Efficient Error Correction Coding for Physically Unclonable Functions

Abstract

Physically unclonable functions (PUFs) generate keys for cryptographic applications, eliminating the need for conventional key storage mechanisms. Since PUF responses are inherently noise-sensitive, their reliability can decrease under varying conditions. Integrating channel coding can enhance response stability and consistency. This work presents an efficient scheme that integrates a delay-base d PUF with a Low-Density Parity-Check (LDPC) code. Specifically, a feed-forward PUF is combined with LDPC coding to reliably regenerate the cryptographic key. Our design reproduces the key with minimal error using channel coding. The scheme achieves 96% key-generation reliability, representing a notable improvement over PUF-based key generation without error-correction coding. LDPC decoding with the min-sum algorithm provides better error correction than the bit-flipping algorithm, but it is more computationally intensive. We could design the proposed scheme with minimum hardware resource utilization using Xilinx Vivado 2018.2 and Cadence Genus tools.

1. Introduction

PUFs derive their challenge–response behavior from uncontrollable manufacturing variations, including random deviations in device dimensions and gate oxide thickness. These unique variations generate distinct responses to specific challenges, making PUFs effective for device authentication and secure key generation [1,2,3,4,5,6,7].

Arbiter PUF can generate numerous responses based on the applied challenge, while SRAM PUF and Butterfly PUF produce only a limited set of challenge-response pairs. Arbiter PUF generates challenge-response pairs using a delay-based mechanism. In contrast, SRAM PUF and Butterfly operate based on a memory-based bistable structure [1,2,4,6].

The feed-forward physically unclonable function introduces non-linearity through feed-forward loops, making the challenge-response behavior more complex and difficult to predict. This added non-linearity significantly enhances the computational effort required for attacks, thereby improving security for cryptographic key generation in applications such as IoT. Lata et al. [6] present a comparative analysis of various PUF designs, highlighting their respective advantages as well as the challenges associated with each.

PUFs can generate unique, unclonable cryptographic keys for authentication and secure communication, making them suitable for applications in 5G networks [5,6,7]. Environmental factors can lead to inaccuracies in the PUF response, resulting in a bit error rate that affects its reliability. This bit error rate can be mitigated by implementing an error correction coding technique for the PUF response [8,9,10,11,12,13].

Key performance metrics for a PUF design include uniqueness, reliability, randomness, bit error rate, area and power efficiency, and security against attacks. Our work focuses on error correction codes in PUFs, making reliability a critical metric that measures response consistency.

Reliability in data transmission and storage is achieved through Error Correction Coding (ECC) techniques, which identify and correct errors introduced by noise and hardware imperfections. Hamming codes, Reed-Solomon codes, LDPC, and polar codes are widely used to detect and rectify errors within communication systems [8]. Low-Density Parity-Check (LDPC) codes can achieve error correction close to the theoretical limit with efficient decoding, making them highly effective for high-speed applications like 5G networks [14,15].

A wide range of approaches have been explored to apply the error correction coding scheme to physically unclonable functions [8,9,16]. Hiller et al. [8] provide a comparison of various combinations of PUF and channel coding techniques, analyzing bit error rates along with FPGA resource utilization, power consumption, and area as performance metrics. Jarvis et al. [9] compare BCH codes and convolutional codes as error correction methods for PUF. Maes et al. [16] implement a code-offset scheme using repetition and RM codes for SRAM PUF.

In our work, we utilize LDPC coding for reliable key production from a feed-forward arbiter PUF. The decoding process involves both bit-flipping and min-sum algorithms. The bit-flipping algorithm iteratively corrects erroneous bits based on parity check failures. While this approach is straightforward, it tends to perform poorly with high-error-rate PUF responses. Conversely, the min-sum algorithm, which serves as an approximation of belief propagation, optimizes check node updates to achieve near-Shannon-limit error correction while maintaining compact hardware utilization.

Background and related studies are discussed in Section 2. The proposed method is outlined in Section 3. Section 4 presents the results and analysis, including a comparison with related work. Finally, Section 5 addresses the challenges encountered and suggests possible future work to enhance the system.

2. Background and Related Work

2.1. Arbiter PUF

The Arbiter PUF is a type of physically unclonable function that operates based on delay variations. Arbiter PUF structure is shown in Figure 1. The Arbiter PUF consists of 2-to-1 multiplexers and a D flip-flop, which functions as an Arbiter. For an n-bit Arbiter PUF, $2^n$ multiplexers will be connected as illustrated in Figure 1. The challenge bits are utilized as select lines for each multiplexer. Variations in manufacturing can lead to delays in input arrival times to the D flip-flop, resulting in unpredictable outputs. This randomness in the PUF response makes it challenging for attackers to anticipate, allowing it to be effectively used as a key for cryptographic applications in IoT and embedded systems [1,5,6].

2.2. Feed-Forward Arbiter PUF

The Arbiter PUF is modified by placing an Arbiter (D flip-flop) in between the multiplexer array, as shown in Figure 2. The feed-forward physical unclonable function (PUF) consists of 64 stages. We utilize two feed-forward taps located after stages 20 and 40. The outputs from these taps will serve as select lines for subsets of multiplexers during later operations, specifically at stages 30–33 and 50–55. The arbiter uses a D flip-flop (D-FF), which outputs a logic ‘1’ when the rising edge of the input signal (D) occurs earlier than the rising edge of the clock (clk) by at least the required setup time of the flip-flop. This modification aims to increase the randomness of the PUF response. Kumar et al. [2] implemented a feed-forward PUF in FPGA and ASIC and observed the power, area, speed, and device utilization in the Spartan 3E FPGA.

2.3. Error Correction Codes

Error correction codes play a crucial role in communication systems by ensuring that messages are accurately reproduced at the receiver. In channel coding techniques, redundant bits are systematically added to the message, facilitating error correction. Commonly used error correction codes include convolutional codes, block codes, BCH codes, LDPC codes, Reed–Solomon (RS) codes, and polar codes. LDPC codes are recognized for their exceptional error correction abilities and their capacity to manage a high error threshold. The LDPC method employs a sparse matrix H, which contains fewer ones compared to zeros [10,17]. The input message of k bit size is multiplied by a systematic generator matrix G to produce an n-bit codeword [10,18,19,20]. In our work, we used an LDPC encoder for different codeword lengths (128, 256) and analyzed decoder efficiency for different code rates (1/2, 2/3, and 3/4).

2.3.1. Tanner Graphs

Tanner graphs illustrate the parity check matrix of a Low-Density Parity-Check (LDPC) code. In these graphs, check nodes represent the parity check equations, while variable nodes represent the codeword bits. When a specific bit is included in a parity check equation, it is connected to the corresponding check node by an edge [10,21]. Tanner graph with codeword length 7 and message size 3 is shown in Figure 3.

2.3.2. Bit-Flipping Algorithm

The bit-flipping algorithm is a straightforward decoding technique, especially when compared to other LDPC decoding methods. However, this algorithm struggles to correct errors when the number of erroneous bits is high. It works by flipping the bits that do not satisfy the parity check equations, and this process continues until all checks are satisfied. Figure 4 shows a flow chart for the bit-splitting algorithm.

2.3.3. Minimum Sum Algorithm

The minimum sum decoding algorithm is more complex compared to the bit-flipping algorithm, but it has more error correction capability. This decoding algorithm is widely used in standards like 5G and Wi-Fi. All messages are initialized with channel log Likelihood ratios. Sign and magnitude are to be computed for each connected variable node. The sum of channel log Likelihood ratios is calculated for each check node. Total LLR for each variable node is calculated. Decoding continues up to the specified maximum number of iterations [18].

2.4. Error Correction on PUF

Physically unclonable function provides an alternative method to key storage in security applications of lightweight embedded devices. Hiller et al. provide a comparison of various error correction designs for PUFs, focusing on PUF response bits and FPGA slice utilization. Ganorkar et al. [22] use Euclidean geometry Low-Density Parity Check the coding scheme over PUF for secure key generation using the bit-flipping algorithm. Kumar et al. [10] used Low-Density Parity-Check (LDPC) error correction code in conjunction with the Modified Anderson PUF, resulting in improved uniformity and reliability.

3. Key Generation and Reconstruction

The key construction using the proposed method is shown in Figure 5, and the key reconstruction method is shown in Figure 6. The feed-forward PUF produces a response R with respect to an applied challenge. The reliability of feed-forward PUF is calculated by applying the same challenge multiple times. The secret key is constructed from the PUF response using the HASH (SHA 256) function.

Helper Data Generation

The helper data is computed as $P=R\oplus C$ where R is the response from the feed-forward PUF, and C is the codeword generated by the LDPC encoder. The XOR operation is used because the LDPC code is linear, allowing the codeword to act as a mask for the noisy response. During key reconstruction, the device measures a noisy response R′. Using the stored helper data and the reconstruction algorithm, the decoder is able to recover C through the operation $C=R^{\prime }\oplus P$ = $R^{\prime }\oplus (R\oplus C)$ = $C\oplus (R^{\prime }\oplus R)$. This scheme does not increase hardware complexity and maintains a linear relationship, which is important for both security and entropy analysis. This helper data procedure is consistent with the code-offset construction in foundational fuzzy extractor designs. Helper data reduces the uncertainty of the PUF response. If H(R) represents the entropy of the puf response and H(R/P) represents the entropy of the response after observing helper data, then minimizing information leakage requires maximizing H(R/P) so that the helper data reveals as little as possible about R.

In the key reconstruction stage, the same physical unclonable function (PUF) is used to generate a response, denoted as R′, by applying the same challenge bits. However, R′ may differ from the original response R.

To recover the original information, R′ is XORed with helper data to produce a 128-bit codeword, C′. An LDPC (Low-Density Parity-Check) decoder is then utilized to retrieve the original codeword, C, from C′. The original PUF response is generated from the codeword C and the helper data. Finally, the response R is hashed to retrieve the secret keyword.

4. Results and Analysis

4.1. Feed-Forward PUF Implementation Results

Responses of Arbiter PUF and feed-forward physically unclonable functions (PUFs) have been evaluated for various response lengths. Figure 7 shows the simulation result for a 128-bit response from a feed-forward PUF. PUF reliability is quantified as 1-intraHD, where intraHD represents the average Hamming distance between repeated measurements of the same challenge. Figure 8 and Figure 9 give a comparison of Hamming distances and bit error rate for Arbiter PUF and feed-forward Arbiter PUF across multiple response samples.

Table 1. Comparison of BER and reliability for various PUFs.

Result from	Average BER	Reliability
Our work—Arbiter PUF	0.0773	92.7%
Our work—feed-forward PUF	0.068	93.22%
Kurra et al. [23]—feed-forward PUF	-	91.3%

shows the average reliability and the average bits in error measured from these readings $93.1$% and $0.0687$, respectively. The feed-forward design consistently achieves a lower BER for most response indices, demonstrating improved stability against environmental and temporal noise. Reliability must be enhanced for cryptographic key generation. The use of error correction coding techniques can improve the reliability of PUF responses.

Table 2. FPGA implementation result of feed-forward Arbiter PUF.

Size	# LUT	# FF	# IOB	Dynamic Power (W)	Total on Chip Power (W)	Junction Temperature (°C)
8 bit	2	8	10	0.008	0.009	25.3
16 bit	4	16	21	0.010	0.076	25.4
32 bit	6	28	33	0.015	0.079	25.4
64 bit	10	48	42	0.035	0.090	25.3

summarizes the FPGA resource utilization for the feed-forward Arbiter PUF. As the response bit size increases, both device utilization and power consumption also rise. Figure 10 shows that total power consumption increases as the PUF response size becomes larger.

Table 3. Comparison of ASIC implementation feed-forward PUF with related work. Bold values indicate superior performance.

Results from	Size	Technology	Switching Power (nW)	Speed (GHz)	Area (nm2)
Our proposed work	8 bit	45 nm	880.52	0.98	51.53
Kumar et al. [2]	8 bit	45 nm	1487.1	0.707	89.2

shows a comparison of ASIC implementation results of the proposed feed-forward PUF with earlier related work in [2]. The proposed design achieves a 40% reduction in switching power, a 38% improvement in speed, and a 43.1% decrease in area.

4.2. Ldpc Implementation Results

The LDPC design was focused on a block length of n = 128 bits. Multiple code rates were generated, specifically 1/2, 2/3, and 3/4, by modifying the parity-check matrix while keeping the core encoder structure the same. After validating the functionality and synthesizing the 128-bit design, the encoder was scaled up to n = 256 bits.

Table 4. FPGA implementation result of LDPC encoder for different codeword length.

K	N	# Slice LUT	# Slice Register	# IOB	Dynamic Power (W)	Total on Chip Power (W)	Junction Temperature (°C)
8	16	9	27	29	0.006	0.007	25.4
16	32	32	13	52	0.013	0.083	25.4
32	64	21	75	101	0.026	0.096	25.4
64	128	40	196	195	0.052	0.122	25.4
128	256	61	298	305	0.104	0.172	25.4
256	512	120	582	510	0.208	0.278	25.4

shows resource utilization, power consumption and area utilization when the LDPC encoder is implemented on Artix7 FPGA for different codeword lengths. Due to high switching activities, dynamic power increases with codeword length. Resource utilization also increases as codeword length increases.

Table 5. FPGA implementation result of LDPC encoder for different code rate.

Coderate	# Slice LUT	# Slice Register	# IOB	Dynamic Power (W)	Total on Chip Power (W)	Junction Temperature (°C)
1/2	40	196	195	0.052	0.122	25.4
2/3	48	206	214	0.062	0.133	25.4
3/4	53	210	224	0.070	0.136	25.4

presents the FPGA implementation results of the LDPC encoder (n = 128) for three different code rates: 1/2, 2/3, and 3/4. As the code rate increases, there is a gradual rise in hardware resource utilization, particularly in the number of slice LUTs, slice registers, and I/O blocks. This increase reflects the additional logic complexity required to support higher code rates, which typically involve more complex parity generation and control structures.

Correspondingly, the dynamic power consumption also rises from 0.052 W at a code rate of 1/2 to 0.070 W at a code rate of 3/4, indicating higher switching activity within the encoder. The total on-chip power shows a similar upward trend, although the variation remains small, demonstrating that the design remains power-efficient across all configurations.

The Cadence Genus tool is used for ASIC implementation of the LDPC encoder. The observation results are summarized in

Table 6. ASIC implementation result of LDPC encoder for different codeword length.

K	N	Technology (nm)	Speed (GHz)	Switching Power (mW)	Area (mm2)
16	32	45	1.83	1.73	302
16	32	90	1.29	3.02	1721
16	32	180	0.59	11.2	4294
32	64	45	1.82	2.48	424
32	64	90	1.30	5.33	2975
32	64	180	1.22	16.9	8974
64	128	45	1.71	5.2	764
64	128	90	1.21	8.13	5234
64	128	180	1.19	32.02	17,560

. The area, speed, and dynamic power are analyzed for 45 nm, 90 nm, and 180 nm technology. Among these, the 45 nm node offers the best trade-off, providing the lowest delay and area with moderate power consumption.

Figure 11 shows the variation in switching power for the LDPC encoder with codeword length for different technology nodes.

4.3. Results for Proposed Scheme: Error Correction Coding on PUF

The 64-bit PUF response is encoded using LDPC to produce a 128-bit codeword, and this codeword subsequently serves as the basis for generating the 128-bit helper data. The Figure 12 shows the simulation waveform for LDPC encoding.

In the key-reconstruction phase, decoding is performed using the bit-flipping technique and the minimum sum algorithm. In this work, the reliability evaluation was conducted on a 50 repeated response samples for each challenge.

Table 7. Comparison of LDPC assisted feed-forward PUF implementations using bit-flipping and minimum-sum decoding algorithm.

Results from	Method	Reliability	# LUT	# FF	Switching Power (mW) (n =128)	Switching Power (mW) (n = 256)	Speed (GHz)
Our proposed work	LDPC and feed-forward PUF with bit-flipping algorithm (Artix7)	94%	1850	2110	1.77	2.8	1.87
Our proposed work	LDPC and feed-forward PUF with minimum sum algorithm (Artix7)	96%	1975	2220	3.22	4.6	1.27
Kumar et al. [10]	LDPC (bit-flipping) and Anderson PUF (Virtex6)	-	2017	2615	-	-	-

shows a comparison of the error-correction capability of the two decoding algorithms, along with their FPGA resource utilization. While the minimum-sum decoder achieves higher reliability, the bit-flipping decoder offers advantages in resource utilization and power consumption. The switching power is compared for codeword lengths of n = 128 bits and n = 256 bits. The increase in switching power with a longer codeword length occurs because doubling the codeword length leads to higher circuit activity and greater use of combinational logic. This, in turn, results in a proportional increase in switching energy consumption. Moreover, the complexity of decoding also increases as the codeword length grows.

Table 8. Comparison of performance-per-watt for LDPC assisted feed-forward PUF implementations using bit-flipping and minimum-sum decoding algorithm.

Method	Performance per Watt (Gbps/W)
LDPC and feed-forward PUF with bit-flipping algorithm (Artix7)	4.2
LDPC and feed-forward PUF with minimum sum algorithm (Artix7)	2.8

presents a comparative evaluation of two hardware-accelerated LDPC decoding architectures integrated with a feed-forward PUF. Performance per watt (Gbps/W) is used as a primary evaluation metric, which is highly relevant for energy-constrained IoT endpoint devices. Our results demonstrate that the bit-flipping decoder achieves 4.2 Gbps/W, approximately 1.5 times higher than the minimum-sum decoder, which reaches 2.8 Gbps/W. This substantial improvement demonstrates that the bit-flipping approach offers superior energy efficiency, making it a more suitable choice for low-power IoT applications where reduced power consumption and compact hardware are critical. Additionally, the bit-flipping algorithm requires fewer hardware resources, resulting in better area efficiency compared to the minimum-sum implementation.

The reliability analysis in

Table 9. Reliability and BER improvement using LDPC encoding for codeword length n = 128.

Results from	Method	Reliability Before Applying LDPC	Reliability After Applying LDPC (Rate = 1/2 and n = 128)	BER Before Applying LDPC	BER After Applying LDPC (Rate = 1/2 and n = 128)	Reliability After Applying LDPC (Code Rate = 2/3 and n = 128)
Our proposed work	LDPC and feed-forward PUF with bit-flipping algorithm (Artix7)	93%	94%	7%	6%	92.7%
Our proposed work	LDPC and feed-forward PUF with minimum sum algorithm (Artix7)	93%	96%	7%	4%	95%

gives the effectiveness of applying the LDPC encoding to stabilize the noisy response of the feed-forward PUF. Before applying LDPC, both decoding configurations had an average reliability of 93 % and a BER of approximately 7%. After applying LDPC coding, an improvement is observed in both cases. Table 9 also shows the effect of reliability when the code rate is changed from 1/2 to 2/3. Reliability slightly decreases when the code rate is changed from 1/2 to 2/3 because the number of parity bits is decreased. In

Table 10. Reliability and BER improvement using LDPC encoding for codeword length n = 256.

Results from	Method	Reliability Before Applying LDPC	Reliability After Applying LDPC (Rate = 1/2 and n = 256)	BER Before Applying LDPC	BER After Applying LDPC (Rate = 1/2 and n = 256)	Reliability After Applying LDPC (Code Rate = 2/3 and n = 256)
Our proposed work	LDPC and feed-forward PUF with bit-flipping algorithm (Artix7)	93%	95%	7%	5%	94%
Our proposed work	LDPC and feed-forward PUF with minimum sum algorithm (Artix7)	93%	96.5%	7%	3.5%	95%

, reliability effectiveness is analyzed for a larger codeword length of n = 256 bits. Reliability slightly increases compared to the 128-bit codeword. The reliability improves slightly for the 256-bit codeword because longer LDPC codewords allow the decoder to exploit more parity-check constraints, resulting in better error-correcting capability.

5. Conclusions and Future Work

Arbiter PUF and feed-forward PUF are designed, and reliability is measured by checking the Hamming distance of the PUF response for the same challenge bits. Our feed-forward PUF design gives a 40% reduction in switching power, a 38% increase in speed and a 43.1% decrease in area compared to earlier related work. The proposed method can handle noisy PUF responses efficiently with the help of a powerful channel coding technique (LDPC). We could achieve a reliability of 96% by using the minimum sum algorithm for decoding and 94% using the bit-flipping algorithm. LDPC encoding is performed with different code rates to observe the variation in hardware resource utilization, power and reliability. Reliability slightly decreases when the code rate is changed from 1/2 to 2/3 because the number of parity bits is decreased. We observed that increasing the codeword length results in higher power switching because a longer codeword leads to greater circuit activity.

The complex ECC decoding method consumes large amounts of power and area and this method may not be able to handle high error rates. As future work, resource-efficient error correction coding can be designed and used to increase reliability. Future research can focus on the design of decoders with optimized FPGA/ASIC implementation for IoT devices. We will incorporate complete post-layout results in our extended future work. We can use compact machine learning models to approximate complex decoding techniques. Adaptive decoding methods enhanced by machine learning methods will improve the reliability while minimizing resource utilization.