Investigating SRAM PUFs in large CPUs and GPUs Citation for published version (APA): Aubel, Van, P., Bernstein, D. J., & Niederhagen, R. F. (2015). Investigating SRAM PUFs in large CPUs and GPUs. (Cryptology ePrint Archive; Vol. 2015/760). IACR. Document status and date: Published: 01/01/2015 Document Version: Publisher’s PDF, also known as Version of Record (includes final page, issue and volume numbers) Please check the document version of this publication: • A submitted manuscript is the version of the article upon submission and before peer-review. There can be important differences between the submitted version and the official published version of record. People interested in the research are advised to contact the author for the final version of the publication, or visit the DOI to the publisher's website. • The final author version and the galley proof are versions of the publication after peer review. • The final published version features the final layout of the paper including the volume, issue and page numbers. Link to publication General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal. If the publication is distributed under the terms of Article 25fa of the Dutch Copyright Act, indicated by the “Taverne” license above, please follow below link for the End User Agreement: www.tue.nl/taverne Take down policy If you believe that this document breaches copyright please contact us at: [email protected] providing details and we will investigate your claim. Download date: 23. Sep. 2021 Investigating SRAM PUFs in large CPUs and GPUs Pol Van Aubel1, Daniel J. Bernstein2;3, and Ruben Niederhagen3 1 Radboud University Digital Security Group P.O. Box 9010, 6500 GL Nijmegen, The Netherlands [email protected] 2 Department of Computer Science University of Illinois at Chicago Chicago, IL 60607{7045, USA [email protected] 3 Department of Mathematics and Computer Science Technische Universiteit Eindhoven P.O. Box 513, 5600 MB Eindhoven, The Netherlands [email protected] Abstract. Physically unclonable functions (PUFs) provide data that can be used for cryptographic purposes: on the one hand ran- domness for the initialization of random-number generators; on the other hand individual fingerprints for unique identification of spe- cific hardware components. However, today's off-the-shelf personal computers advertise randomness and individual fingerprints only in the form of additional or dedicated hardware. This paper introduces a new set of tools to investigate whether intrinsic PUFs can be found in PC components that are not ad- vertised as containing PUFs. In particular, this paper investigates AMD64 CPU registers as potential PUF sources in the operating- system kernel, the bootloader, and the system BIOS; investigates the CPU cache in the early boot stages; and investigates shared memory on Nvidia GPUs. This investigation found non-random non-fingerprinting behavior in several components but revealed us- able PUFs in Nvidia GPUs. Keywords: Physically unclonable functions, SRAM PUFs, ran- domness, hardware identification. This work was supported by the European Commission through the ICT pro- gram under contract INFSO-ICT-284833 (PUFFIN), by the Netherlands Organ- isation for Scientific Research (NWO) under grant 639.073.005, by the U.S. Na- tional Science Foundation under grant 1018836, and by the Dutch electricity transmission system operator TenneT TSO B.V. Permanent ID of this document: 2580a85505520618ade3cd462a3133702ae673f7. Date: 2015.07.29. 1 Introduction Commonly used consumer computing devices, such as desktop computers and laptop computers, need a multitude of cryptographic primitives, e.g., crypto- graphic operations with secret keys, keyed hash functions, secure randomness, and, in some cases, remote attestation and identification capabilities. In this pa- per we focus on two seemingly conflicting aspects: The generation of random bit strings, which requires indeterministic behavior, and the generation of unique identifiers, which requires deterministic behavior. Randomness is required for several purposes in cryptography. For example, random bit sequences are used to generate secret encryption keys and nonces in cryptographic protocols in order to make them impossible for an attacker to guess. Many cryptographic primitives assume the presence of a secure random source; however, most processing chips are designed to be deterministic and sources of randomness are rare [12, 15]. Unique identifiers can be used to deterministically derive an identity-based cryptographic key. This key can be used for authentication and data protection. For example, it would be possible to use these keys as an anti-counterfeiting measure. Bloomberg Business reports in [13] that \an `epidemic' of bogus chips, routers, and computers costs the electronics industry up to $100 billion annu- ally", and Business Wire reports in [1] that \as many as one in ten IT products sold may actually be counterfeit". Having the ability to identify a chip as legiti- mate by comparing some PUF to a database provided by the manufacturer may help reduce this problem. As another example, it is possible to use this key for hard disk encryption: The hard drive, i.e., the bootloader, operating system, and user data, are encrypted with this secret intrinsic key and can only be decrypted if the unique identifier is available. The identifier thus must be protected from unauthorized access. Currently, these features are provided by accompanying the device with ded- icated hardware: randomness is offered, e.g., by the RDRAND hardware random number generator; identification, e.g., by a Trusted Platform Module (TPM). However, these solutions can only be used if a dedicated TPM is available in the device or if the CPU supports the RDRAND instruction which only recently was introduced with Intel's Ivy Bridge CPUs. Furthermore, they do not help in cases where the cryptographic key should be bound to the identity of a specific chip itself. However, for these cryptographic functionalities additional hardware is not necessarily required: randomness as well as identification can be derived from individual physical characteristics inherent to a silicon circuit by the use of phys- ically unclonable functions (PUFs). PUFs can be derived from, e.g., ring oscil- lators [10], signal delay variations [14, 23], flip-flops [16], latches [22], and static random-access memory (SRAM) [11,4]. While most of these require dedicated circuits, SRAM is already used for other purposes in many general-purpose, mass-market chips. SRAM PUFs were initially identified in FPGAs. The PUF characteristics of SRAM are derived from the uninitialized state of SRAM immediately after power-up. When unpowered SRAM cells are powered up, they obtain a value of 0 with a certain probability P0, or 1 with probability P1 = 1 − P0. The individual probabilities of each SRAM cell depend on minor manufacturing differences and are quite stable over time. Some of the cells have a probability close to 1 for either P0 or P1 and thus tend to give the same value at every power-up. Because of this stability, and because the pattern of this stability is different for every block of SRAM, they can be used for fingerprinting. Other cells have a probability close to 0:5 for both P0 and P1 and thus tend to give a different value at each power-up. Since their behavior is unstable, they are a good source for randomness. Before the power-up state of SRAM can be used as PUF, an enrollment phase is required: the SRAM is powered up several times in order to measure which SRAM cells are suitable for randomness and which for fingerprinting. For the actual use of the SRAM PUF some postprocessing is performed, e.g., a feedback loop can be used in order to avoid bias in the generated random bit sequence and an error correction code in order to compensate for occasional bit errors in the fingerprint. At TrustED 2013, researchers demonstrated in [24] that SRAM-based PUFs exist in various brands of popular microcontrollers, such as AVR and ARM, which are commonplace in mobile and embedded devices. More recently [20] used this to secure a mobile platform. We want to investigate the possible presence of PUFs in commonly used desktop and laptop computers. For this purpose, the two most attractive tar- gets are the Central Processing Unit (CPU) and the Graphics Processing Unit (GPU), since they are present in almost every desktop machine commonly in use, and they are the chips most directly accessible by the software running on the machine. Research into PUFs on GPUs was suggested independently by [7]. The most common CPU architecture today for large computing devices, such as laptop computers, desktop computers, and servers, is the AMD64 architec- ture. The AMD64 architecture, also known as x86-64 and x64, was introduced by AMD in 1999 as a backwards-compatible successor to the pervasive x86 ar- chitecture. SRAM is used in abundance in the caches and registers of AMD64 CPUs. Therefore, they may carry intrinsic PUFs. In [18] the authors propose an instruction-set extension to utilize this SRAM to build a secure trusted com- puting environment within the CPU. However, research on existing PUFs in AMD64 CPUs appears non-existent. The obvious question is whether such PUF capabilities are currently also exhibited by (i.e., available and accessible in) x86 and AMD64 CPUs. The documentation of these processors contains a number of statements which suggest that | even though such SRAM PUFs may exist | they are impossible to access from software running on those CPUs.