1

True Random Number Generator

Circuits Based on Single- and Multi-

Phase Beat Frequency Detection

Qianying Tang, Bongjin Kim, Yingjie Lao,

Keshab K. Parhi, and Chris H. Kim

University of Minnesota, Minneapolis, MN 55455 USA

tangx280@umn.edu

Agenda

• Background

• Proposed beat freq. based TRNG

• 65nm single-phase TRNG test chip

• 65nm multi-phase TRNG test chip

• Summary

2

Example of TRNG Appliction

3

• Use random numbers to generate secret keys

• Encrypt plaintext into ciphertext with secret keys

Univ. of

MinnesotaEncryption

#VS?y+J_

@XqyE jg

DecryptionUniv. of

Minnesota

Secret Keys

Plaintext Plaintext

Ciphertext

Random Numbers

01001011….01100

Random Numbers

11011000….10100

Prior Work

• Direct noise amplification from devices

– Random Telegraph Noise (R. Brederlow, ISSCC, 2006)

– Resistor thermal noise (V. Kaenel, CICC 2007)

• Conventional ROSCs based TRNG(M. Bucci, Tran. on Comp., 2003)

– Harvesting noise from oscillator jitter

– Generally requires noise amplification otherwise yield with low

efficiency

• Metastability TRNG (C. Tokunaga, JSSC, 2008; S. Mathew, JSSC, 2012)

– Inverter pair driven to metastable state

– Requires continuous calibrating loop

4

5

Prior Work: Dual Oscillator Based

TRNG

DFF

D QFast

Oscillator

Slow

Oscillator

+

-

• Faster oscillator sampled by a much slower oscillator

– Output is truly random only when ΔTslow > Tfast

– Amplification is required to enlarge ΔTslow

– Less amenable to be integrated with digital processor

6

Prior Work: Meta-stability Based

TRNG

• Inverter pair driven to meta-stability and resolved to ‘0’ or

‘1’ depending on noise direction

– Percentage of ‘0’s and ‘1’s is relatively sensitive to inverter pair

mismatch (requires ΔVINV<0.24σVnoise )

– Limited randomness: P(0) (probability of generating ‘0’s) is

33~49% for a supply range from 0.8V to 1.2V

Shift

RegisterFSM

Fine/Coarse TuneTime

Vo

lta

ge

a b

a

b

S. K. Mathew, et al., JSSC, vol. 47, 2012

Random Bit Generation Using BFD

Scheme

7

DFF

Co

un

ter

Re

se

t

D Q

B

A C

fA

fB

A

B

N

8

DFF

Co

un

ter

Re

se

t

D Q

B

A C

fA

fB

A

B

N

Random Bit Generation Using BFD

Scheme

9

DFF

Co

un

ter

Re

se

t

D Q

B

A C

fA

fB

A

B

N

N

C

Random Bit Generation Using BFD

Scheme

Single-phase TRNG Implementation

• Trimming capacitors: ensure desirable count range

• 5 bit majority voter: prevents functional errors

• Start/end control: reduces unnecessary switching power

10

ROSC Freq. Trimming

Beat Freq.

Detector

12

bit

Co

un

ter

F1<0:5>

ROSC Freq. Trimming

F2<0:5> Fn<0:5>

DFF

D Q 5b

Maj.

Voter

Start/End

Control

Logic

B

A

C D

Reset

EnableB

A

LS

B S

ele

ct,

Vo

n N

eu

m.

Lo

gic

C

D

Reset

Enable

ResetEnable

Sampling

CLK

Sampling CLK

Bubble

Rejection

Sampling CLK

TRNG Output

...

0 1 1 0 1 0 1

N Parallel to

Serial

344 354

Cnt. Output

Trimming Capacitors

1X 2X 32X

Fn<0> Fn<1> Fn<5>

...

Fn<0> Fn<1> Fn<5>

...

...

...

ROSC Freq. Trimming

Count versus Trimming Cap. Setting

• Count value increases as ROSC frequencies are brought

closer together

11

Time (a.u)

65nm, 0.8V, 27ºC

150

250

350

450

550

0 1 2 3

2500

3500

4500

Trim. Cap. Setting= 0, Avg. Cnt. = 191

Trim. Cap. Setting = 1, Avg. Cnt. = 352

Trim. Cap. Setting = 2, Avg. Cnt. = 519

Trim. Cap. Setting =3, Avg. Cnt. = 3040C

ou

nt

NIST Randomness Test Results

• Estimate randomness from percentage of ‘0’s and ’1’s

• NIST test further verifies the randomness

– 55×1M random bits test: P-Value > 0.01 and Proportion > 0.94975

– 1st ~ 3rd LSBs pass all NIST tests while 4th LSB fails

12

0

50

100

2 4 6 8 101

(LSB)

3 5 7 9 1112

(MSB)

65nm, 0.8V, 27ºC, 1M Cnt's

Pe

rce

nta

ge

Bit Number

‘0’s

‘1’s

Average Count = 352

Frequency

Block Frequency

*Cumulative Sums

Runs

Longest Run

Rank

FFT

*Nonoverlapping Temp.

Overlapping Template

Universal

Approximate Entropy

*Random Excursions

*Rand. Excursions Var.

Serial

Linear Compelxity

* Tests with 2 or more subtest, P-val and Prop shown here are the smaller or median values

** Concatenate 1st

~3rd

LSBs and 4th

LSB after von Neumann correction

P-Val / Proportion

1st LSB

P-Val

0.679 0.9818

0.130 1.0000

0.554 0.9818

0.596 1.0000

0.049 0.9818

0.305 0.9818

0.305 1.0000

0.437 1.0000

0.249 0.9818

0.868 1.0000

0.554 1.0000

0.672 1.0000

0.740 1.0000

0.637 1.0000

0.401 1.0000

2nd LSB

0.091 0.9818

0.760 1.0000

0.367 0.9818

0.182 1.0000

0.760 0.9818

0.335 0.9636

0.010 1.0000

0.596 1.0000

0.249 1.0000

0.475 0.9818

0.043 1.0000

0.740 1.0000

0.602 1.0000

0.401 1.0000

0.072 0.9818

3rd LSB

0.514 1.0000

0.063 0.9818

0.475 1.0000

0.225 0.9818

0.596 1.0000

0.305 1.0000

0.514 0.9818

0.679 1.0000

0.798 0.9818

0.071 1.0000

0.103 1.0000

0.500 1.0000

0.637 0.9679

0.637 0.9818

0.063 0.9818

Prop. P-Val Prop. P-Val Prop.

4th LSB

Fail

Fail Fail

Fail Fail

Fail Fail

Fail Fail

0.596 0.9636

Fail Fail

Fail Fail

Fail Fail

Fail Fail

Fail Fail

Fail Fail

Fail Fail

Fail Fail

0.163 0.9818

P-Val Prop.

Fail

Avg. count = 352

Final Output After Post-processing

• Concatenating lower LSBs

– Apply von Neumann correction on just the 4th LSB

– Keep 1st ~3rd LSBs, buffer and insert corrected 4th LSB

13

344 354 356 361 348 353 345 339

0

1 0 1

0 0 1 0 1

Count

1st

LSB

2nd

LSB

3rd

LSB

4th

LSB

4th

LSB w/

von Neu.

Corr.

Final Out

0

0

0

0 0 1 0 1 1 1

0 0 10 0

0 0 1 0 0 0

0 0 1 1 0 1 0

0 1 0 0 0 1 0 0 0 1 1 1 01 0 0 1 0 0 0

1 0

1

1

00 01 10 11

Drop 0 1 Drop

Raw Data

Corr. Data

von

Neumann

Final Output NIST result

0.514 1.0000

0.946 0.9818

0.437 1.0000

0.720 1.0000

0.475 1.0000

0.055 0.9636

0.103 1.0000

0.679 1.0000

0.182 0.9818

0.063 1.0000

0.600 1.0000

0.637 1.0000

0.876 1.0000

0.304 0.9818

0.868 0.9636

P-Val Prop.

Frequency

Block Frequency

Cumulative Sums

Runs

Longest Run

Rank

FFT

Nonoverlapping Temp.

Overlapping Template

Universal

Approximate Entropy

Random Excursions

Rand. Excursions Var.

Serial

Linear Compelxity

P-Val / Proportion

One-time Calibration

• Count range of 200 to 500 provides good trade-off

between speed and efficiency

• One-time calibration at initial startup

– Achieves target range within a few beat frequency periods

– Incurs negligible power overhead

14

Chip #

65nm, 0.8V, 27ºC

1 2 3 4 5 6 7 8

200

400

600

800

1000

Target

Range

=200~500

Before CalibrationAfter Calibration

Co

un

t

Counts in

Range?

Tune Trim. Caps.

Yes

No

Scan

Out

Sample

Counts from BFD

Startup Routine

Robustness of TRNG

• Average count does not drift during 15 hours operation

• For a supply voltage range of 0.8V to 1.2V

– Average count remains within desirable range

– Variation of the count value decreases slightly

15

300

350

400

0 5 10 15

Time (hrs)

Av

g. C

ou

nt

65nm, 0.8V, 27ºC

300

350

400

0.8 0.9 1.0 1.1 1.2

Voltage (V)A

vg

. C

ou

nt

65nm, 27ºC

Simulation and Modeling

• Modeling of ROSC frequencies:

– Same deviation (σ=0.006)

– Tunable average frequency (µA, µB)

• Monte Carlo simulation matches well with test chip data 16

0.0%

2.5%

5.0%

0.992 0.996 1.000 1.004

Frequency (a.u.)

Po

rtio

n

ROSC A

µA=0.9972

σ=0.006

ROSC B

µB=1.0000

σ=0.006

0.0%

4.0%

8.0%

320 340 360 380 400

Counts

Po

rtio

n

Meas. Data

MC Sim.

65nm, 0.8V, 27C

1

1

)()(:min)(N

i

BAB iTiTTNpdfNpdf

Multi-phase TRNG Implementation

• Beat Frequency Detectors (BFDs) used in each stage

– Independent noise on each stage induces small variation in

different counter values

– Sum of counter values provides a larger final count 17

Co

un

ter1

BF

D

BF

D

BF

D

Co

un

ter2

Co

un

ter3

Shift Register & Adder Trig

LS

B S

ele

ct,

Vo

n N

eu

m.

Pa

ralle

l to

Se

rial

LS

B S

ele

ct,

Vo

n N

eu

m.

Pa

ralle

l to

Se

rial

Single-

phase

Multi-

phase

353

350

351

334

344 345332

343 344

333 343 343

1032999 1030

333 343.3 344 351.3

Counter1

Counter2

Counter3

Avg Count

Adder Out 987

Multi-phase vs Single-phase

• Multi-phase TRNG improves performance:

– More # of bits passing NIST test: 1 or 5 more random bits

generated for 3-stage and 31-stage ROSCs, respectively

– Higher bit generation efficiency

18

3 2

3

3

8

13.3

15.1

2.03

3.17

# of bits

passing NIST Efficiency

(Mb/mW)

31

# of

stages

# of

phases

Single

Multi

Single

Multi200

500

800

1100

0 1 2 3

Time (a.u)

Co

un

t

65nm, 0.8V, 27ºC

Single phase Out

Multi-phase Out

Multi-phase TRNG with Different

ROSC Stage Count

• Multi-phase TRNG utilizing fewer ROSC stages shows

improved bit rate and efficiency

19

0

1

2

3

Bit

ra

te

(Mb

/s)

3 7 15 31

# of ROSC stages

65nm, 0.8V, 27ºC

0

4

8

12

16

3 7 15 31E

ffic

ien

cy

(Mb

its

/mW

)# of ROSC stages

65nm, 0.8V, 27ºC

Single- and Multi-phase TRNG Die Photo

20

ROSC A

ROSC BBFD &

CounterScan out

52µm

DCAP

DCAP

ROSCs

(3~31

stage)

ROSCs

(3~31

stage)

Beat Freq.

Detectors

Adder

65nm LP CMOS 65nm LP CMOS

0.8V ~ 1.2V0.8V ~ 1.2V

Multi-phase TRNGsSingle-phase TRNGs

3,7,15 and 31 stage5 stage

15.114Mb/mW2.5Mb/mW

7000µm2

6000µm2 (3 stage)

Process

Operating

Voltage

TRNG

Feature

ROSC Chain

Length

Gen.

Efficiency

Core Circuit

Area

Summary

• A fully digital beat frequency detector based

TRNG implemented in 65nm

• Measured data shows satisfactory TRNG

performance across a wide supply voltage

range without an elaborate calibrating loop

• A one-time calibration scheme is proposed to

ensure count values are in the desirable range

• To further improve the efficiency, a multi-phase

TRNG was demonstrated that samples phase

noise from each ROSC stage

21