Cracking 65nm PUFs: The Power of Environmental Fault Injection

TL;DR

Hardware security often relies on Physically Unclonable Functions (PUFs) to act as a unique "fingerprint" for chips. However, researchers Jeroen Delvaux and Ingrid Verbauwhede have demonstrated that by simply "tweaking" the environment—specifically the supply voltage—they can accelerate modeling attacks by 2.4x, achieving over 98% prediction accuracy. This work shifts the threat landscape from pure Machine Learning (ML) to a hybrid of side-channel analysis and fault injection.

Problem & Motivation: The "Noise" is a Signal

Historically, Strong PUFs (like Arbiter and RO Sum PUFs) were considered secure because they have an exponential number of challenge-response pairs (CRPs). While ML attacks can model them, they usually require thousands of binary responses.

The authors' core insight is that imperfections are features. CMOS device noise makes some responses "unstable" (flipping between 0 and 1). Instead of viewing this instability as an error to be corrected, the authors treat it as a side channel. This instability provides a window into the analog internal values (like delay differences) before they are "squashed" into a binary 0 or 1. If we can increase the number of these unstable points, we can clone the PUF's behavior much faster.

Methodology: Turning the Dial on Voltage

The researchers moved beyond passive observation of noise. They actively injected "faults" by changing the supply voltage (0.95V to 1.45V) and temperature.

The Linear Model

Both Arbiter and RO Sum PUFs have an additive linear core. For an Arbiter PUF, the total delay difference $\Delta t_V$ is a sum of staged delays. The binary response is simply $r=sgn(\Delta t_V)$. By measuring the Repeatability ($R$)—the frequency of '1's over multiple trials—the authors can reverse the threshold function:

$\Delta x_V(R)=\Delta x_B-\sqrt{2}{\sigma }_{N}erf{c}^{-1}(2R)$

By varying the voltage, they force more challenges into the "critical" zone where the response is unstable, effectively linearizing the entire system for a Least Mean Square (LMS) solver.

Fig: The PUF repeatability model showing how variance (${\sigma }_V$) and noise (${\sigma }_N$) determine the bit-flip probability.

Experiments & Results

The study used real 65 nm silicon chips. They found that supply voltage had a much more significant impact on inducing useful faults than temperature.

Performance Boost

• Arbiter PUF: Accuracy reached 95.9% with just 500 training CRPs.
• RO Sum PUF: Accuracy reached a staggering 99.0% using the same number of training samples.
• Speedup: The fraction of "usable" (unstable) CRPs increased significantly, leading to a 2.4x speedup in the attack process.

Table: Accuracy results for Arbiter PUF under various voltage settings (Fault Injection vs. Side Channel).

Critical Analysis & Conclusion

This paper delivers a sobering message to hardware designers: A PUF that is stable under nominal conditions may be completely transparent under stress.

Key Takeaways:

1. Repeatability is more informative than binary bits: Any side channel that leaks the "certainty" of a PUF response drastically reduces the complexity of a modeling attack.
2. Environmental Resilience is Security: PUFs must be designed to behave consistently across a wide voltage/temperature range, or they must include sensors to shut down when "out-of-nominal" conditions are detected.

Limitations:

While impressive, these attacks still require physical access to the chip to manipulate the voltage. Furthermore, "Controlled PUFs" (which use hashes to hide responses) remain a potent countermeasure, though they come with higher area costs.

The future of PUF security lies in the "joined effort" mentioned by the authors—combining repeatability data with advanced ML architectures to test the ultimate limits of hardware un-clonability.