PUF-derived IoT identities in a zero-knowledge protocol for blockchain

Depósito de investigación de la Universidad de Sevilla https://idus.us.es/ “This is an Accepted Manuscript of an article published by Elsevier in Internet of Things (The Netherlands) on March 2020, available at: https://doi.org/10.1016/j.iot.2019.100057 ” PUF-derived IoT identities in a zero-knowledge protocol for blockchain Miguel ´ Angel Prada-Delgado, Iluminada Baturone Instituto de Microelectr´onica de Sevilla, IMSE, CNM (Universidad de Sevilla, CSIC) Seville, Spain Gero Dittmann, Jens Jelitto, Andreas Kind IBM Research – Zurich, Switzerland Abstract As the internet of things moves into increasingly sensitive domains, connected devices need to be secured against data manipulation and counterfeiting. Where the underlying business processes involve multiple independent parties, a blockchain platform can provide a common source of truth. If changes to the common state depend on IoT devices, the authenticity and integrity of the IoT input must be ensured. Employing a blockchain platform for authenticating devices makes the process independent of the device manufacturer. This paper shows how cryptographic keys derived from a device’s physical fingerprint can be employed in a zero-knowledge protocol to authenticate a device. As the keys are regenerated at boot time rather than stored, the approach does not need an expensive secure element. An efficient implementation enables even lightweight devices to prove their identity and sign messages. Experimental results demonstrate the robustness of the approach. Keywords: PUF, IoT, blockchain, zero-knowledge proof, authentication, microcontroller, SRAM 1. Introduction The number of objects with embedded microcontrollers (MCUs) connected to the internet of things (IoT) is increasing rapidly [1]—also in the safetyPreprint submitted to Internet of Things May 12, 2019 and security-critical medical, energy and automotive industries. The use of distributed ledger technology in combination with IoT devices has gained a lot of5 attention not only in the financial sector but in many industries as a means to increase trust and visibility, e.g. along complex supply chains for more accurate goods tracing, counterfeit detection [2, 3] and information verification [4]. Complex manufacturing lines and distribution systems can be securely monitored and documented such that downstream business processes can validate10 the provenance of products. This back-to-birth traceability is critical and often even mandatory, e.g. in the airline industry for life-limited parts [5] or in the pharma sector for prescription medicine [6]. Likewise, upstream business processes can determine the recipients of goods, for instance in case of a product recall.15 Blockchains leverage cryptography, distributed protocols, and privacy-enabling techniques (e.g. zero-knowledge protocols, threshold-signature schemes) to enable trust and to control visibility of the information in multi-party environments [7]. In this regard, it is of crucial importance the privacy protection in blockchain-based IoT systems from issues caused due to information leakage20 [8]. A blockchain alone, however, is often insufficient to prove product originality or provide an uninterrupted and indisputable chain of custody throughout the product life-cycle because it cannot guarantee the uniqueness of a physical entity. In addition, an IoT connection is commonly used to monitor or control an25 object connected to the blockchain. This connection with physical devices is necessary, but it opens the door to new attack vectors such as the injection of hardware vulnerabilities by a malicious firmware update [9]. For security, cryptographic protocols authenticate the objects with keys or passwords configured by the manufacturer1. Authentication also addresses counterfeit products and30 fake replacement parts which are becoming more sophisticated and present a major problem to many industries [10]. 1By manufacturer we refer to the integrator rather than the producer of the MCU chip. 2 Hence, an IoT-enabled home appliance such as a washing machine whose controller board features a network connection must be secure, not only to protect itself from attacks but to protect also the network to which it is connected.35 In the production process, the manufacturer configures the controller with a cryptographic key and store the counterpart key in a database.2Once sold and deployed in the field, the machine may require services offered by the manufacturer. To authenticate the machine, the manufacturer sends a challenge that the machine must answer employing its secret key. The manufacturer verifies40 the response using the counterpart key. Beyond authentication, the secret key may also be used for signing data sent by the machine, e.g., sensor readings, attesting from which machine they originate. In MCUs, the secret key must be stored in a way that is not accessible from the outside to make them impossible to copy into a counterfeit. The se-45 cure elements that provide such storage [11], however, add significant cost and, consequently, few controllers have them. In this paper, an alternative authentication approach in which an MCU generates a secret key internally is introduced, exploiting manufacturing variability as a physical unclonable function (PUF). As the key is generated by the de-50 vice itself, manufacturers save the expense of a secure environment for external key generation. In production, once chips are loaded with a firmware, it is only necessary to run an internal characterization and pass on the resulting public key, mask and helper data to be stored for authentication and recovery. Further external memory access is prevented, e.g., by blowing the JTAG security fuse.55 As the secret key is regenerated (with the same result each time) rather than stored in non-volatile memory, it is very hard to clone and the cost of a secure element can be saved. The case for such IoT devices is strengthened further in combination with a distributed ledger, or blockchain. First of all, the immutability and distributed60 2In asymmetric cryptography, the device is configured with a private key and the manufacturer stores the public key; in symmetric cryptography, both hold the same secret key. 3 trust provided by a blockchain can make the device authentication independent of the manufacturer. Secondly, a business process implemented in chaincode that relies on IoT inputs can validate device signatures to ensure the authenticity and integrity of those inputs. Replacing the central database operated by a manufacturer with a blockchain65 makes the system independent of the manufacturer. The chaincode will still allow only the manufacturer to create new machine entries on the distributed ledger but as the ledger content is distributed to all participants (multiple manufacturers, retailers, owners, etc.) the manufacturer is relieved of administering the system and guaranteeing its availability. A central database would go offline70 when the manufacturer goes out of business whereas a blockchain can survive. Given the security disadvantages of symmetric authentication schemes (keeping a database of keys to authenticate with the risk of being hacked or lost, the risk of cloning, and barriers for third-party authentication, among others) our approach instead uses public-key cryptography based on learning parity with75 noise (LPN) problems, and in particular zero-knowledge (ZK) protocols to further simplify the management of device public keys. The blockchain may make the public keys generated by each device available for anyone to use in their own authentication system. As for the second aspect, even a low-cost device can prevent manipulation80 of its communication with a blockchain by signing its messages with our PUFderived keys, making the proposal suitable for any resources-limited device connected to the blockchain [9]. The chain code, in turn, can also validate the device signatures to ensure data integrity and authenticity, extending the trust the blockchain provides into the IoT device.85 This paper proposes using an SRAM-based PUF to generate cryptographic keys that are employed in a zero-knowledge proof to authenticate an IoT device. We present an efficient implementation in an MCU and show that even low-cost devices can perform the required computational tasks sufficiently fast. Experimental results demonstrate that our approach is robust against temperature90 variations and that collisions of device identities are unlikely. 4 This paper is structured as follows. Section 2 reviews related work in digital and physical trust on the blockchain as well as PUFs using LPN problems to understand PUFs, ZK proofs of knowledge, and exact LPN (xLPN) problems. Section 3 describes our proposal to use PUFs in cryptosystems based on xLPN95 problems. An efficient implementation of the proposal on an MCU is described in Section 4. Experimental results of the implementation are presented in Section 5. Finally, conclusions and future work are given in Section 6. 2. Preliminaries 2.1. Extension of trust into physical products100 An extension of the blockchain-provided trust beyond the digital into the physical domain is required to reliably determine product originality or to accurately trace the movement of goods. The physical objects must be unequivocally tied to their associated digital records. Typically, a unique identifier (UID) is used to link a physical object to a digital record. The identifier can be unique in105 the sense that it represents an individual object, or it can more broadly identify a class of objects by model, batch, production site, manufacturer or similar [12]. A UID is typically attached as a tag, printed or embossed on the object or its packaging. Such identifiers, however, can often easily be cloned or transfered to a fake object. Hence, an identifier alone cannot uniquely and securely identify,110 i.e., authenticate an object. A broad variety of concepts and solutions has been studied and introduced to identify objects securely and uniquely. The concepts include hard-to-clone electronic tags [13], embedded security features such as those found in banknotes, all the way to physical fingerprints of the objects themselves. Such fingerprints115 typically result from uncontrollable material or manufacturing variabilities and are well studied in the context of PUFs [14, 15]. Examples include the structure of leather, the imprint of production-line tools, or the doping in semiconductors. The variability may be a common production side-effect (intrinsic) or specifically introduced (extrinsic), for instance by adding special particles [16] or color120 5 codes [17] to medical products. 2.2. PUFs and computationally hard problems The term PUF was used for the first time to characterize the physical microstructure introduced by random variations of a manufacturing process, particularly of the CMOS fabrication process [18, 19]. The unique variations be-125 tween CMOS components are exploited by a hardware PUF to generate unique, component-specific responses to identical challenges. However, since PUF responses change slightly from one measurement to another, the use of a fuzzy extractor was proposed to help reconstructing a constant and unique response linked to the physical characteristics of a PUF [20].130 Recently, the use of learning with error (LWE) problems was proposed [21] in a LWE-based lossless computational fuzzy extractor as a way to protect secret information in a computationally secure manner. In a very similar way, [22, 23] used learning parity with noise (LPN) to create a computational fuzzy extractor and cryptographically-secure PUF. That proposal uses an LPN-based135 challenge-response protocol together with a symmetric key (obfuscated by the computational fuzzy extractor) to authenticate the PUF. Despite the interesting advantages of computational fuzzy extractors, their use is outside the scope of this work, and we will use only traditional fuzzy extractors for simplicity. 2.3. Physical unclonable functions properties and metrics140 There is always unavoidable variability during the manufacturing process of any device. In this context, a PUF is a physically evaluated function that exploits the random variability unintentionally introduced in the device production. Because of the uncontrollable nature of these variations, they are impossible to clone and the responses to a challenge can identify different devices uniquely,145 like fingerprints. To be considered as a PUF, the following properties must be satisfied [15]: •Reproducibility: The response of a PUF to a given challenge must be the same over time. 6 •Uniqueness: The responses of different PUFs to a given challenge must be150 very different. •Unpredictability: If different challenges are provided to a PUF, its responses must be completely different and unpredictable. As PUF responses are typically digital these properties are commonly evaluated using the Hamming distance (HD) [24] which represents the percentage of different bits between PUF responses as follows: HD(fi, gj) = 1 L L−1 X b=0 fi[b]⊕gj[b] (1) where fiand gjrepresent the response of a PUF fto the challenge iand gto the challenge j, respectively; Lis the length of the response vector in bits and155 bis a bit position in the response vector, and ’⊕’ denotes bitwise XOR. If fis the response of a PUF at a time t=t1to a given challenge i, and g is the response of this PUF at time t=t2to the same challenge (i=j) then Equation 1 yields the intra-device Hamming distance (intra-HD), evaluating the reproducibility of the PUF responses by its error, which ideally should be 0. If,160 in contrast, gis the response of this PUF at t=t1to a different challenge (i6=j) then Equation 1 evaluates the unpredictability of the PUF responses by their similarity, with an ideal value of 50%. Finally, if gis the response of another PUF at any time to the same challenge, then Equation 1 gives the inter-device Hamming distance (inter-HD) and evaluates the uniqueness of the PUFs by the165 similarity of their responses, whose ideal value is 50%. Another metric that can be used to evaluate the PUF properties is the minimum entropy [24]. It gives the percentage of randomness in a set of sequences with the following equation: Hmin (pmax) = 1 L L−1 X b=0 −log2(pmax [b]) (2) where pmax [b] represents the maximum probability of taking logic value 0 or 1 observed at the bth bit of the PUF response. 7 If pmax [b] is calculated in a single PUF using responses over time to the same challenge, then Equation 2 evaluates the reproducibility and the minimum170 entropy should ideally be 0. If the responses are generated using different challenges, then it evaluates the unpredictability and the minimum entropy should ideally be 100%. Finally, if the responses are obtained from different PUFs, then the property evaluated is the uniqueness, and the minimum entropy should ideally be 100%.175 2.4. Fuzzy extractors PUF responses will be very similar but not exactly the same for successive generations. Therefore, an error-correcting code (ECC) has to be implemented to reconstruct a stable response. Fuzzy extractors [25] have been widely used in PUFs together with a soft-decision helper-data algorithm [20]. The PUF quality180 can be further improved by conditioning responses to eliminate unstable bits and bias. To do this, the algorithm described in [26, 27] first takes multiple responses from a PUF and compares them to detect which bits of the response are stable and which bits are unstable. This result is expressed as masks of stable and185 unstable bits. Considering only the stable bits increases the reproducibility of the PUF responses. The masks are used to create unique identifiers or keys from stable bits, and random seeds from unstable bits. The stable bits selected from the PUF response may be biased towards either 1 or 0 and therefore must be conditioned before being used in a cryptographic190 algorithm. In [26], the pair-output von Neumann algorithm (2O-VN) is introduced for debiasing. It creates another mask that, combined with the mask of stable bits, results in a selection mask. The bit sequence obtained after applying the selection mask is a PUF response with higher reproducibility and unpredictability, thus suitable for cryptography.195 The operation of fuzzy extractors can be divided into two phases: registration and generation. The registration phase takes the debiased string of the PUF, D, and combines it with an n-times repetition of a secret key s,C=REPEAT(s, n), 8 Subsection 2.6, the device needs the secret error, e, to calculate C2. Since the device stores its public key (or it is provided from the outside after it is powered up), it can compute e=A·s⊕y. Besides, this error can be verified as easily as counting the number of bits with value ’1’ of the vector obtained, i.e., calculating350 its Hamming weight. As explained in [29], if there were a single wrong bit in s, the vector eobtained would look like a uniform random variable, and the probability that its weight were equal to wwould be negligible thanks to the hardness of the xLPN problem. This allows the device not only to verify the correctness of the error but also to detect it before exchanging any message in355 the ZK protocol. 4. Efficient implementation on a microcontroller 4.1. Hardware platform One of the main challenges of many cryptographic algorithms is the transition from theoretical description to implementation, especially when it comes360 to making efficient use of hardware resources. We used SRAM PUFs of commercial microcontrollers [26] to obtain the intrinsic identity of electronic devices and test its suitability as secrets for the ZK proofs detailed in Section 3. The interactive zero-knowledge proofs make it impossible to transfer the trust, and so the identity cannot be counterfeited.365 While the protocol is generic and simple enough to work in any microcontroller, the ideal device should have enough persistent memory to store characterization data (such as matrix A) to avoid recalculating it for every iteration or receiving it from the verifier. It is also recommended to have cryptographic accelerators available in low power microcontrollers to simplify the design, all370 without having to draw upon more expensive high-frequency processors or DSPs. We have implemented our approach on a Texas Instruments (TI) LaunchPadTM development kit with a 16-bit RISC MSP430FR5994 microcontroller at 16 MHz. In addition, we designed a command-line interface (CLI) in MATLABTM to interact with the microcontroller via a serial port. In this setup,375 15 the microcontroller acts as prover while the CLI acts as a verifier and sends challenges in order to verify the ZK proofs. The microcontroller has 8 KB of SRAM, 256 KB of ferroelectric randomaccess memory (FRAM) and uses a library that implements the NIST standard of the counter-mode deterministic random bit generator (CTR-DRBG) [35] us-380 ing its AES hardware accelerator. It also has a low-energy accelerator for signal processing, several ultra-low-power modes, and up to four eUSCI ports (TI’s enhanced universal serial communication interface). We used all these characteristics to simplify the development of our proof of concept. Regarding the use of PUFs, the device self-characterization is more resource-385 demanding than the verification step. However, this process is carried out only at the registration phase of the fuzzy extractor and can be fully automated within the device. With respect to the ZK protocol, the tasks that require the highest computational power are the multiplication of matrices and the generation of random numbers. The implementation of all these algorithms and the particular390 solutions proposed are presented in the following. 4.2. Self-characterization While many TI microcontrollers are low power, those of the FRAM family feature ultra-low-power modes. They can shut down parts of the system on a chip (SoC) in a controlled way, powering down transceivers and peripherals,395 clocks and the SRAM. We use the ultra-low-power mode LPM 3.5 and the real-time clock to power cycle the processor after a predefined time to erase the information stored in SRAM and all registers. After each power cycle, the SRAM start-up values represent the PUF responses used in the fuzzy extractor, as detailed in Subsec-400 tion 2.4. The FRAM, which is non-volatile, is employed to store the multiple measurements of PUF responses needed to generate the bit-selection mask. 4.3. Matrix and vector operations in xLPN Matrix and vector multiplications are computationally costly operations. In the protocol employed, they are required to generate the public key in the form405 16 y=A·s⊕e, to calculate the perfectly binding commitment (as detailed in Subsection 2.6), and to generate the commitment messages of the proofs (as detailed in Subsection 2.7). As discussed in [29], xLPN operations have a similar complexity to decoding random linear codes. Thanks to working with binary vector products and XOR410 sums, the operations are equivalent to performing linear combinations of vectors. The binary vector sin the operation y=A·s⊕eindicates which columns of A should participate in the calculation of the parity sum along with the vector e. Only the columns that are multiplied by a non-zero value affect the result. One way to combine the vector products is employing XOR sums, reducing the xLPN415 product to linear combinations of the columns of Athat are multiplied by nonzero elements of s. Figure 2 shows an example in which the non-zero elements of s are {0,2,3}, and therefore ycan be calculated as y=A(:,0)⊕A(:,2)⊕A(:,3)⊕e. 𝒚 = 𝑨 ∙ 𝒔 ⨁ 𝒆 𝑘 𝑘 ℓ + 𝑛 𝑘 ℓ+ 𝑛 10101 10001 10110 10011 00100 11010 10001 00101 11001 01100 1 0 1 1 0 0 0 1 0 0 0 0 0 0 1 0 1 0 0 1 0 1 1 1 0 Figure 2: Linear combinations of Acolumns with noise e. When this operation is used to calculate the commitments, the claimed in17 formation must be compacted to the size of s, which is analogous to generating420 multiple products of matrix Awith pieces of the claim, and then add an error e. In other words, when used for calculating Com(m) = A·(r||m)⊕ewith m∈ In, if for example the claim mhad size k=O(n) = β·ninstead of size n, and it could be described as m= [m1, m2, ..., mβ], then: Com(m) = β M i=1 [A·(ri||mi)] ⊕e=A· r|| β M i=1 [mi]!⊕e for eR ← Ik w,ri R ← I`, and Lβ i=1 ri=r. In this equation, the message of425 length βn is compacted using XOR operations into a message of length n, and only a single xLPN operation is required to calculate the commitment of this claim. This compression is very useful especially for the commitment of the random permutation which helps to reduce the size from k·log2(k) to n. 4.4. Variants of the deterministic random bit generator430 The protocol requires random vectors from a uniform distribution in multiple steps. We generate them using the microcontroller’s AES hardware accelerator in the NIST approved CTR-DRBG mode4. Other parts of the algorithm, such as the weighted errors or the random vector permutations, require random sequences of a different nature. The algorithms used to adapt the random number435 generator to fulfill these protocol requirements are described in the following. 4.4.1. Weighted uniform random bit generator The CTR-DRBG functions are used to generate a weighted uniform distribution. The sequences needed by the xLPN problem should have a Hamming weight not of won average but exactly equal to w. To achieve this, the imple-440 mented algorithm starts from an all-zeros vector of kelements denoted as 0k. Since the resulting vector must have a constant weight, it means that w=bτke ones are inserted in the sequence of zeros. The positions in which the wones are 4Alternatively, a C implementation of the AES algorithm can be used for a processor without such an accelerator. 18 introduced follow a uniform distribution of random values in the range [0, k −1] provided by the CTR-DRBG. If a random position is repeated, it is discarded,445 and a new position is generated until wones are inserted. Figure 3 shows the diagram that describes the algorithm. 2 For that reason, our modification over the Knuth Shuffle algorithm performs a modulo operation, but only using powers of 2 𝑤 [0,𝑘 − 1] 0𝑘→ 1𝑤 Figure 3: Weighted random number generator using CTR-DRBG. 4.4.2. Random permutation generation Instead of generating random positions by trial and error for all elements of a vector, we developed and implemented a variant of the Knuth shuffle algorithm.450 The original algorithm starts with any permutation (for example, the identity permutation) written to a string π[ ] of size k. Then, it points to positions 0 through k−2 using an index variable i(assuming the vector elements are indexed 0 to k−1). For each position of i, the algorithm swaps the element in that position with a randomly chosen element between and including positions455 iand k−1 (the end of the vector). There are some issues regarding the random number generation in the range ito k–1. The CTR-DRBG of the chosen microcontroller always produces a 128-bit output, so the output is post-processed to match the interval [i, k–1]. 19 Applying techniques such as modulo operator to the output of the RNG will not460 generate the uniform output in the desired range but a biased string in which the lower part of the range has a higher probability of occurrence. [𝑘 − 𝑥,𝑘 − 1] M random numbers (positions) 0 𝑘 zeros bit string 𝑘 bits with exactly ⌊𝑘 × 𝜏⌉ weight 1 ⌊𝑘 × 𝜏⌉ one bits 𝑚𝑜𝑑(𝑥)+𝑘 − 𝑥 [0,2128 − 1] Figure 4: Random permutation generator based on the Knuth shuffle. To address this problem, our modification of the Knuth shuffle algorithm, shown in Figure 4, performs a modulo operation using only powers of 2 (which is equivalent to eliminating the least significant bits). With this change it gen-465 erates random numbers in the range [0, x −1] for x= 2n, making the Knuth shuffle algorithm more efficient while maintaining a probability of occurrence that follows the uniform distribution. Besides, kmust be a power of two so that the absence of bias is also satisfied when reducing the range of random numbers from [0,2128 −1] to [0, k−1]. It is worth noting that modulo 2noperations can be470 implemented by shifting a register by nbits. This greatly simplifies computing on any device with limited resources. 20 The modified Knuth shuffle algorithm for random permutations is summarized in algorithm 1. The probability of repeating a random position will be always in the range (0,0.5) with this modification. With the original imple-475 mentation (without applying modulo) the probability of repeating a random position tends to (1 −1/k) when itends to k. Given that each iteration of the ZK protocol requires permutations, this improvement substantially increases the performance of our implementation. Algorithm 1 Random permutation generator based on the Knuth shuffle procedure Generate a random permutation, π∈ Sk Initialize variables: π←[0,1,2,3, ..., k −2, k −1] i←0 while i < k: x←2dlog2(k−i)e p←CTR-DRBG[0,2128 −1] mod (x)+k−x if p≥ithen swap(π[i], π[p]) i←i+ 1 5. Experimental results480 This section details the experimental results as well as the protocol implementation. Protection of the device against side-channel attacks is beyond the scope of this work. To prevent some of these attacks, such as differential power analysis (DPA), the system should be built in such a way that it is impossible to extract any information from the outside, e.g., by measuring electromagnetic485 radiation. Considering attacks via the JTAG port, the security fuses should be blown once the device is put into production. These countermeasures are considered standard in the industry when dealing with secure systems. We ran the experiments on 10 TI LaunchPadsTM with MSP430FR5994 mi21 crocontrollers. In total we took 120 readings of the complete SRAM (8 KB)490 of each microcontroller at 3 different temperatures, with the device powered off between measurements for two seconds by LPM 3.5.5This number of measurements and operating conditions have proven to be sufficient to characterize SRAMs correctly and obtain their mask in an efficient way [24]. From each set of 120 measurements, we used 20 measurements to compute the selection495 mask of the devices. With the remaining 100 measurements we evaluated the properties of the microcontroller SRAM PUFs (reproducibility, uniqueness, and unpredictability). As shown in [24], temperature variations alter the behavior of SRAM PUFs significantly. The temperatures supported by the microcontroller range from500 −40 ◦C to +85 ◦C, according to the manufacturer. We conducted experiments at a±5◦C margin from these boundaries, at −35 ◦C and 80 ◦C, and at a controlled nominal temperature of 25 ◦C. We calculated the intra-device Hamming distance (intra-HD) and interdevice Hamming distance (inter-HD) according to Equation 1. Figure 5(a) shows505 intra-HD in one device at −35 ◦C with and without selection mask, and Figure 5(b) the inter-HD considering all the 10 devices at −35 ◦C. Figures 6 and 7 show the same intra-HD and inter-HD representations at 25 ◦C and 80 ◦C, respectively. It can be seen how the selection mask drastically reduces the intra-HD by510 more than 50% at extreme temperatures, and approximately 90% in nominal conditions, approaching the optimal intra-HD value of 0%. The inter-HD distributions, on the other hand, are practically unaffected by the mask with averages around the ideal uniqueness value of 50%. Another critical part of the zero-knowledge proof protocol is the generation515 of random numbers. It is important to evaluate the quality, i.e., unpredictability 5The time between measurements has been determined by characterizing the microcontrollers of this particular prototype. It must be adjusted for each individual type of microcontroller or integrated circuit. 22 (a) (b) Figure 5: Intraand inter-device Hamming distance (expressed in %) with and without selection mask at −35 ◦C. of the seeds that are used to feed the pseudorandom number generator. Since these seeds come from the unstable cells of the SRAM, we must evaluate their minimum entropy as detailed in Equation 2. The experimental results for this metric can be seen in Figure 8, with and without selection mask, at −35 ◦C,520 25 ◦C and 80 ◦C. 10 20 30 40 50 60 70 80 90 100 Number of measurements 0 5 10 15 20 25 30 35 Percentage of Hmin Masked at -35ºC Unmasked at -35ºC Masked at 25ºC Unmasked at 25ºC Masked at 80ºC Unmasked at 80ºC Figure 8: Minimum entropy at −35 ◦C, 25 ◦C and 80 ◦C, with and without selection mask. 23 (a) (b) Figure 6: Intraand inter-device Hamming distance (expressed in %) with and without selection mask at 25 ◦C. Tables 1 and 2 show the individual measurements of average intra-HD and minimum entropy in the ten devices, characterized at −35 ◦C, 25 ◦C and 80 ◦C, both with and without the mask. We observe that the relative behavior of all devices is similar, just showing slightly different absolute values owing to their525 different manufacturing variations. Device 1 2 3 4 5 6 7 8 9 10 Unmasked at −35 ◦C 5.18 5.31 5.02 4.24 3.98 4.94 4.23 5.14 4.91 4.86 Masked at −35 ◦C 1.99 3.86 3.79 3.86 2.31 2.35 1.96 3.96 1.95 2.65 Unmasked at 25 ◦C 4.98 5.02 4.90 5.03 4.27 4.89 4.58 4.58 5.02 4.59 Masked at 25 ◦C 0.44 0.45 0.42 0.45 0.36 0.43 0.40 0.38 0.42 0.33 Unmasked at 80 ◦C 4.85 4.71 4.67 4.40 4.80 4.71 4.90 3.57 4.41 4.11 Masked at 80 ◦C 2.45 2.70 2.48 3.50 3.51 2.41 3.36 1.58 2.01 1.98 Table 1: Average intra-HD percentage of ten devices at −35 ◦C, 20 ◦C and 80 ◦C with and without mask. 24 References [1] A. Nordrum, Popular Internet of Things Forecast of 50 Billion Devices by 2020 Is Outdated, IEEE Spectrum (2016) 0–2.635 URL https://spectrum.ieee.org/tech-talk/telecom/internet/ popular-internet-of-things-forecast-of-50-billion-devices-by-2020-is-outdated [2] N. Kshetri, Blockchain’s roles in meeting key supply chain management objectives, International Journal of Information Management 39 (2018) 80–89. doi:10.1016/J.IJINFOMGT.2017.12.005.640 URL https://www.sciencedirect.com/science/article/pii/ S0268401217305248 [3] K. W¨ust, A. Gervais, Do you need a Blockchain?, eprint.iacr.org. URL https://eprint.iacr.org/2017/375.pdf [4] Q. Xu, C. Jin, M. F. B. M. Rasid, B. Veeravalli, K. M. M. Aung,645 Blockchain-based decentralized content trust for docker images, Multimedia Tools and Applications 77 (14) (2018) 18223–18248. doi:10.1007/ s11042-017-5224-6. URL http://link.springer.com/10.1007/s11042-017-5224-6 [5] Preserving aircraft value: technical records in commercial leases.650 URL https://aerotime.aero/zivile.zalagenaite/ 20740-preserving-aircraft-value-technical-records-in-commercial-leases [6] Pharmaceutical Traceability. URL https://www.hda.org/issues/pharmaceutical-traceability [7] E. Androulaki, A. Barger, V. Bortnikov, C. Cachin, K. Christidis, A. De655 Caro, D. Enyeart, C. Ferris, G. Laventman, Y. Manevich, S. Muralidharan, C. Murthy, B. Nguyen, M. Sethi, G. Singh, K. Smith, A. Sorniotti, C. Stathakopoulou, M. Vukoli´c, S. W. Cocco, J. Yellick, Hyperledger Fabric: A Distributed Operating System for Permissioned Blockchains, in: Proceedings of the Thirteenth EuroSys Conference, ACM, 2018. doi:660 31 10.1145/3190508.3190538. URL http://arxiv.org/abs/1801.10228 [8] M. U. Hassan, M. H. Rehmani, J. Chen, Privacy preservation in blockchain based IoT systems: Integration issues, prospects, challenges, and future research directions, Future Generation Computer Systems 97 (2019)665 512–529. doi:10.1016/J.FUTURE.2019.02.060. URL https://www.sciencedirect.com/science/article/pii/ S0167739X18326542 [9] M. A. Khan, K. Salah, IoT security: Review, blockchain solutions, and open challenges, Future Generation Computer Systems 82 (2018) 395–411.670 doi:10.1016/j.future.2017.11.022. URL https://linkinghub.elsevier.com/retrieve/pii/ S0167739X17315765 [10] M. M. Tehranipoor, U. Guin, S. Bhunia, Invasion of the hardware snatchers, IEEE Spectrum 54 (5) (2017) 36–41. doi:10.1109/MSPEC.2017.7906898.675 URL http://ieeexplore.ieee.org/document/7906898/ [11] C. Shepherd, G. Arfaoui, I. Gurulian, R. P. Lee, K. Markantonakis, R. N. Akram, D. Sauveron, E. Conchon, Secure and Trusted Execution: Past, Present, and Future - A Critical Review in the Context of the Internet of Things and Cyber-Physical Systems, in: 2016 IEEE680 Trustcom/BigDataSE/ISPA, IEEE, 2016, pp. 168–177. doi:10.1109/ TrustCom.2016.0060. URL http://ieeexplore.ieee.org/document/7846943/ [12] GS1 UniqueID — GS1. URL https://www.gs1.org/gs1-uniqueid685 [13] CryptoSeal (CSS100) – Chronicled. URL https://store.chronicled.com/products/crypto-seal-strip 32 [14] R. Maes, Physically unclonable functions : constructions, properties and applications, Springer, 2013. [15] C. B¨ohm, M. Hofer, C. Bohm, M. Hofer, Physical Unclonable Functions in690 Theory and Practice., Springer, 2012. doi:10.1007/978-1-4614-5040-5. [16] G. M. Miyake, R. A. Weitekamp, V. A. Piunova, R. H. Grubbs, Synthesis of Isocyanate-Based Brush Block Copolymers and Their Rapid Self-Assembly to Infrared-Reflecting Photonic Crystals, Journal of the American Chemical Society 134 (34) (2012) 14249–14254. doi:10.1021/ja306430k.695 URL http://pubs.acs.org/doi/10.1021/ja306430k [17] O. G¨ok¸ce, C. Mercandetti, E. Delamarche, High-Content Optical Codes for Protecting Rapid Diagnostic Tests from Counterfeiting, Analytical Chemistry 90 (12) (2018) 7383–7390. doi:10.1021/acs.analchem.8b00826. URL http://pubs.acs.org/doi/10.1021/acs.analchem.8b00826700 [18] R. Pappu, B. Recht, J. Taylor, N. Gershenfeld, Physical One-Way Functions, Science 297 (5589). [19] B. Gassend, D. Clarke, M. van Dijk, S. Devadas, Silicon physical random functions, in: Proceedings of the 9th ACM conference on Computer and communications security - CCS ’02, ACM Press, New York, New York,705 USA, 2002, p. 148. doi:10.1145/586110.586132. URL http://portal.acm.org/citation.cfm?doid=586110.586132 [20] R. Maes, P. Tuyls, I. Verbauwhede, Low-Overhead Implementation of a Soft Decision Helper Data Algorithm for SRAM PUFs, Springer, Berlin, Heidelberg, 2009, pp. 332–347. doi:10.1007/978-3-642-04138-9_24.710 URL http://link.springer.com/10.1007/978-3-642-04138-9{_}24 [21] C. Huth, D. Becker, J. G. Merchan, P. Duplys, T. Guneysu, Securing Systems With Indispensable Entropy: LWE-Based Lossless Computational Fuzzy Extractor for the Internet of Things, IEEE Access 5 (2017) 11909– 33 11926. doi:10.1109/ACCESS.2017.2713835.715 URL http://ieeexplore.ieee.org/document/7944563/ [22] C. Herder, L. Ren, M. van Dijk, M.-D. Yu, S. Devadas, Trapdoor computational fuzzy extractors and stateless cryptographically-secure physical unclonable functions, IEEE Transactions on Dependable and Secure Computing 14 (1) (2017) 65–82. doi:10.1109/TDSC.2016.2536609.720 URL http://ieeexplore.ieee.org/document/7422776/ [23] C. Jin, C. Herder, L. Ren, P. Nguyen, B. Fuller, S. Devadas, M. van Dijk, FPGA Implementation of a Cryptographically-Secure PUF Based on Learning Parity with Noise, Cryptography 1 (3) (2017) 23. doi: 10.3390/cryptography1030023.725 URL http://www.mdpi.com/2410-387X/1/3/23 [24] I. Baturone, M. A. Prada-Delgado, S. Eiroa, Improved Generation of Identifiers, Secret Keys, and Random Numbers From SRAMs, IEEE Transactions on Information Forensics and Security 10 (12) (2015) 2653–2668. doi:10.1109/TIFS.2015.2471279.730 URL http://ieeexplore.ieee.org/document/7217837/ [25] Y. Dodis, R. Ostrovsky, L. Reyzin, A. Smith, Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data, SIAM Journal on Computing 38 (1) (2008) 97–139. doi:10.1137/060651380. URL http://epubs.siam.org/doi/10.1137/060651380735 [26] M. A. Prada-Delgado, A. Vazquez-Reyes, I. Baturone, Physical unclonable keys for smart lock systems using Bluetooth Low Energy, in: IECON 2016 - 42nd Annual Conference of the IEEE Industrial Electronics Society, IEEE, 2016, pp. 4808–4813. doi:10.1109/IECON.2016.7792955. URL http://ieeexplore.ieee.org/document/7792955/740 [27] R. Arjona, M. A. Prada-Delgado, J. Arcenegui, I. Baturone, A PUFand Biometric-Based Lightweight Hardware Solution to Increase Security at 34 Sensor Nodes, Sensors 18 (8) (2018) 2429. doi:10.3390/s18082429. URL http://www.mdpi.com/1424-8220/18/8/2429 [28] S. Goldwasser, S. Micali, C. Rackoff, The knowledge complexity of inter-745 active proof-systems, in: Proceedings of the seventeenth annual ACM symposium on Theory of computing - STOC ’85, ACM Press, New York, New York, USA, 1985, pp. 291–304. doi:10.1145/22145.22178. URL http://portal.acm.org/citation.cfm?doid=22145.22178 [29] A. Jain, S. Krenn, K. Pietrzak, A. Tentes, Commitments and Efficient750 Zero-Knowledge Proofs from Learning Parity with Noise, Springer, Berlin, Heidelberg, 2012, pp. 663–680. doi:10.1007/978-3-642-34961-4_40. URL http://link.springer.com/10.1007/978-3-642-34961-4{_}40 [30] N. M. D¨ottling, Cryptography based on the Hardness of Decoding, Ph.D. thesis (2014).755 [31] K. Pietrzak, Cryptography from Learning Parity with Noise, Springer, Berlin, Heidelberg, 2012, pp. 99–114. doi:10.1007/978-3-642-27660-6_ 9. URL http://link.springer.com/10.1007/978-3-642-27660-6{_}9 [32] N. Yao, Y. Yu, X. Li, D. Gu, On the Robustness of Learning Par-760 ity with Noise, Springer, Cham, 2016, pp. 99–106. doi:10.1007/ 978-3-319-50011-9_8. URL http://link.springer.com/10.1007/978-3-319-50011-9{_}8 [33] E. Barker, A. Roginsky, Recommendation for Cryptographic Key Generation, Tech. rep., National Institute of Standards and Technology,765 Gaithersburg, MD (dec 2012). doi:10.6028/NIST.SP.800-133. URL https://nvlpubs.nist.gov/nistpubs/SpecialPublications/ NIST.SP.800-133.pdf [34] L. Chen, Recommendation for key derivation using pseudorandom functions (revised), Tech. rep., National Institute of Standards and Technology,770 35 Gaithersburg, MD (2009). doi:10.6028/NIST.SP.800-108. URL https://nvlpubs.nist.gov/nistpubs/Legacy/SP/ nistspecialpublication800-108.pdf [35] E. B. Barker, J. M. Kelsey, Recommendation for Random Number Generation Using Deterministic Random Bit Generators, Tech. rep., National775 Institute of Standards and Technology, Gaithersburg, MD (jun 2015). doi:10.6028/NIST.SP.800-90Ar1. URL https://nvlpubs.nist.gov/nistpubs/SpecialPublications/ NIST.SP.800-90Ar1.pdf [36] A. Esser, R. K¨ubler, A. May, LPN Decoded, Springer, Cham, 2017, pp.780 486–514. doi:10.1007/978-3-319-63715-0_17. URL http://link.springer.com/10.1007/978-3-319-63715-0{_}17 36