SIMPLE PLL-BASED TRUE RANDOM NUMBER ... - KEMT FEI TUKE

More documents

Recommendations

Info

3 Randomness extraction from the PLL-generated clock jitter The basic principle behind our method is to extract the randomness from the jitter of the clock signal synthesized in the embedded analog PLL. The jitter is detected by the sampling of a reference (clock) signal using a rationally related (clock) signal synthesized in the onchip analog PLL. The fundamental problem lies in the fact that the reference signal has to be sampled near the edges influenced by the jitter. The basic structure of the random bitstream generator is depicted in Figure 3. CLK CLJ PLL D CLK Q D CLK Q q(nTCLK) Decimator (NKD) x(nNTQ) Figure 3: Basic structure of random bitstream generator using PLL-synthesized low-jitter clock signal Because there is a probability that the first flip-flop could become metastable, the second flip-flop is cascaded. In case the first flip-flop produces a metastable output, it can resolve until its output is clocked by the second flip-flop. This flip-flops connection does not assure that only stable signal is clocked, but the probability that the output qn ( T CLK ) will get a valid state is much higher [13]. Let CLJ be an on-chip PLL-synthesized rectangular clock waveform with the frequency FCLJ = FCLK KM/ KD (2) where CLK is a reference clock signal and parameters K M and KD defined in (1) are related to the PLL structure. Signal CLJ is sampled into the D flip-flop using a clock signal with frequency F CLK . There are KD rising edges of CLK signal and 2K M edges (rising and falling) of CLJ waveform during time period TQ = KDTCLK = KMTCLJ (3) It has been shown in [6] that if K M and KD are relative primes, the set of samples create an equidistant set of values with the distance step TCLK TCLJ d = GCD( 2 KM, KD) = GCD( 2 KM, K D) (4) 2KM 2KD where GCD means Greatest Common Divisor. It has been shown that the worst-case distance between the two closest edges of CLK and CLJ during the period T Q is given as ( ) If KM, K D and F CLJ are chosen so, that σ > MAX ( ∆ T ) MAX ∆ T = d /2 (5) jit we can guarantee that during T Q the sampling edge of CLK will fall at least once into the edge zone of CLJ (the edge zone means the time interval around the edge with a width smaller than σ jit ). Therefore during the period T Q , D values of CLJ will be sampled into the first D flip-flop and at least one of them will statistically depend on the random jitter, so the output value of the second flip-flop will be nondeterministic. In [6] we used delay elements to increase the probability of overlapping of and CLJ edge zones. K qnT ( CLK ) CLK min min (6)
Thanks to the measurements we got the information about the jitter value, and also about the probability of edges overlapping that both are higher as expected. Therefore the delay line is not needed anymore. The decimated output signal ( Q) = ( Q) ⊕ ( Q − CLK) … ⊕ ( Q−( D−1) CLK) xnT qnT qnT T qnT K T which is generated at the output of an Exclusive-OR (XOR)-based decimator as a bit-wise addition modulo 2 ( ⊕ ) of K D samples ( ) . q sampled with the frequency F CLK , will be nondeterministic, too. It can be seen that in reference to [6] we have changed basic structure of the generator in several ways: - because of higher jitter value, which has been approved by precise jitter measurements we could replace the delay line and the bank of flip-flops by a single flip-flop, - the metastability behavior of the signal qn ( T CLK ) and thus of the generator in general was improved by addition of the second flip-flop, - we have validated that if condition (6) is fulfilled, the speed of the generator can be increased by reducing the decimation factor to NK D , where N = 1 is number of T Q periods. 4 TRNG implementation We have validated our simplified structure of the random bitstream generator using Altera analog PLLs embedded in Apex E family. We have used an evaluation board with a PC Card interface. The Apex EP20K160 device has included generator, 16x128-bit FIFO, PC Card interface and a custom logic. As the best option a 2-PLL configuration (shown in Figure 4) with only one input clock signal has been chosen. Synthesized clock signals CLK and CLJ are not fed out from the FPLD (in design presented in [6] one synthesized signal has been fed out of the device and again reused in FPLD, what is definitely less secure). Therefore they cannot be manipulated separately without a circuit reconfiguration. This fact is very important for cryptographic applications, because it significantly improves overall system security. Oscil 40 MHz CLK4p CLK2p (NC) CLKLK_FB2p (NC) CLKLK_OUT2p (NC) APEX EP20K160E-2X PLL4 clk1 inclk clk0 PLL2 clk1 inclk clk0 fCLJ (96,4 MHz) Random bitstream generator fCLK (95 MHz) S/P Conv. Serial output 454 kbits/s Custom logic & PC Card interface FIFO 16x128 Figure 4: Block diagram of the experimental PC card with Apex EP20K160 ETC144-2x (7)
Page 1 and 2: SIMPLE PLL-BASED TRUE RANDOM NUMBER
Page 3: ack to the specified frequency, but
Page 7 and 8: prove even further the quality of t

SIMPLE PLL-BASED TRUE RANDOM NUMBER ... - KEMT FEI TUKE

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?