Design and Evaluate Recomposited OR-AND-XOR-PUF
Jianrong Yao, Lihui Pang, Yang Su, Zhi Zhang, Wei Yang, Anmin Fu, Yansong Gao
Abstract
Physical Unclonable Function (PUF) is a hardware security primitive with a desirable feature of low cost. Considering the space of challenge-response pairs (CRPs), there are two PUF categories: weak PUF and strong PUF. Compared to a weak PUF, a strong PUF has a wider range of applications. However, it is challenging to design a <i>reliable and secure lightweight</i> strong PUF. To address this challenge, PUF recomposition built upon multiple simple PUF instances has received a lot of attention in research, such as the most popular XOR-APUF, the recent MPUF in IEEE TC 2017 (Sahoo <i>et al.</i> , 2018), XOR-FF-APUF in IEEE TIFS 2020 (Avvaru <i>et al.</i> , 2020) and IPUF in TCHES 2020 (Nguyen <i>et al.</i> , 2019). When a combination of MAX and MIN (equal to AND and OR) bitwise operations are used in PUF recomposition (Rührmair <i>et al.</i> , 2010), (Rührmair <i>et al.</i> , 2013) and (Gao <i>et al.</i> , 2020), its resilience against model attacks was expected to be improved markedly, because one bitwise operation might be vulnerable to one type of modeling attack and combining them can yield improved resilience. To our knowledge, there is no explicit evaluation of this recomposition; thus, this study is the first to evaluate the uniformity and reliability of the <u>O</u> R- <u>A</u> ND- <u>X</u> OR <u>-PUF</u> (OAX-PUF)—( <inline-formula><tex-math notation="LaTeX">$x,y,z$</tex-math></inline-formula> )-OAX-PUF. Compared to the most used <inline-formula><tex-math notation="LaTeX">$l$</tex-math></inline-formula> -XOR-PUF, the ( <inline-formula><tex-math notation="LaTeX">$x,y,z$</tex-math></inline-formula> )-OAX-PUF shows better reliability given <inline-formula><tex-math notation="LaTeX">$l=x+y+z$</tex-math></inline-formula> without degrading the uniformity (i.e., retain to be 50%). As APUF is a compact PUF instance for constructing lightweight strong PUF candidates, e.g., XOR-APUF, MUXPUF and IPUF, we further examine the modeling resilience of the ( <inline-formula><tex-math notation="LaTeX">$x,y,z$</tex-math></inline-formula> )-OAX-APUF using four powerful attacks, i.e., logistic regression (LR), reliability assisted CMA-ES, multilayer perceptron (MLP), and the most recent hybrid LR-reliability. Compared to the XOR-APUF, the OAX-APUF successfully defeats the CMA-ES attack. It often shows improved modeling resilience against LR and hybrid LR-reliability attacks while always increasing the attacking time costs of these two attacks. However, OAX-APUF exhibits lower modeling resilience against the MLP attack unless the <inline-formula><tex-math notation="LaTeX">$x,y,z$</tex-math></inline-formula> are carefully tuned. Overall, the OAX recomposition could be an alternative lightweight recomposition approach in constructing strong PUFs if the underlying PUF (e.g., FF-APUF), has shown improved resilience against modeling attacks, because the OAX incurs smaller reliability degradation compared to XOR.