Behavioral Models of True Random Number Generators

Transcription

1 POSTER 8, PRAGUE MAY Behavioral Models of True Random Number Generators Vlastimil KOTĚ,, Vladimír MOLATA,, Patrik VACULA, Dept. of Microelectronics, Czech Technical University, Technická, 66 7 Praha, Czech Republic STMicroelectronics Design and Application, s.r.o., Pobřežní 6/, 86 Praha, Czech Republic kotevlas@fel.cvut.cz, molatvla@fel.cvut.cz, vaculpat@fel.cvut.cz Abstract. The behavioral models of true random number generators (TRNGs), presented in this paper, are developed to be able to approximate properties of real TRNGs and speed up system simulations on a chip containing this type of generators. The models of the TRNG with direct amplification of noise, the TRNG with ring oscillators, and TRNG based on metastable states are based on commonly used architectures. For their creation, the hardware description language Verilog-A has been used. The random number sequences have been tested by the well-known statistical test suites FIPS and NIST. According to obtained results, the introduced models substitute a function of real TRNGs very well. Using these models instead of a transistor level, the simulation time is shortened by at least ten times. Keywords True random number generator (TRNG), behavioral model, integrated circuit, Verilog-A, statistical test.. Introduction Can we imagine our lives without modern communication systems? Internet and mobile phones are used every day. These modern communication systems connect people and allow us to reduce geographical distances between different places in the world. The security of transfers made by modern communication systems has to be ensured by different session keys for authentication and encryption which are generated on a random number basis. Therefore parts of these systems are random number generators in better cases so-called true random number generators (TRNGs) which generates high-quality random numbers based on a random behavior of physical phenomena. Already published TRNGs extract randomness occurring in superconductive integrated circuits [], in magnetic tunnel junctions [], or during radioactive decay []. However, current communication systems are fabricated in complementary metal oxide semiconductor (CMOS) technologies. Hence, it is important to be also possible to extract randomness in these semiconductor structures. Thermal noise generated by electronic components such as resistors can be used as source of randomness []. The published TRNG [] extracts randomness from jitter appearing in ring oscillators. Metastable states arising in digital CMOS circuits are the basis for the TRNG presented in [6]. Hardware prototype testing is an expensive and longlasting process because the prototype has to be manufactured and each of its modification means the manufacturing of a new version of the prototype. This is reflected in a price of the finished product and on its competitiveness. Therefore the software models of the proposed electronic circuits are used during the design of the whole device in order to optimize these circuits. To create and simulate a precise model is very difficult and time-consuming. Thus physical phenomena are described and modeled only approximately. There should be done a compromise between the time consumption and accuracy of the behavioral model [7]. For evaluating of the random number quality, statistical test suites such as FIPS [8] or NIST [9] are used and require a large number of random numbers. Today, TRNGs are individual blocks of systems on a chip (SoC) usually fabricated in CMOS processes. Simulation of the whole SoC at the most accurate transistor level is almost impossible due to enormous time demands. Therefore individual blocks are substituted by the behavioral models which approximate properties of the designed blocks at the transistor level and significantly speed up simulations of the whole system. This paper introduces behavior models of three TRNG types which are suitable to be implemented in integrated circuits fabricated in CMOS processes.. Behavioral Models True random number generators are circuits composed of analog and digital blocks. For their description, the hardware description language Verilog-A has been used. This high-level programing language is suitable for modeling analog circuits as TRNGs. The behavior of the model is defined by mathematical relations among input and output signals and a structure of the circuit can be described in more levels. After structure definition, a set of equations is created and solved by a simulator. In this case, Cadence Spectre Circuit Simulator has been used.

2 V. KOTĚ et al., BEHAVIORAL MODELS OF TRUE RANDOM NUMBER GENERATORS Noise source Digitizer. Analog noise signal D Q Post-processing. R A LFVCO Text files V ans. Fig.. The architecture of the TRNG with direct amplification of noise... TRNG with Direct Amplification of Noise The model of the TRNG with direct amplification of noise has been created on the base of a structure described in [] and shown in Fig.. In this model, randomness is extracted from thermal noise generated in an undriven resistor R with the resistance of kω. Thermal noise is generated by the Brownian motion of the charge carries in real electrical conductor and arises regardless of the applied voltage. An amplitude distribution of thermal noise can be described by the normal distribution. In other words, thermal noise is considered as a white noise. Thus the power spectral density is ideally constant throughout all frequencies. The root mean square (RMS) value of thermal noise is necessary to know due to the implementation of this noise into the abovementioned model where the real resistor is modeled as the ideal resistor in series with the voltage source of thermal noise. According to [], the RMS value of the thermal noise voltage V RMS,tn is given by V RMS,tn = kt R f () where k is the Boltzmann constant (k =.86 J K ), T is the temperature, and f is the frequency bandwidth. Specifically for this model, the temperature is set to K and the bandwidth f to khz. Thus the RMS value of the noise voltage is.7 µv. The random behavior is modeled by the pseudorandom algorithm which is a part of Verilog-A language. An important parameter of thermal noise is an amplitude distribution which can be described by the normal distribution. Parameters of used Verilog-A functions are set so that the RMS voltage of generated noise matches with the calculated RMS voltage of thermal noise. The generated noise signal has the normal distribution of amplitudes with the mean value equal to. An amplifier is the second module of the noise source. The generated thermal noise applied to the amplifier input is amplified. The gain A of amplifier is set so that the output signal called the analog noise signal can be further processed. If the analog noise signal after amplification would be higher than the supply voltage of V, the amplifier limits this signal as in the real circuit. The analog noise signal V ans is shown in Fig V lfvco V dns Fig.. The modeled analog noise signal V ans depending on time. LFVCO output signal Digitized noise signal Fig.. The LFVCO output signal V lfvco and the digitized noise signal V dns depending on time. The generated analog noise signal is processed in the digitizer which is composed of three components. The first component is the low frequency voltage controlled oscillator (LFVCO) generating a square waveform signal whose the period is controlled by the input signal in this case by the analog noise signal. The duration of the basic period is µs. The second component the high frequency oscillator generates the square waveform signal with the frequency of MHz which is hundred times higher than the basic frequency of LFVCO. The third component D-type flip-flop responds to the falling edge of the clock signal while the input value is captured and appears at the output with a small delay of ns. The output signal of LFVCO is applied to the clock input of the D-type flip-flop and the high frequency square waveform signal is applied to the input D. The falling edge of the LFVCO output signal comes at a random moment.

3 POSTER 8, PRAGUE MAY Noise source Digitizer Output signal from the binary XOR tree RO. RO. RO V xt. RO Binary XOR-tree D Q Post-processing.. RO RO 6 V clk Text files Fig.. The output signal from the binary XOR-tree. Fig.. The architecture of the TRNG with ring oscillators. Thus the flip-flop output value cannot be determined. The output signal marked as the digitized noise signal with the LFVCO output signal are shown in Fig.. In random number sequences, unbalanced ratio of logical values, periodically repeating patterns, or any bias can appear. Therefore in this TRNG model, two basic distortion removal techniques described in [6] are implemented. The first one marked as the XOR corrector reads two consecutive bits and performs the well-known XOR bit operation. The other one known as the Von Neumann corrector also reads two consecutive bits but they are processed according to Tab. when two equal consecutive bits are discarded. All generated sequences are stored into text files in order to evaluate by the statistical test suites. Input bit pair Output bit [,] none [,] [,] none [,] Tab.. The table describing function of the Von Neumann corrector... TRNG with Ring Oscillators The TRNG architecture with the ring oscillators is based on only digital circuits which allows compact and efficient design. This architecture described in [] is shown in Fig.. The ring oscillator is created of an odd number of inverters arranged the rings. The output of each inverters oscillates between the logical zero and the logical one. Thereby an output square waveform signal Ψ j (t) is formed and can be described by Ψ j (t) = Ψ j (t + ξ) () where ξ is period of the output signal which is determined by the number of inverters n and the delay of the inverters τ. Thus the period ξ can be written down as ξ = nτ. () However, in the real world, the output signal does not have the ideal square waveform. The period ξ is not fixed but consists of a constant part ξ c and of a random variable part ξ r whose value occurs in the range from ξ c / to ξ c / with the normal distribution and the mean value in middle of this interval. Thus the period ξ is given by ξ = ξ c + ξ r. () The random variable part ξ r appears around the rising edge or the falling edge of the output signal Ψ j (t) and is marked as the jitter. In this type of the TRNG, randomness is extracted from the uncertainty of exact timing of the output signal edges. The duration of the constant part ξ c is set to ns and the maximal value of the random variable part ξ r to ns. The instantaneous value of the random variable part ξ r is determined by the pseudo-random algorithm which generates values with the normal distribution. The phase drift also arises in the output square waveform signal. In this software model, the phase drift is modeled by a random delay with the uniform distribution which is created by the pseudo-random algorithm generating uniformly distributed numbers. The digitizer is composed of the binary XOR-tree and the D-type flip-flop. In this model, digital XOR gates are connected into the binary XOR-tree which produces an output signal composed of a deterministic part and a nondeterministic part. The width of the deterministic part is given by the number of used ring oscillators. Thus the deterministic part narrows with the higher number of used ring oscillators. Random bits are extracted from the nondeterministic part. The binary XOR-tree output signal V xt depicted in Fig. is sampled by the D-type flip flop which responds to the rising edge of the clock signal V clk. If samples are taken in the deterministic part, a bias arises in random numbers. Therefore the frequency f c of the clock signal V clk

4 V. KOTĚ et al., BEHAVIORAL MODELS OF TRUE RANDOM NUMBER GENERATORS Clock signal V SUP V clk M M V CLK V bi 6 8 I Output signal from D type flip flop V D Node a I Node b 6 8 Fig. 7. The architecture of the TRNG based on metastable states. Fig. 6. The clock signal V clk and the flip-flop output signal V D.. Output signal from bi stable element is set so that samples are taken from non-deterministic part. The clock signal V clk and the output signal V D from this D- type flip-flop are shown in Fig. 6. Also in this model, abovementioned correctors are implemented and the random number sequences are stored into text files. V bi TRNG Based on Metastable States Another TRNG type is based on metastable states arising in digital circuits. In this case, randomness is extracted from thermal and flicker noise appearing in CMOS circuits which are modeled by the pseudo-random algorithm. The metastable state can be observed in a pair of cross coupled inverters I and I which is described in [6] and shown in Fig. 7. The PMOS transistors used as the pre-charging devices M and M are controlled by the clock signal V CLK with the period set to µs. If V CLK is in logical zero, then both nodes a and b are transferred to logical one. The bistable element goes to the metastable state, when V CLK is at a rising edge. The voltage in nodes a and b goes to the metastable voltage V meta. Presence of random noise in both nodes causes that the bistable element goes to the stable state. The result logical levels in stable state depend on the value of a noise difference in nodes a and b during the metastable state. The metastability based TRNG can generate a new random bit during each clock period. In this model, the output signal from the bistable element is generated in three phases. In the first phase, the supply voltage is applied to the nodes a and b. Then, in the second phase, the supply voltage is disconnected and the metastable state arises. Almost immediately after the second..... Fig. 8. The output voltage V bi of the bistable element depending on time. phase, the bistable element goes to the stable state because random noises are present in nodes a and b. In the next period of the clock signal, the first phase repeats. The output voltage V bi of the bistable element is shown in Fig. 8. Details of voltages in nodes a and b during the meta-stable state are shown in Fig. 9. As can be seen, random noises does not have their typical waveform because the new value of modeled noises is calculated only in one time point. This simplification safes valuable computing time. The metastability based TRNG is able to resist disturbances in the supply voltage V SUP which is advantage of this architecture. The supply voltage disturbances operates on both nodes simultaneously and do not create any difference. Thus the output logical levels are not affected. However, the generated random numbers can be affected by a device mismatch between the both inverters which can introduce a bias into random number sequences. In an extreme case, if the perceptible device mismatch is present, the voltages in nodes a and b can move to the same values in each period and the random behavior of device can be lost.

5 POSTER 8, PRAGUE MAY V a Voltage at node a Voltage at node b Using the presented models, sequences containing Mb of random data have been generated both directly and as well as with the correctors. The FIPS test suite did not detect any distortion or repeating patterns in all sequences. The strict NIST statistical tests found any bias in sequences generated by the TRNG model with direct amplification of noise. As can be seen in Tab.., the Von Neumann corrector removed the bias in a large extent. Obtained results of the TRNG models with the ring oscillators and with bistable element in Tab.. show that these models produce high quality random number sequences whose properties are very close to properties of sequences generated by real TRNGs. As mentioned above, simulations at the transistor level are very time-consuming. The very important task for the models is to accelerate the simulation of SoCs containing TRNGs. During performed simulations when using the developed models, durations were observed more than ten times shorter than durations of transistor level simulations. V b.. Conclusions.9 6 Fig. 9. Details of voltage V a in node a and of voltage V b at node b during the metastable state. The output voltage V bi can drive the logic gate directly but contains a region with the metastable voltage which can cause issues during processing. Therefore this signal V bi is sampled by the D-type flip-flop to be able to processed by the above-mentioned correctors. As with the previously mentioned models, all random number sequences are stored.. Achieved Results As already mentioned above, the aim of the proposed models is to approximate the TRNG behavior and to generate random number sequences with the high quality and very similar properties as random number sequences produced by real TRNGs. In general, it is not possible to prove that a number sequence is random. Therefore the random number quality is usually tested by the statistical test suites which are described in the FIPS - standard (FIPS) [8] and in the National Institute of Standards and Technology tests (NIST) [9] and are able to detect any distortion in random number sequences. The NIST test suite is composed of statistical tests and some statistical tests consist of subtests. Therefore results in Tab.. are in form P/F where P is the number of the passed sub-tests and F is the number of failed. This paper presents the behavioral models of TRNGs developed on the base of usually used architectures. The models have been designed in the hardware description language Verilog-A. Use of the developed models instead of TRNGs at transistor level significantly speed up simulations of the system containing these generators. For testing of generated random number sequences, the well-known statistical test suites FIPS and NIST have been used. Obtained results show that the models approximate properties of the real TRNGs very well. Acknowledgements Research described in the paper was supervised by Doc. J. Jakovenko and Prof. M. Husák, FEE CTU in Prague and supported by the Grant Agency of the Czech Technical University in Prague, grant No. SGS7/88/OHK/T/ (Mikro a nanostruktury a soucastky). References [] SUGIURA, T., YAMANASHI, Y., YOSHIKAWA. N. Demonstration of Gbit/s generation of superconductive true random number generator. IEEE Transactions on Applied Superconductivity,, vol., no., p [] OOSAWA, S., KONISHI, T., ONIZAWA, N., HANYU, T. Design of an STT-MTJ based true random number generator using digitally controlled probability-locked loop. In IEEE th International New Circuits and Systems Conference (NEWCAS). Grenoble (France),, p.. [] RÜSCHEN, D., SCHREY, M., FREESE, J., HEISTERKLAUS, I. Generation of True Random Numbers based on Radioactive Decay. In Proceedings of the International Student Scientific Conference Poster /7. Prague (Czech Republic), 7, p.. [] HOLMAN, W. T., CONNELLY, J. A., DOWLATABADI, A. B. An integrated analog/digital random noise source. IEEE Transactions on Circuits and Systems I: Fundamental Theory and Applications, 997, vol., no. 6, p. 8. [] YANG, K., FICK, D., HENRY, M. B., LEE, Y., BLAAUW, D., SYLVESTER, D. 6. A Mb/s pj/b fully synthesized truerandom-number generator in 8nm and 6nm CMOS. In IEEE International Solid-State Circuits Conference Digest of Technical Papers (ISSCC). San Francisco (CA, USA),, p. 8 8.

6 6 V. KOTĚ et al., BEHAVIORAL MODELS OF TRUE RANDOM NUMBER GENERATORS TRNG with dir. amp. TRNG with ring osc. TRNG with bistab. elem. NIST test Directly XOR VN Directly XOR VN Directly XOR VN Monobit / / / / / / / / / Frequency / / / / / / / / / Runs / / / / / / / / / Longest runs / / / / / / / / / Binary matrix rank / / / / / / / / / Spectral DFT / / / / / / / / / Non-overlapping template 7/ /6 / 8/ 6/ 8/ 7/ 7/ 7/ Overlapping template / / / / / / / / / Universal statistical / / / / / / / / / Linear complexity / / / / / / / / / Serial / / / / / / / / / Approximate entropy / / / / / / / / / Cumulative sums / / / / / / / / / Random excursions 8/ 8/ 8/ 8/ 8/ 8/ 8/ 8/ 8/ Random excursions var. 8/ 8/ 8/ 8/ 8/ 8/ 8/ 8/ 8/ Tab.. Results of the NIST tests for all presented models which have been generated directly (Directly), using the XOR corrector (XOR), or using the Von Neumann corrector (VN). [6] SRINIVASAN, S., MATHEW, S., ERRAGUNTLA, V., KRISHNA- MURTHY, R. A Gbps.7pJ/bit Process-Voltage-Temperature Variation Tolerant All-Digital True Random Number Generator in nm CMOS. In 9 nd International Conference on VLSI Design. New Delhi (India), 9, p. 6. [7] WANG, Y., WANG, Y., HE, L. Behavioral modeling for operational amplifier in sigma-delta modulators with Verilog-A. In APCCAS 8-8 IEEE Asia Pacific Conference on Circuits and Systems. Macao (China), 8, p [8] Federal Information Processing Standards, National Institute of Standards and Technology.Security Requirements for Cryptographic Modules.. NIST FIPS PUB pages. [Online] Cited Available at: /fips.pdf [9] RUKHIN, A., et al. A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications.. National Institute of Standards and Technology. Rev a. pages. [Online] Cited 8--. Available at: ra.pdf [] JUN, B., KOCHER, P. The Intel Random Number Generator. White Paper Prepared For Intel Corporation, 999. Available from: [] JOHNSON, J. B. Thermal Agitation of Electricity in Conductors. Physical Review, 98, vol., no., p [] SUNAR, B., MARTIN, W. J., STINSON, D. R. A Provably Secure True Random Number Generator with Built-In Tolerance to Active Attacks. IEEE Transactions on Computers, 7, vol. 6, no., p attends the Ph.D. study in the Department of Microelectronics at CTU in Prague where his research interests include structures of semiconductor devices, physical design, electrical circuit theory, and IC design methodology development. Vladimír MOLATA received the B.S. degree in electrical engineering from Czech Technical University in Prague, in 9 and the M.S. degree in electrical engineering from Czech Technical University in Prague, in. He is currently studying Ph.D. program at the Czech Technical University where his research interests include electrical circuit theory, modelling and simulation. He is working at STMicroelectronics as IC Design Senior Engineer of CMOS/BCD analog ICs for power management. Patrik VACULA was born in 979. Master s degree in Electronics and Multimedia Communications Engineering, he completed at TU FEI in Kosice in. Currently he is working at STMicroelectronics as member of Technical Staff IC layout engineer responsible for entire BE IC development flow including power MOS integration. He is a PhD. Student in the Department of Microelectronics at CTU. About Authors... Vlastimil KOTĚ, born in 987, received his Bachelor s degree in electrical engineering from Czech Technical University in Prague in 9, and Master s degree in electrical engineering from CTU in Prague in. Currently, he is working at STMicroelectronics as IC Layout Staff Engineer. He