Maxim uses own PUF for low-cost crypto devices
To support its line of security chips for embedded applications, Maxim Integrated opted to develop its own form of physically unclonable function (PUF) instead of using one of the better-known technologies such as those based on the raw power-up state of SRAM arrays.
The first implementation of the ChipDNA-branded PUF technology is inside the DS28E38 DeepCover authenticator device. The IC is intended to support anti-counterfeiting in electronic equipment as well as secure-boot operations for microcontrollers to which the chip is connected. Emerging applications include smart data cables for data centers: servers will not activate a network port unless the cable itself is verified.
Don Loomis, vice president of micros, security and software at Maxim, said the new part is an extension of the 1-Wire family of products that the company took on with its acquisition of Dallas Semiconductor. The company has kept the old DS part-number prefixes.
Loomis pointed to the problem of IoT devices responding to spoofed sensors or network commands. “Without authenticated components, how can it be secure?” he asked.
Anti-tamper amnesia
The DS28E38 uses cryptographic hardware from Maxim’s existing payment-security products, which use battery-backed SRAM for key storage. The company uses this rather than flash or similar non-volatile storage as a form of anti-tamper protection. If the device detects an active attack on the clock, data bus or power supply, it disconnects the power supply to wipe the stored keys.
Loomis said in attacks on payment cards hackers “spend almost all their time trying to get at the keys”. He added: “With ChipDNA technology we are trying to bring that level of security to sub-dollar devices.”
The problem for markets such as IoT sensors and counterfeit protection for electronic consumables such as ink cartridges is that the SRAM-based key storage is too expensive, Loomis said. “And they don’t want the battery either.”
Although flash or ROM could store preprogrammed keys, reliably destroying them during an attack presents a problem. Maxim turned to the PUF option because it would render it unnecessary to store the required keys. Instead, it recreates the root key on the fly when required by analyzing the array of PUF elements.
Loomis claimed: “We don’t keep the key live in the system unless the key bits are needed. We use it for the smallest amount of time as possible. The possibility of the key being recovered intact in the part is very minimal.”
Deliberate mismatch
For reliability and to avoid random bit errors, this application requires single-digit parts-per-billion failure rates. “We looked at the existing PUFs before deciding to build our own. They fell short of our needs to get something small and hard to probe,” Loomis said, as well as working predictably down to -40°C.
The circuitry uses an array of minimum-length transistors in place of an SRAM array, used by specialist supplier IntrinsicID which launched its own take on PUF-based cryptography earlier this year, or group of ring oscillators. “It exploits the bane of analog transistor: mismatch.”
The device uses additional countermeasures against side-channel attacks and tampering to reduce the probability of an attacker to decode key bits from the processes used to generate and use them.
The DS28E28 itself is a challenge-response device that sits at one end of a 1-Wire link to provide key-authentication and generation services for asymmetric schemes such as ECC. Later devices will support other interfaces such as I2C and the technology may be built into secure microcontrollers.
