Exogenous Sources of noise

ANR – 15 – CE 25 – 0006 - 01 (NAND) Deliverable D 5.2

1

ANR – 15 – CE 25 – 0006 - 01 (NAND)

Deliverable D 5.2

Exogenous Sources of noise

Jamel Nebhen Fabrice Seguin Cyril Lahuec


2

Abstract

In the first part of this deliverable, we will present a state of the art and a bibliographic

synthesis on random number generators, with particular study on TRNGs in digital circuits

and how to design and evaluate them. We briefly describe the PRNGs. We will present

several principles of TRNG proposed in the literature. We will be particularly interested in the

design and evaluation of TRNGs, their operating principle and some techniques of random

extraction that are often found in digital circuits.

In the second part of this deliverable, we will study and develop our variable random

number generator. First, we will develop our TRNG circuit with noise mathematical

equations. Then, we will simulate the input referred noise of our new architecture. Next

step will be the layout of the variable TRNG in ST 28 nm FDSOI process and perform the

post layout simulations.


3

Contents

Abstract .................................................................................................................. 2

Chapter 1 ..................................................................................................................... 4

1. State of the art of TRNG in digital circuits ................................................................. 22

1. 1. Pseudo-random number generators (PRNG) ............................................................................. 23

1. 2. True Random Number Generators (TRNG) .............................................................................. 24

2. Techniques for extracting hazards in digital circuits ................................................. 24 2. 1. Analog component based TRNG ............................................................................................... 25

2. 2. Jitter based TRNG ..................................................................................................................... 26

2. 3. Metastability based TRNG ........................................................................................................ 28

2. 4. Linear feedback shift registers .................................................................................................. 29

3. TRNG principles proposed in the literature ............................................................... 31 3. 1. TRNG proposed by Bagini et al ................................................................................................ 31

3. 2. TRNG proposed by Jun et al ..................................................................................................... 32

3. 3. TRNG proposed by Killman et al .............................................................................................. 33

3. 4. TRNG proposed by Danger et al ............................................................................................... 33

3. 5. TRNG proposed by Vasyltsov et al ........................................................................................... 34

3. 6. TRNG proposed by Fairfield et al ............................................................................................. 35

3. 7. TRNG proposed by Bucci et al.................................................................................................. 36

3. 8. TRNG proposed by Kohlebrenner et al ..................................................................................... 37

3. 9. TRNG proposed by Varchola et al ............................................................................................ 37

3. 10. TRNG proposed by Sunar et al ............................................................................................... 38

3. 11. TRNG proposed by Zhou et al ................................................................................................ 39

4. TRNG comparison ............................................................................................... 41 5. Conclusion .......................................................................................................... 42 Chapter 2 ................................................................................................................... 43

1. Noise generator .................................................................................................. 43

2. Variable noise generator ......................................................................................... 47

3. Conclusion .......................................................................................................... 51

Conclusion of this deliverable ..................................................................................... 52

Bibliography .......................................................................................................... 53


22

Chapter 2

Random number generators, state of the art

In this part, a state of the art and a bibliographic synthesis of random generation on a

programmable logical target will be presented. It discusses the description of noise generators,

as described by the scientific community in a logic of historical presentation.

1. State of the art of TRNG in digital circuits

An ideal random number generator is a mathematical construct that generates independent

and uniformly distributed random numbers [25]. In practice, RNGs are divided into two

classes with the possibility of hybridization between the two: True Random Number

Generators (TRNG) and Deterministic Random Numbers Generators (PRNG). The PRNG

relies on deterministic algorithms to generate numbers that appear to be random. Their

algorithmic nature makes them easily implantable in digital circuits and can operate at high

bit rates. However, in theory, PRNGs do not guarantee the unpredictability of the generated

sequences. To remedy this, they often use a small initialization from a TRNG. The TRNG are

not algorithmic in nature: they are electrical or mechanical constructions that extract the

randomness from a phenomenon most often physical which is characterized by random

properties. Their flow is limited by the frequency spectrum of the phenomenon from which

they derive the hazard (frequency spectrum of electronic noise ...) and by the constraints

related to the extraction technique and its implantation. The statistical quality of the sequences

generated depends on both the quality of the source of the hazard and the technique with

which it is extracted, however statistical defects related to the implantation are often observed

in practice. Nevertheless, if properly designed, TRNGs can generate unpredictable sequences.

This chapter presents a state of the art on random number generators. Especially, we are

studying TRNG generators in digital circuits and how to design and evaluate them. Section 1

briefly describes the PRNGs: their operation and applications. Section 2 defines the TRNGs,

their operating principle and presents some random extraction techniques that are often found

in digital circuits.


23

1. 1. Pseudo-random number generators (PRNG)

Pseudo-random number generators (PRNGs) generate binary sequences that have the same

statistical properties as a sequence of random sequences but are predictable in theory. Their

output is evaluated using statistical tests on the binary sequences. This class of generators is

easy to implant and allows high flow rates while producing sequences that have good

statistical properties. It is therefore very suitable for applications that do not require the

unpredictability of suites, but can also be used in cryptographic applications if certain criteria

are met.

Principle and applications: The sequences generated by a PRNG are not truly random in the

sense that they are completely determined by a set of initial parameters. The algorithm used

can thus be completely characterized by the deterministic succession of its internal states. The

period of a PRNG is defined by the number of all these states, generally expressed in bits.

Generally, it is quite easy to build algorithms with periods long enough for most applications.

On the other hand, these algorithms are constructed so as to provide numbers that have good

statistical distributions. Their ease of implementation, speed and the multitude of known

efficient algorithms make this type of generators widely used in applications such as

numerical simulation (Monte Carlo methods), gaming machines and even certain

cryptographic applications not requiring the unpredictability of the sequel. Among the most

common PRNGs, we can cite the middle-square generator of J. von Neuman [26] and the

linear generators, introduced by D. H. Lehmer in 1948 [27]. The latter have become

particularly popular and widespread since their improvement by G. J. Mitchell and D. P.

Moore in 1958.

PRNGs can also be used in cryptographic applications requiring unpredictable sequences if

their initialization state is periodically renewed using a truly random number generator

(TRNG). This makes it possible to benefit both from the rapidity of the PRNGs and the

unpredictability of the TRNGs. It is important to note that if a PRNG is always initialized to

the same state, it will always produce the same output sequence. It is therefore essential that

the seed of initialization (from a TRNG) be renewed with a period less than that of the

algorithm.


24

1. 2. True Random Number Generators (TRNG)

True random number generators (TRNGs) are mechanical or electrical devices for extracting

random numbers from a source of physical hazard. If properly designed and implemented,

even an absolute knowledge of their architecture and internal operation should not be able to

predict their output bits. In this section, we are interested in their principle of operation and

some techniques of extraction of hazard that are often found in digital circuits.

Principle of operation: The TRNG generates random numbers from a phenomenon (mostly

physical) whose evolution cannot be predicted over time. TRNG is fundamentally a circuit

that extracts randomness from a physical phenomenon having a random distribution. Unlike

a PRNG, the state of a TRNG is independent of the previous states and generates bits

with entropy very close to the ideal value of '1'. A basic TRNG circuit would consist of three

components, the source of randomness, the extraction circuit and the post-processing unit. A

TRNG samples and digitizes these continuous sources to extract the randomness.

A generic scheme of TRNG is shown in Fig. 15. It should be noted that according to the

principles of TRNG, these three parts are not necessarily architecturally distinct. The source

of entropy corresponds to the process that produces the hazard. Entropy extraction is the

mechanism by which the random properties of the source are extracted to generate random

numbers (in the form of bit sequences in the case of TRNG implanted in digital circuits).

Since physical sources of hazard and extraction mechanisms are never perfect, the numbers at

the output of a TRNG often suffer from statistical defects. Post-processing algorithms are then

used to correct these defects.

Fig. 15. Schematic diagram of a TRNG

2. Techniques for extracting hazards in digital circuits

True sources of randomness are extremely limited within circuits, and they all seem a priori

related to noise. It is omnipresent in electronic circuits. It has various origins and is therefore


25

presented in different forms: diffusion noises (thermal noise, quantum noise, shot electron

noise), excess noises (scintillation noise, Generation/recombination noise, burst/popcorn

noise) and semiconductor junction noises (shot noise, avalanche noise). In an electronic

circuit, noise influences signals with different manners (fluctuations in analog voltage signal,

jitter, etc.). This section presents some examples of techniques for extracting these properties

to generate random bit sequences.

2. 1. Analog component based TRNG

Some TRNG principles use the noise of an analog component such as a resistor or a Zener

diode as a source of randomness. These techniques seek to amplify the fluctuations of the

output voltage of an analog signal (coming from the noise source) and to pick them up by

analog components (operational amplifiers, comparators, etc.). For example, the technique

used in a TRNG developed by Intel proposed in [28] consists in amplifying the differential

voltage between two noise sources (resistors) in order to supply a VCO (voltage controlled

oscillator), this is sampled at Regular intervals to generate random numbers. The differential

structure using two independent noise sources makes the architecture more robust to external

perturbations and environmental fluctuations. The schematic diagram of this random

extraction technique is illustrated in Fig. 16.

Fig. 16. TRNG circuit discussed in [28]

Among the published TRNG principles based on amplification of the noise of analog

components may also be mentioned [29] and [30]. The main drawback of these techniques is

that they use analog components: they require a mixed analog / digital design flow and cannot


26

be easily implanted in reconfigurable circuits. Moreover, the rates are quite low (at best of the

order of hundreds of KB / s in [29], [30] and [31]).

2. 2. Jitter based TRNG

The jitter corresponds to short temporal fluctuations of the digital signal due to the noise in

the electronic components. It can be measured on a digital signal in the frequency or time

domain and can be captured by counting or sampling. The manipulated signals can be

generated inside the circuit, and the extraction is based only on digital components (D flip-

flops, latchs, counters, etc.). These techniques are therefore widely used in digital circuits.

Traditionally, there are two methods to generate random numbers from the jitter of an

oscillating signal: sampling a digital signal as close to its switching time (the sampled value

then depends on the jitter as shown in Fig. 17), or count the number of oscillations of an

oscillating signal over a given time window (time variations due to jitter are additive over

time and can influence the number of oscillations if the time window is sufficiently long, This

is called accumulation of jitter).

The technique proposed in [32] exploits the property of jitter accumulation over time. The

architecture uses a simple D flip-flop, which samples a jitted signal to extract the random

numbers. This technique will be one of the basic principles widely adopted and improved by

the scientific community at a later date. The operating principle is described in Fig. 18. In

[32], a high-frequency signal, generated by an 8 MHz on-board oscillator, is sampled by a

low-frequency signal adjustable by external components.

Fig. 17. Sampling of a digital signal containing noise jitter by an ideal clock signal

The sampled value depends on the time variations accumulated on the high frequency signal

as well as those of the low frequency signal. The main drawbacks of this technique are the


27

low flow rate and the fact that the variations due to deterministic noise accumulate more

rapidly than those due to random noise [33], which can lead to significant statistical defects at

the output. On the other hand the noise in the low frequencies is often correlated with the

value of the frequency (one speaks of flicker noise, also called noise in 1/f ) which can induce

dependencies in the bits generated at output.

Fig. 18. Principle of operation of the TRNG proposed in [32]

This circuit is taken up in [34] but introducing a new idea: by judiciously choosing the ratio

between the frequencies of the two oscillating signals, it is possible to perform a sweep of the

sampled signal with a time resolution sufficiently fine to detect the jitter. The output bits of

the latch then consist of a sequence of bits with deterministic random bits interposed between

them.

Knowing the relationship between the frequencies, it is possible to extract the random bits

using a decimator. This scheme avoids the need for a very low frequency signal sampling

with the disadvantages that implies (poor jitter and low bit rate). However, it requires precise

control of the ratio between oscillator frequencies. TRNG proposed in [34] has a design

allowing this adjustment to be made precisely using a PLL (Phase-locked Loop).

Another very popular technique allowing even greater flow rates is to combine the outputs of

several independent signals in order to maximize the influence of the jitter on the resulting

theoretical signal. The idea is to produce several electrical transitions (events) in very short

times by combining a large number of periodic signals with an XOR gate. The more these

signals are, the more events there are in a period of oscillation of the resulting signal, and the

closer they are in time, so that the influence of the jitter overlaps more and more of the period


28

of oscillation. A representation of this principle is given in Fig. 19 (the area of influence of the

jitter is exaggerated in the figure for ease of understanding). This technique is used in the

TRNG studied in [35], [36] and [37].

Fig. 19. The sum (XOR) of two independent jittered signals

2. 3. Metastability based TRNG

In electronics, metastability is the ability of an electronic system to persist indefinitely in a

state of unstable equilibrium [38]. For example, by looping the output of an inverting gate at

its input, the output voltage can stagnate at an intermediate value between the logic high level

and the low logic level [39] [31]. This phenomenon also occurs (probabilistically) when the

setup time and hold a logic gate (including scales) are not met, the output voltage can then

stagnate on an intermediate value for an indeterminate and random time (which actually

depends on the noise) before reaching its final value [40]. Finally, we can also speak of

metastable oscillations to designate a regime of damped transient oscillation (for example in a

bi-stable circuit [31]). Techniques exploiting metastability to generate random numbers have

the common principle of placing an electronic system in a situation where the noise greatly

influences its resolution. For example, in [31], the authors cause the state of metastability of

inverting gates (by looping back on itself) to randomly initialize a bi-stable circuit. This

scheme is described in Fig. 20. The two multiplexers make it possible to switch between two

operating modes. If the selector is at '0', the circuit consists of two inverters looped back on

themselves. According to the authors, these inverters then have an output voltage close to Vdd

/ 2 (from our point of view this is difficult to obtain because the structure composed of a

multiplexer and an inverter stage tends to oscillate). When the selector is at '1', the inverters

are connected to each other and form a bi-stable circuit whose initialization depends on the


29

resolution of the metastable state of the inverters (influenced in part by the random noise, but

unfortunately also by all kinds of deterministic influences). In practice, the architecture of the

TRNG proposed in [31] is composed of 15 instances of the basic cell described in Fig. 20.

Their outputs are combined using an XOR to provide the random numbers before the post-

processing.

Fig. 20. TRNG architecture proposed in [10]

2. 4. Linear feedback shift registers

A linear feedback shift register (LFSR) is a shift register whose input bit is a linear function of

its previous state. The only linear functions of single bits are xor and inverse-xor; thus it is a

shift register whose input bit is driven by the exclusive-or (xor) of some bits of the overall

shift register value. The initial value of the LFSR is called the seed, and because the operation

of the register is deterministic, the sequence of values produced by the register is completely

determined by its current (or previous) state. Likewise, because the register has a finite

number of possible states, it must eventually enter a repeating cycle. However, a LFSR with a

well-chosen feedback function can produce a sequence of bits which appears random and

which has a very long cycle.

One of the two main parts of an LFSR is the shift register (the other is the feedback function).

A shift register is a device whose identifying function is to shift its contents into adjacent

positions within the register or, in the case of the position on the end, out of the register. The

position on the other end is left empty unless some new content is shifted into the register.

The feedback function in an LFSR has several names: XOR, odd parity, sum modulo 2. The


30

bits contained in selected positions in the shift register are combined in some sort of function

and the result is fed back into the register's input bit. By definition, the selected bit values are

collected before the register is clocked and the result of the feedback function is inserted into

the shift register during the shift, filling the position that is emptied as a result of the shift.

An LFSR is one of a class of devices known as state machines. The contents of the register,

the bits tapped for the feedback function, and the output of the feedback function together

describe the state of the LFSR. With each shift, the LFSR moves to a new state. There is one

exception, when the contents of the register are all zeroes, the LFSR will never change state.

For any given state, there can be only one succeeding state. The reverse is also true: any given

state can have only one preceding state. For the rest of this discussion, only the contents of the

register will be used to describe the state of the LFSR. A state space of an LFSR is the list of

all the states the LFSR can be in for a particular tap sequence and a particular starting value.

Any tap sequence will yield at least two state spaces for an LFSR. (One of these spaces will

be the one that contains only one state – the all zero one.) Tap sequences that yield only two

state spaces are referred to as maximal length tap sequences.

The state of an LFSR that is n bits long can be any one of 2n different values. The largest state

space possible for such an LFSR will be 2n - 1 (all possible values minus the zero state).

Because each state can have only once succeeding state, an LFSR with a maximal length tap

sequence will pass through every non-zero state once and only once before repeating a state.

For some applications, the best random number sequence is one that is very uniform, has very

little correlation effects, requires minimal hardware, easy to use, and above all the “random

sequence” must be completely reproducible. The Random number generator chosen for this

study is based on a one LFSR with the following connecting rule:

D1=Q8

D2=Q1

.

.

.

Dn=Q7

Where Q1,...,Q8 are the outputs and D1,..,D8 are the inputs. As shown in Fig. 21, the random

number generator is implemented using XOR and Dff. One of the outputs, Q1, is XORed with

the output from the leftmost Dff, Q8. Then the last output is feedback into first Dff input. This


31

circuit counts through 28 - 1 different non-zero bit patterns. With n flip-flops, 2n - 1 different

non-zero bit pattern can be generated. In general XORs are only ever 2-input and never

connect in series. Therefore the minimum clock period for this circuit is T > T2-input XOR +

clock overhead. The latency is very little and independent of n. This design can be used as a

random number generator that numbers appear in a random sequence repeats every 2n - 1

patterns. Also can be used fast counter, if the particular sequence of count value is not

important such as micro-code micro-pc.

Fig. 21. LFSR architecture

3. TRNG principles proposed in the literature

In this part, a state of the art and a bibliographic synthesis of TRNG will be presented. It

presents some TRNG principles proposed in the literature.

3. 1. TRNG proposed by Bagini et al.

Summary of the technique: An analog noise source is amplified and transformed into a digital

signal via a comparator, which is sampled to generate the random numbers.

The TRNG presented by Bagini et al. In [29] uses the thermal noise of an external analog

component as a source of entropy. The scheme of the TRNG is shown in Fig. 22. The noisy

signal is first filtered, amplified, and then transformed into a digital signal via the hysteresis

comparator. The authors propose a fairly complete theoretical study which allows to express

the correlation of the output bits as a function of the internal parameters of the generator, and

thus to establish the maximum rates to obtain an independence of the output bits.

Nevertheless, the authors give no concrete results of implantation.


32

Fig. 22. Circuit of the NRG proposed in [29]

3. 2. TRNG proposed by Jun et al.

Summary of the technique: The difference between two sources of noise is amplified and

feeds a VCO, which is sampled to generate the random numbers. This principle of TRNG is

very close to that presented in [29].

In this architecture, shown in Fig. 23, two sources of noise (integrated resistors) are used.

Their output signals are compared. The result is then amplified and applied to the input of a

Voltage Controlled Oscillator (VCO). The raw random numbers are obtained by sampling the

output of the VCO at regular intervals. The differential structure using two independent noise

sources makes the architecture more robust to external perturbations and environmental

fluctuations. The output bits are processed via an arithmetic post-processing of the Von-

Neumann decorrelator type.

Fig. 23. TRNG architecture developed in [28]


33

3. 3. TRNG proposed by Killman et al.

Summary of the technique: Difference between two sources of noise attacks a Schmitt trigger.

The random numbers are extracted by measuring the durations of the high levels of this signal

[30].

In this generator, the noisy signals are derived from two Zener diodes. The difference between

the two voltages (theoretically zero on average) is amplified and then fed into a Schmitt

trigger (see Figure 24). The latter produces, as a function of the noise in the two diodes, a

series of '1' and '0' whose duration is random. Each transition '0' to '1' triggers a first flip-flop

which then reverses its output (toggle flip-flop). A second flip-flop samples this signal every n

clock cycles. The number (in base 2) of transitions '0' to '1' during n clock cycles then gives

the raw random number rn (derived from the digitized analog signal). The arithmetic

postprocessing is given by the formula yn + 1 = yn ⊕ rn, where yn is the n th post-processed

number (i.e. internal random number).


3. 4. TRNG proposed by Danger et al.

Technical Summary: Force a flip-flop into a metastability state to produce random numbers.

The principle of the TRNG proposed in [40], illustrated in Fig. 25, is to use the same signal as

clock and data input of a flip-flop. By adjusting the delay d1 with respect to the delay d2, the

data can be sampled at the limit of the tipping point of the CMOS gate (i.e. around Vdd / 2).

The thermal noise and the environmental conditions then determine whether the voltage

switches to the high level, the low level, or a metastable state which resolves into a duration τ

also depending on the noise and environmental conditions. Theoretically, this structure allows


34

very high flow rates but is very sensitive to environmental conditions (time calibration can be

lost with the slightest fluctuation in voltage and temperature).


To solve the problem posed by external fluctuations, the authors propose an architecture

composed of a chain of delays and flip-flops. The signal passes through n delays and comes in

each case to supply a new flip-flop. The outputs of these flip-flops are combined with an XOR

logic gate. Thus, the greater the number of flip-flops, the faster the resolution of the delay, it

is very probable that one of the flip-flops returns to a metastable state and produces a random

bit. The random bit is transmitted at the output of the generator via the XOR tree.

3. 5. TRNG proposed by Vasyltsov et al.

Summary of technique: To cause the state of metastability of inverting cells to randomly

initialize a ring inverter. The TRNG proposed in [39] takes advantage of the state of

metastability of inverting cells to randomly initialize a ring inverter. This principle takes up in

part the idea of the TRNG proposed in [31]. The proposed architecture, named META-RO, is

described in Fig. 26.



35

This structure operates in two phases sequenced by a clock. In the first phase, the stages of the

ring are looped back on themselves: according to the authors, each inverter enters a state of

metastability with a voltage close to Vdd / 2 at its output and can be considered as an

independent source of noise. In the second phase, the inverters are reconnected as a ring. The

initialization values of the stages are at this time intimately related to the noise fluctuations in

each inverter. The transient oscillations of the ring also have a shape and duration depending

on the initialization values which are random. This signal is then sampled at the end of each

cycle to produce a random number (1 bit).

3. 6. TRNG proposed by Fairfield et al.

Summary of the technique: A low-frequency oscillator samples a high-frequency oscillator

(jitter accumulation)

The article referenced [32], is founder in the field of the generation of hazard in digital

circuits. It presents the first implementation of TRNG in an integrated electronic circuit, as

well as a very complete mathematical analysis on its operation. The proposed technique

exploits the jitter accumulation property over time. The architecture uses a simple D flip-flop,

which samples a jitted signal to extract the random numbers. This will be one of the basic

principles widely taken up and improved by the scientific community later. The operating

principle is described in Fig. 27. A high frequency signal, generated by an on-board oscillator

of 8 MHz, is sampled by a low frequency signal adjustable by external components. The

sampled value depends on the time variations accumulated on the high frequency signal, as

well as on the jitter of the low frequency signal.


36

Fig. 27. Principle of operation of the TRNG proposed in [32]

3. 7. TRNG proposed by Bucci et al.

Summary of the technique: Detection of the relative jitter of two oscillators having the same

characteristics.

In [42], Bucci et al. present a new technique of extraction of the jitter which is according to

the authors, without memory (stateless), i.e. that it produces decorrelated bits. The principle is

based on the detection of the relative stroke of two oscillators with the same characteristics (as

shown in Fig. 28) which are reset each time a random bit is generated. The two oscillating

signals are generated using a delay chain and a switch which allows the signals to follow the

same branches in order to guarantee two equal frequencies. The detection circuit triggers the

sampling when the accumulated relative jitter of the two oscillators exceeds a certain

threshold.



37

3. 8. TRNG proposed by Kohlebrenner et al.

Summary of technique: Coherent sampling between two oscillators with very close

frequencies.

This architecture, proposed in [43] adopts the same principle as that of [34]. Kohlebrenner, et

al. proposes to use two oscillators having the same characteristics in order to generate two

extremely close frequencies. The scanning resolution then corresponds to the difference

between the half-periods of these two oscillators. The proposed architecture is described in

Fig. 29. The signal s, of frequency Fs, is sampled by the signal clk, of frequency Fclk (with Fs

= Fclk). The resulting signal is composed of long sequences of '1' followed by long sequences

of '0' with short random sequences. The randomness is captured by counting these bits during

a count window given by the controller, which must be adjusted according to the difference

between the periods of the oscillators.


3. 9. TRNG proposed by Varchola et al.

Summary of the technique: To capture the number of oscillations in transient mode in a bi-

stable circuit (this number is directly influenced by the jitter).

In [41], M. Varchola and M. Drutarobsky present a TRNG which extracts the jitter in a bi-

stable circuit. When a bi-stable circuit is initialized in a conflict situation, it oscillates during a

transient regime before reaching a stable end state. The authors note an interesting fact: the

number of oscillations during the transient regime is directly influenced by the jitter. The

architecture of a base cell of this TRNG, called TERO (Transient Effect Ring Oscillator) is

described in Fig. 30. When the control signal is at '0', the equivalent circuit diagram is a bi-


38

stable blocked in a conflict state. When the control signal goes to 1, the bi-stable circuit

oscillates during a transient state, toggle type flip-flops are placed at the output of each stage

to count the number of oscillations in base 2. The operating frequency is calibrated as a

function of the maximum duration of the transient oscillations. Finally, the complete

architecture of the TRNG comprises one or more instantiations of TERO cells whose outputs

are combined with an XOR to provide the raw random numbers.


3. 10. TRNG proposed by Sunar et al.

Sunar et al. In [35] propose a TRNG for FPGA targets, full digital, based on a large number of

ring oscillators and which has a relatively high throughput. The principle is presented in Fig.

31. The principle is similar to the historical extraction of [32] but an important new idea is

introduced. Instead of sampling a single ring oscillator, Sunar et al. Propose to sample a signal

that is the XOR of a large number of oscillators that contain jitter. By making the hypothesis

that the jitter in the oscillators is Gaussian and thus follows a normal law N (μ, σ2), Sunar et

al. Propose a statistical model to calculate the minimum number of oscillators necessary to

ensure that the sampling takes place in a zone dominated by the jitter.



39

3. 11. TRNG proposed by Zhou et al.

Summary of technique: Zhou et al. in [44] propose an ultra-low power CMOS random

number generator (TRNG), which is based on an oscillator-sampling architecture. The noisy

oscillator consists of a dual-drain MOS transistor, a noise generator and a voltage control

oscillator. The dual-drain MOS transistor can bring extra-noise to the drain current or the

output voltage so that the jitter of the oscillator is much larger than the normal oscillator. The

frequency division ratio of the high-frequency sampling oscillator and the noisy oscillator is

small. It can produce good quality bit streams without any post-processing. The bit rate of this

TRNG could be as high as 100 kbps. It has ultra-low power dissipation.

Fig. 32 shows the structure of the noise source device. It consists of one dual-drain PMOS

transistor and one dual-drain NMOS transistor. The dual-drain MOS transistor is a special

MOS transistor with two drains, one source and one gate [45]. It can be fabricated by only

changing the source-drain implanting mask shape from a rectangle to a concave in a standard

CMOS process. The special dual-drain MOS transistor structure can bring an extra-noise to

the currents through the double drains of the MOS transistor.

This concave mask forms two drains of a MOS transistor and results in a shed of the current

that flows from the source to the dual-drain of the MOS transistor. When the majority carriers

drift from the source to the drain and meet the shed, the carriers enter one of the two drains

stochastically and form the current through the corresponding drain. Although the probability

that a carrier enters one of the two drains is the same as that a carrier enters the other drain.

There is an uncertainty of the carriers’ choosing of the drains of the transistor. This

uncertainty creates the current fluctuation through each drain of the dual-drain MOS

transistor. Comparing with a single-drain MOS transistor, this is an extra-noise source. The

currents of the two drains inevitably correlate to each other because the two drains share the

same active field. If the gate and the source of the dual-drain MOS transistor are biased by

two constant voltages and its drains are biased by the two voltages with the same values,

respectively, the source current is equal to the summation of the two drain currents and is

constant. Thus the fluctuation of one drain-current causes the opposite-phase fluctuation of the

other one. If the current through one drain of the dual-drain MOS transistor increases

(decreases) stochastically, the current through the other one decrease (increases) accordingly.

The fluctuation of the two drain currents is correlated. The differential noise of the two drains

is obviously larger than that of the normal MOS transistor or that of the total current of the


40

two drains. This noise characteristic of the dual-drain MOS transistor can be used as the noise

source of a CMOS RNG. In order to convert the noise current of dual-drain MOS transistors

into the noise voltage signal and to reduce the dc offset of the noise voltage signal, the noise

source device is designed to be a dual-drain MOS transistor current mirror circuit, as shown in

Fig. 32.

Fig. 32. Schematic of the noise source device proposed in [44]. It consists of two dual-drain MOS transistors.

The fluctuation of the drain currents in the dual-drain MOS transistors is converted into a

differential voltage signal between Vp and Vn. A differential amplifier follows the noise source

device. It amplifies the differential noise voltage signal and transfers it to a single-ended noise

voltage signal Vno, Fig. 33.

Fig. 33. Schematic of the noise generator proposed in [44]. The differential voltage signal between Vp and Vn is amplified by a CMOS amplifier to produce the noisy voltage signal Vno.


41

The whole noise generator is presented in Fig. 32. The noise generator generates a proper

noise signal and provides enough drive ability. We use the noise generator to design a RNG

based on the oscillator sampling architecture, as shown in Fig. 34. It consists of a noisy

oscillator, a high-frequency oscillator and a D flip–flop. The noisy oscillator consists of a

dual-drain MOS transistor noise generator and a voltage-controlled oscillator. The output

noise voltage signal of the noise generator controls the oscillator and makes it oscillate with a

much large jitter.

Fig. 34. Architecture of the RNG proposed in [44]. It is an oscillator-based RNG. The noisy voltage Vno controls the oscillation frequency of the low frequency oscillator.

4. TRNG comparison

As we have shown, there is a large number of TRNGs. Each TRNG circuit has advantages

and disadvantages. Until now, there is no perfect TRNG generator. Comparison between

TRNG diagnoses is not easy because implantations are presented in different electronic card

and on different chips. We presented an overview of the most existing principles to better

understand our research work to explore to advance research in the field of TRNG generation.

In addition, an evaluation is only possible if the TRNG diaphragms to be evaluated are

implanted on the same chip with the same immediate environment (power supply, PCB card,

electromagnetic radiation, etc.).

We have thus synthesized a comparison of the main TRNGs studied in this state of the art in

Table 1 according to different criteria which, in our view, are the most important although

other criteria can also be added (internal state, possibility of on-line tests, material cost,

consumption, robustness against attacks, etc ...)


42

Table 1. Comparison of the different principles of TRNG presented in detail in the state of the

art

TRNG Source of noise Measurement Flow rate Implantation Existing model

Bagini et al. [29] Thermal noise,

integrated resistor

No - Easy Yes

Jun et al. [28] Thermal noise, integrated res.

Yes 75 kb/s Easy Yes

Killman et al. [30] Thermal noise,

Zener diode Yes 500 kb/s Easy Yes

Danger et al. [40] Metastable No 20 Mb/s Very hard No Vasyltsov et al. [39] Metastable No 140 Mb/s Hard No Fairfield et al. [32] Jitter osc. Yes Kb/s Easy Yes

Bucci et al. [42] Jitter osc. Yes 13 Mb/s Easy Yes Kohlebrenner et al.

[43] Jitter osc. No 591 kb/s Hard No

Varchola et al. [41] Jitter osc. Yes 250 kb/s Easy Yes Sunar et al. [35] Jitter osc. No 2.5 Mb/s Easy Yes

Zhou et al. [45] Integrated res.

+ Jitter osc. Yes 100 kb/s Very easy Yes

5. Conclusion

We have presented in this chapter a state of the art in the form of a bibliographic synthesis of

the main articles describing random number generators that can be easily implemented in

FPGAs. This bibliographic summary lists the main scientific articles dealing with the

generation of hazards. The most practical source of randomness in digital circuits is the jitter

because it is ubiquitous and easily accessible. Techniques that extract random jitter often

require precise oscillating signals. The structures which make this possible are often not very

precise like ring oscillators. We have developed the most important ones.


43

Chapter 3

Design of variable TRNG

In this chapter, we will resume the random generator TRNG presented in [23]. We will

validate the architecture with noise mathematical equations and noise simulations. Next, we

will propose our variable random noise generator TRNG. We will validate our new TRNG by

mathematical noise equations and by simulations of the input referred noise voltage.

1. Noise generator

Fig. 35 shows the structure of the noise source circuit. It consists of a PMOS transistor with

dual-drain and a NMOS transistor with dual-drain. The dual-drain MOS transistor is a special

MOS transistor with two drains, one source and one gate [45]. It can be fabricated by only

changing the source-drain implanting mask shape from a rectangle to a concave in a standard

CMOS process. The special dual-drain MOS transistor structure can bring an extra-noise to

the currents through the double drains of the MOS transistor. This concave mask forms two

drains of MOS transistors and results in a shed of the current that flows from the source to the

dual-drain of the MOS transistor. When the majority carriers drift from the source to the drain

and meet the shed, the carriers enter one of the two drains stochastically and form the current

through the corresponding drain. Although the probability that a carrier enters one of the two

drains is the same as that a carrier enters the other drain. There is an uncertainty of the

carriers’ choosing of the drains of the transistor. This uncertainty creates the current

fluctuation through each drain of the dual-drain MOS transistor. Comparing with a single-

drain MOS transistor, this is an extra-noise source.

If the gate and the source of the dual-drain MOS transistor are biased by two constant

voltages and its drains are biased by the two voltages with the same values, respectively, the

source current is equal to the summation of the two drain currents and is constant. Thus the

fluctuation of one drain-current causes the opposite-phase fluctuation of the other one.


44

Fig. 35. Schematic of the noise source device. It consists of two dual-drain MOS transistors.

If the current through one drain of the dual-drain MOS transistor increases (decreases)

stochastically, the current through the other one decreases (increases) accordingly. The

fluctuation of the two drain currents is correlated. The differential noise of the two drains is

obviously larger than that of the normal MOS transistor or that of the total current of the two

drains. The experiment result shows that the input referred noise voltage of the dual-drain

MOS transistor is two times of that of the normal MOS transistor [46].

Input referred noise voltage of a circuit composed by a single NMOS and a single PMOS, Fig.

36.

Fig. 36. Conventional circuit composed by an NMOS transistor and a PMOS transistor

The input referred noise voltage of this circuit can be written as [47]

2 2,

1 1 1 1

81

3m n

n inm m ox

g KkTV

g g W L C f

(24)


45

With gm denotes the transconductance of the MOS transistor [47]

m d

Wg K I

L (25)

Input referred noise voltage of a circuit composed by a dual-drain NMOS and a dual-drain

PMOS

Fig. 37. Proposed circuit composed by a dual-drain NMOS transistor and a dual-drain PMOS transistor

A classical dual-drain MOS transistor has the following dimensions: W’ = W/2 and L’ = L

The input referred noise voltage of this circuit can be written as

''2 2, ' ' '

1 1 1 1

81

3m n

n inm m ox

g KkTV

g g W L C f

(26)

With gm’ denotes the transconductance of the MOS transistor

'

2 2 2d m

m

I gWg K

L (27)

Now, we substitute gm’ with gm / 2 in Eq. 26, we have

'2 22, ,

1 1 1 1

82 1 2.

3m n

n in n inm m ox

g KkTV V

g g W L C f

(28)


46

The simulation of the input referred noise voltage of these two circuits under cadence is

presented in Fig. 38. The blue curve is that of the noise for the traditional single MOS circuit

with (W/L)NMOS = (W/L)PMOS = 10/2 (µm/µm). The red curve is for the new dual-drain MOS

circuit with (W/L)Dual-drain-NMOS = (W/L)Dual-drain-PMOS = 5/2 (µm/µm). This figure clearly shows

that the noise of a dual-drain MOS is twice that of a single MOS which is in coincidence with

the previous equations. This noise characteristic of the dual-drain MOS transistor can be used

as a noise generator. The two NMOS and PMOS dual-drain transistors form a Wheatstone

bridge.

Fig. 38. Input referred noise voltage of a single MOS and a dual-drain MOS circuit

This noise characteristic of the dual-drain MOS transistor can be used as the noise source of a

CMOS TRNG. In order to convert the noise current of dual-drain MOS transistors into the

noise voltage signal and to reduce the dc offset of the noise voltage signal, the noise source

device is designed to be a dual-drain MOS transistor current mirror circuit, as shown in Fig.

39. And the bias current is 100 nA. The fluctuation of the drain currents in the dual-drain

MOS transistors is converted into a differential voltage signal between Vp and Vn. A

differential amplifier follows the noise source device. It amplifies the differential noise

voltage signal and transfers it to a single-ended noise voltage signal Vno. The noise generator

generates a proper noise signal and provides enough drive ability. The key points of the

generator are as follows. Firstly, the noise voltage PSD of the dual-drain MOS transistor is

two times of that of the normal MOS transistor. Secondly the output impedance of the noise

source device is around 1 GΩ so that 1 pA variation in the drain current results in a 1 mV


47

change in the differential voltage signals (Vp, Vn). Finally, because the dual-drain MOS

transistors operate at the sub-threshold state, the noise generator has low power nature.

Fig. 39.Schematic of the noise generator. The differential voltage signal between Vp and Vn is amplified by an CMOS amplifier to produce the noisy voltage signal Vno.

We use the noise generator to design a RNG based on the oscillator sampling architecture, as

shown in Fig. 40. It consists of a noisy oscillator, a high-frequency oscillator and a D flip–

flop. The noisy oscillator consists of a dual-drain MOS transistor noise generator and a

voltage-controlled oscillator. The output noise voltage signal of the noise generator controls

the oscillator and makes it oscillate with a much large jitter.

Fig. 40. Architecture of the RNG. It is an oscillator-based RNG. The noisy voltage Vno controls the oscillation frequency of the low frequency oscillator.

2. Variable noise generator

Now, we will study and design our new variable noise generator, Fig. 41. This variable noise

generator is based on the idea of a dual-drain MOS transistor but with some modifications.

Instead of taking the drains of MOS transistor as D1 = D / 2 and D2 = D / 2, we will take

different proportions for the drains of MOS transistor as follows D1 = D / n and D2 = D.(n-1)

/ n.


48

Fig. 41. Variable noise generator

The noise power spectral density of the modified circuit can be written as [47]

2 8. . .

3th mi K T g (29)

Fig. 42. Noise study of variable noise generator

Since the thermal and 1/f noise of M1 and M2 can be modeled as voltage sources in series

with the input, we only need to refer the noise of M3 and M4 to the input. Let us calculate the

output noise contributed by M3. The drain source current of M3 is divided between r03 and

the resistance seen looking into the drain of M1. This resistance equals

04 012XR r r (30)

Denoting the resulting noise currents flowing through r03 and Rx by InA and InB, respectively,

we have

04 013 3

04 01

2

2 2nA m n

r rI g V

r r

(31)


49

And

033 3

04 012 2nB m n

rI g V

r r

(32)

The former produces a noise voltage at node X with respect to ground as

04 013 3 03

04 01

2

2 2nA m n

r rV g V r

r r

(33)

Whereas the latter flows through M1, M2 and r04 generating a noise voltage at node Y with

respect to ground as

033 3 04

04 012 2nB m n

rV g V r

r r

(34)

Thus, the total differential output noise due to M3 is

03 013 3

03 01nXY m n

r rV g V

r r

(35)

Applying Eq. 35 to M4 as well and adding the resulting powers we have

3 4

2 22 2 2 2 2, / , 3 01 03 3 4 02 04 4n out M M m n m nV g r r V g r r V (36)

The gain of this circuit is

1 01 03 2 02 04

2m mg r r g r r

G

(37)

To refer the noise to the input, we divided Eq. 36 by G2, obtaining the total input referred

noise as


50

2 22 2 2 2 23 4, 1 2 3 42 2

1 2

m mn in n n n n

m m

g gV V V V V

g g (38)

Wich, upon substitution for Vn1 and Vn2 and pose X = r01 // r03 and Y = r02 // r04, reduces to

2 22 3 4, 2

1 2 1 1 2 21 2

1 1 48

3 3 3m m n n

n inm m ox oxm m

g X g Y K KV kT

g g W L C f W L C fg X g Y

(39)

Now, if we replace W1’ = W3’ = W/n and W2’ = W4’ = W.(n-1)/n, we can write the

transconductance of transistors M1, M2, M3 and M4 as

1 3

2 4

1

mm m

mm m

gg g

nn g

g gn

(40)

We substitute gm’ in the Eq. 39 with his new value and we suppose X ≈ Y, we obtain the total

input referred noise according to gm1 and gm3 as

22

2 3, 2

1 1 2 2

.18 4

3 1 1m n

n inm m ox

g n KnV kT

n g g n W L C f

(41)

According to Eq. 41, we find that if n increases the total input referred noise also increases.

N = 1 N 2 3 4 5 (W/L)NMOS

(µm/µm) 10/2 (W/L)dual-drain-NMOS

(µm/µm) 5/2 3.33/2 2.5/2 2/2

(W/L)PMOS

(µm/µm) 10/2 (W/L)dual-drain-PMOS

(µm/µm) 5/2 6.66/2 7.5/2 8/2

2, /n inV µV Hz 5 '2

, /n inV µV Hz 10 11 11.7 12.7

'2,

2,

/n in

n in

VµV Hz

V 2 2.2 2.34 2.54

The simulation of the input referred noise voltage of the variable noise generator under

Cadence is presented in Fig. 43. It clearly shows that if N increases, the input referred noise of

the TRNG also increase. This characteristic allows us to design a variable TRNG.


51

Fig. 43. Input referred noise voltage of variable noise generator.

3. Conclusion

In this chapter, we propose an ultra-low power CMOS variable random number generator

(VTRNG), which is based on an oscillator-sampling architecture. The noisy oscillator consists

of a dual-drain MOS transistor, a noise generator and a voltage control oscillator. The dual-

drain MOS transistor can bring extra-noise to the drain current or the output voltage so that

the jitter of the oscillator is much larger than the normal oscillator. The noise generator is a

larger time-jitter oscillator that is constitute by the dual-drain MOS transistors with large

noise output voltage and the voltage-controlled oscillator. The frequency division ratio of the

high-frequency oscillator and the noise oscillator is small so that the frequency of the high-

frequency oscillator is smaller and the power consumption is low. We validated our new

TRNG by mathematical noise equations and by simulations of the input referred noise

voltage. Next step is the layout of the variable TRNG in ST 28 nm FDSOI process and

perform the post layout simulations.


52

Conclusion of this deliverable

In this deliverable, we present a state of the art on electronic noise in the MOSFET and

random number generators, with particular emphasis on TRNG in digital circuits and how to

design and evaluate them. The main source of randomness in electronic circuits is thermal

noise related to the random movements of charge carriers in semiconductors. This is

manifested at the level of the digital signal in the form of random (very small) variations of

the logic gate propagation times. This phenomenon is called jitter (guigue). One of the most

popular techniques for generating randomness in digital circuits is to capture these variations

in the oscillating signals.

In the first part of this deliverable we have presented the low frequency noise in the

MOSFETs and in the passive components (resistors and capacitors). The different types of

noise in a MOSFET transistor, namely white noise, 1/f noise and Lorentzian noise are studied.

We have introduced the basic concepts of jitter and phase noise in VCO. We have presented

the developed technique to relate frequency and time domain oscillator jitter performance.

The origins of these different types of noise as well as their models are described. We have

also performed the simulation of input referred noise voltage of a CMOS inverter in

technology ST 28 nm FDSOI with Cadence. These simulations aim to show the 1/f noise and

the white noise as well as the dependence of the noise equation on the size W and L of the

MOS transistor.

In the second part of this deliverable, we have presented a state of the art and a bibliographic

synthesis on random number generators, with particular emphasis on TRNGs in digital

circuits and how to design and evaluate them. We have briefly described the PRNGs. We

have presented several principles of TRNG proposed in the literature. We have been

particularly interested in the design and evaluation of TRNGs, their operating principle and

some techniques of random extraction that are often found in digital circuits.

Finally, we have developed our low-power variable random number generator with noise

simulations results. It consists of a noise generator and an oscillator-based sampling circuit.

The noise generator is a larger time-jitter oscillator that is constitute by the dual-drain MOS

transistors with large noise output voltage and the voltage-controlled oscillator. We developed

our TRNG circuit with noise mathematical equations. Then we simulated the input referred

noise of our new architecture. Next step is the layout of the variable TRNG in ST 28 nm


53

FDSOI process and perform the post layout simulations. This third part represents an opening

on the beginning of the work of deliverable D 5.2.

Bibliography

[1] L. K. J. Vandamme and F. N. Hooge, “1/f noise as diagnostic tool for quality evaluation of electronic devices”, 6th Int. Conf. Quality in Electronic Components Failure Prevention, Detection and Analysis. Bordeaux, pp. 323-333, ESREF, France, 4-7 October 1993.

[2] L. K. J. Vandamme,” Noise as a Diagnostic Tool for Quality and Reliability of Electronic Devices”, IEEE Transactions on Electron Devices, 41, pp. 2176-2187, 1994.

[3] M. M. Jevtic, “Noise as diagnostic and prediction tool in reliability physics”, Microelectronics Reliability, 35, pp. 455-477, 1995.

[4] J. Savoj and B. Razavi, “A 10-Gb/s CMOS clock and data recovery circuit with a half-rate linear phase detector,” IEEE Journal of Solid-State Circuits, vol.36, pp. 761-767, May 2001.

[5] G. Georgiou, Y. Baeyens, Y. Chen, A. Gnauck, C. Gropper, P. Paschke, R. Pullela, M. Reinhold, C. Dorschky, J. Mattia, T. Mohrenfels, and C. Schulien,“Clock and data recovery IC for 40-Gb/s fiber-optic receiver,” IEEE Journal of Solid-State Circuits, vol. 37, pp. 1120–1124, Sep. 2002.

[6] N. Dalt and C. Sandner, “A subpicosecond jitter PLL for clock generation in 0.12µm digital CMOS,” IEEE Journal of Solid-State Circuits, vol. 38, pp. 1275–1278, July 2003.

[7] B. Jun and P. Kocher, “The Intel random number generator,” Technical Report, Intel, 1999.

[8] M. Bucci, L. Germani, R. Luzzi, A. Trifiletti, and M. Varanonuovo, “A high speed oscillator-based truly random number source for cryptographic applications on a smart card IC,” IEEE Transaction on Computers, vol. 52, pp. 403-409, Apr. 2003.

[9] V. Fischer and M. Drutarovsky, “True random number generator embedded in reconfigurable hardware,” Cryptographic Hardware and Embedded Systems (CHES 2002), pp. 415-430, 2002.

[10] J. McNeill, “Jitter in ring oscillators,” IEEE Journal of Solid-State Circuits, vol. 32, pp. 870-879, June 1997.

[11] J. McNeill, “Jitter in ring oscillators,” Ph.D. dissertation, Boston University, 1994.

[12] T. Weigandt, K. Beomsup and P. Gray, “Analysis of timing jitter in CMOS ring oscillators,” Proceedings of 1994 IEEE International Symposium on Circuits and Systems (ISCAS 1994), vol. 4, pp. 27-30, May 1994.

[13] A. Hajimiri and T. H. Lee, “A general theory of phase noise in electrical oscillators,” IEEE Journal of Solid-State Circuits, vol. 33, pp. 179-194, Feb. 1998.

[14] A. Demir, A. Mehrotra, and J. Roychowdhury, “Phase noise in oscillators: A unifying theory and numerical methods for characterization,” IEEE Transaction on Circuits and Systems. I: Fundamental Theory and Applications, vol. 47, pp. 655-674, May 2000.


54

[15] F. Herzel, “An analytical model for the power spectral density of a voltage-controlled oscillator and its analogy to the laser linewidth theory,” IEEE Transaction on Circuits and Systems I: Fundamental Theory and Applications, vol. 45, pp. 904-908, Sep. 1998.

[16] G. Klimovitch, “Near-carrier oscillator spectrum due to flicker and white noise,” Proceedings of 2000 International Symposium on Circuits and Systems (ISCAS 2000), pp. I-703-706, May 2000.

[17] A. Demir, “Phase noise and timing jitter in oscillators with colored-noise sources,” IEEE Transaction on Circuits and Systems. I: Fundamental Theory and Applications, vol. 49, pp. 1782-1791, Dec. 2002.

[18] A. Hajimiri, S. Limotyrakis, and T. H. Lee, “Jitter and phase noise in ring oscillators,” IEEE Journal of Solid-State Circuits, vol. 34, pp. 790-804, June 1999.

[19] ---, “Synchronous optical network (SONET) transport systems: Common generic criteria, TR-253-CORE,” Bell Communications Research, Inc., Issue 2, Rev No. 1, Dec 1997.

[20] ---, “A guide to understanding and characterizing timing jitter,” Tektronix, Inc., 2002.

[21]---, “Definitions and terminology for synchronization networks,” ITU-T Recommendation G.810, Aug. 1996.

[22] National committee for information technology standardization (NCITS), “Fibre channel - Methodologies for jitter and signal quality specification - MJSQ”, T11.2 / Project 1316-DT / Rev 12.2, Jan. 30, 2004.

[23] F. Gardner, “Phaselock techniques,” New York: Wiley, 1979.

[24] W. Robins, “Phase noise in signal sources,” London: Peregrinus, 1982.

[25] W. Killmann and W. Schindler, “AIS31: Functionality classes and evaluation methodology for true (physical) random number generators”, Bundesamt fur Sicherheit in der Informationstechnik (BSI), Bonn, 2001.

[26] John Von Neumann, “Various Techniques Used in Connection with Random Digits”, J. Res. Nat. Bur. Stand., 12:36–38, 1951.

[27] D. H. Lehmer. “Mathematical methods in large-scale computing units”, Proceedings of a Second Symposium on Large-Scale Digital Calculating Machinery, 1949, pp. 141–146. Harvard University Press, Cambridge, Mass., 1951.

[28] B. Jun and P. Kocher, “The Intel Random Number Generator”, Cryptography Research Inc. white paper, Apr, 1999.

[29] V. Bagini and M. Bucci, “A design of reliable true random number generator for cryptographic applications”, In 1st Workshop on Cryptographic Hardware and Embedded Systems-CHES 1999, vol. 1717 of LNCS, pp. 204–218. Worcester, USA, Springer Verlag.

[30] W. Killmann and W. Schindler, “A Design for a Physical RNG with Robust Entropy Estimators”, In Elisabeth Oswald and Pankaj Rohatgi, editors, Cryptographic Hardware and Embedded Systems – CHES 2008 , volume 5154 of LNCS, pp. 146–163, Springer, 2008.

[31] M. Epstein, L. Hars, R. Krasinski, M. Rosner, and H. Zheng, “Design and Implementation of a True Random Number Generator Based on Digital Circuit Artifacts”, In Cryptographic Hardware and Embedded Systems-CHES 2003, volume 2779 of LNCS, pages 152–165. Cologne, Germany, Springer Verlag, 2003.


55

[32] R.C. Fairfield, R.L. Mortenson, and K.B. Coulthart, “An lsi random number generator (rng)”, In GeorgeRobert Blakley and David Chaum, editors, Advances in Cryptology, volume 196 of Lecture Notes in Computer Science, pp. 203–230, Springer Berlin Heidelberg, 1985.

[33] V. Fischer, F. Bernard, N. Bochard, and M. Varchola, “Enhancing security of ring oscillator-based TRNG implemented in FPGA”, In FPL, pages 245–250, IEEE, 2008.

[34] V. Fischer and M. Drutarovsky, “True random number generator embedded in reconfigurable hardware”, In Proceedings of the 4th International Workshop on Cryptographic Hardware and Embedded Systems-CHES 2002, LNCS 2523, pp. 415–430, Springer-Verlag.

[35] B. Sunar, W.J. Martin, and D.R. Stinson, “A Provably Secure True Random Number Generator with Built-In Tolerance to Active Attacks”, IEEE Transaction on Computers, pp. 109–119, 2007.

[36] K. Wold and C. H. Tan, “Analysis and Enhancement of Random Number Generator in FPGA Based on Oscillator Rings”, 2008 International Conference on Reconfigurable Computing and FPGAs, pp. 385 – 390, 2008.

[37] J.D. Golic, “New Methods for Digital Generation and Postprocessing of Random Data”, IEEE Transaction on Computers, pp. 1217–1229, 2006.

[38] T.J. Chaney and C.E. Molnar, “Anomalous behavior of synchronizer and arbiter circuits”, IEEE Transaction on Computers, C-22(4):421–422, April 1973.

[39] I. Vasyltsov, E. Hambardzumyan, Y.-S. Kim, and B. Karpinskyy, “Fast Digital TRNG Based on Metastable Ring Oscillator”, In Elisabeth Oswald and Pankaj Rohatgi, editors, Cryptographic Hardware and Embedded Systems – CHES 2008 , volume 5154 of LNCS, pp. 164–180, Springer, 2008.

[40] J.L. Danger, S. Guilley, and P. Hoogvorst, “Fast True Random Generator in FPGAs”, IEEE Northeast Workshop on Circuits and Systems, NEWCAS 2007, pp. 506–509, 2007.

[41] Michal Varchola and Milos Drutarovsky, “New high entropy element for fpga based true random number generators”, In Stefan Mangard and François-Xavier Standaert, editors, CHES , volume 6225 of Lecture Notes in Computer Science , pp. 351–365, Springer, 2010.

[42] M. Bucci, L. Giancane, R. Luzzi, M. Varanonuovo, A. Trifiletti, I.T. AG, and A. Graz, “A novel concept for stateless random bit generators in cryptographic applications”, IEEE Circuits and Systems, ISCAS 2006, pp. 4, 2006.

[43] P. Kohlbrenner and K. Gaj, “An Embedded True Random Number Generator for FPGAs”, Proceedings of the 2004 ACM/SIGDA 12th international symposium on Field programmable gate arrays, pp. 71–78, 2004.

[44] Y. Zhou, M. Yan-Wah Chia, “A Low-Power Ultra-Wideband CMOS True RMS Power Detector,” IEEE Transactions on Microwave Theory and Techniques, Vol. 56, No. 5, May 2008.

[45] Fry PW, Hocy SJ, “A silicon MOS magnetic field transducer of high sensitivity”, IEEE Trans Electr Dev 1969, ED16:35–9.

[46] Baltes Henry P, Nathan Arokia, Briglio Davide R, “Noise correlations in magnetic field sensitive transistors”, IEEE Solid-State Sensor and Actuator Workshop, Technical Digest. 1988.

[47] B. Razavi, “Design of Analog CMOS Integrated Circuits”, McGraw Hill International, 2001.

Exogenous Sources of noise

Documents