A Random Number Generator using Metastability

1
A Random Number Generator using Metastability
D.J.Kinniment, and E.G.ChesterUniversity of
Newcastle, UK
2
Outline

• Random Number Generators
• How and why
• Metastability
• Role and characterisation of internal noise
• Device design
• Quality of RNG output
• Imperfections and improvement
• Conclusions
• Entropy, and bit rate

3
Random number generators

• Usually use thermal noise.
• Post-processing.
• to reduce the effects of deterministic internal
  and external influences.
• Full integration.
• For applications like smart card security.
• Vulnerability to attack can be reduced.
• On-chip hardware needed.
• to improve and monitor the quality of the output.
• Need to have high bit rate.
• To allow post processing.
• To permit analysis in real time.

4
Metastability
NODE B
NODE A
OUT
DATA
CLOCK
RESET
D time of data after clock

• Given a decreasing Clock-Data overlap
• Output goes low at first
• Delay increases as overlap becomes small
• Finally output stays high

Propagation delay
5
Typical Histogram

• Suppose two similar dates are in front of a
  hungry man who is unable to take bothcan you
  say the man will be forever hungry?
• Abu Hamid al-Ghazali 1058-1111

0.6mv, 7?
Slope ? 20ps
time
0.6mV is about the level of thermal noise on a
node in 0.18?
6
Randomness from Metastability

• Lots are to be used in things indifferent
• Thomas Gataker 1574-1654

• Hold the bistable close to metastability, and
  then allow it to resolve.
• Offsets must be much smaller than the noise level
  (1mV)
• Use two independent oscillators for clock and
  data, record outputs for which metastability
  lasts longer than 7-8?.
• Ensures start point bias much less than noise,
  but reduces the output rate to only a few bits
  per second.
• two oscillators are in close proximity, and may
  become coupled
• Measure time between clock and resolved output.
• variation in time value bits will not be large

7
R-Flop bistable

Vcc

B

0
A
A


0
1
B

1
V


V

-
Clock

Gnd

Regenerative Latch

Differential Preamplifier

Gain of Preamp is lt1 Vary input slowly and
observe output
8
Noise measurement
Probability of an output 1 as a function of input
voltage difference
9
Noise voltage

• Gate noise voltage eng2 , is proportional to
  kT/C . Where C is the capacitance.
• For our process it is in the range 0.4 mV to 0.5
  mV
• Between nodes B1 and B0 this is ?2 greater, or
  between 0.55 mV and 0.7 mV.
• The noise between A1 and A0 is about 1 mV.
• Gain from A to B was 1/(4.55) in the circuits we
  measured, so total thermal noise should be
  between 1.65mV and 2.1mV at the input.
• Our measurement of approximately 1.7mV RMS at the
  input corresponds to about 0.6mV total between B1
  and B0.

10
Fabrication offsets and design

• Typical variations between transistors give an
  effective gate offset voltage of 10-50mV.
• Node noise voltage is about 1mV
• We can reduce this variation by increasing gate
  areas, but
• Offsets might reduce by 1/?Area
• Noise also reduces by 1/?C
• A reliable design needs lt1mV offset

11
Feedback

• Need to keep device offset low to reduce bias in
  random number distribution.
• Use feedback
• One method uses switched capacitors.

Clock

D Flip-Flop
R-Flop
-
0.01pF
3pF
3pF
0.01pF
12
Simulated feedback waveforms
Output random bit stream
V- Inverter output Input V-
20mV
13
Noise statistics

• The entropy of a k bit key is given byH -? pi
  log2 pi,
• where pi is the probability of state i out of n
  states
• Statistics of noise are affected by circuit
• DC offsets cause predominance of 1 or 0
• Memory effects caused by circuit capacitances
  (probability of next bit affected by previous)
• In our circuit DC bias was small because of
  feedback.
• Deterministic variations in the feedback caused
  60 of bits to be the inverse of the previous bit
• Should be 50.

14
Post processing

• DC bias and memory effects difficult to predict.
• Adding an LFSR to output apparently improves
  statistics, but does not add entropy
• Original input stream can be reconstructed with
  knowledge of LFSR
• Two (or n) independent bit streams can be XORed
  to give better entropy than each of them (but
  reduces the bit rate).
• If each stream has 0.5(1 2x) correlation. N
  streams give 0.5(1 (2x)N). So 61 becomes 52.4
  with two streams

15
Noise quality results
Single bit stream with a parity bit sampled over
2, 4, 6 etc. clocks. 8 bit random sequences give
a variance of 255 in numbers of 8 bit messages
16
Conclusions

• Device completely integrated.
• Output bit rate over 100MHz
• Raw entropy is only 85 because of bit-bit
  correlations.
• Postprocessing reduces bit rate to 20MHz
• Resulting bit stream is indistinguishable from
  random using strongest tests available (99.9
  entropy).
• Deviations from random can be monitored in real
  time because of fast bit rate

17
(No Transcript)