay close to the max-entropy for larger values of $n$? Second, is it possible to obtain a quasi-quadratic entropy in $n$ when choosing a small subset of all $2^{n}$ possible challenges? The latter point is of great practical interest since it would reduce the time required to obtain the PUF identifier while maintaining a high resistance to machine learning attacks.

For values of $n$ larger than $10$, our method seems to become too costly in space and time to produce accurate estimates of the PUF probability distributions under reasonable conditions. One could perhaps have recourse to entropy estimation methods that dispense with learning the distribution itself, such as the NSB estimation [23]. This could be used to check the predicted trend of the PUF entropy for increasing $n$.

Acknowledgment

The authors would like to thank Prof. Gadiel Seroussi, who first suggested a possible link between our problem and BTF theory at the LAWCI’18 conference in Campinas, Brazil.