PUFs, TRNGs, and Cryptography

Why is traditional digital key storage vulnerable?

Non-volatile memory can be attacked, leading to exposure of secret keys.

What are the main security goals in cryptographic systems?

Authentication (no spoofing), Data Integrity (no alteration), Privacy (no eavesdropping).

What are common attacker goals in hardware security?

Extracting crypto keys, learning secret algorithms, modifying stored data, and bypassing security measures.

Why is software-only protection insufficient?

Software protection does not prevent physical attacks, such as invasive memory extraction.

What is the difference between symmetric and asymmetric cryptography?

Symmetric uses the same key for encryption and decryption, while asymmetric uses different keys.

What are one-way functions, and why are they important?

Functions that are easy to compute but hard to reverse, essential for encryption and hashing.

What is a Physical Unclonable Function (PUF)?

A hardware-based function that generates unique, unpredictable outputs based on physical variations.

How do PUFs improve security?

They generate keys on demand, eliminating the need for stored digital secrets.

What is an example of a silicon-based PUF?

Silicon delay-based PUFs exploit manufacturing variations in transistor delays.

How do Ring Oscillator (RO) PUFs work?

They use variations in oscillation frequency to generate unique responses.

How can PUFs be used for authentication?

A system can challenge a PUF with an input and verify the response against a stored database.

Why are PUFs suitable for secure key storage?

Keys are generated dynamically rather than stored, making extraction attacks difficult.

What are common attacks on PUFs?

Machine learning attacks, fault injection attacks, and environmental variation effects.

How can measurement noise affect PUF reliability?

Temperature and voltage fluctuations can alter PUF responses, making them less stable.

What is a TRNG?

A system that generates random numbers from unpredictable physical processes.

What are common entropy sources for TRNGs?

Thermal noise, radioactive decay, and semiconductor variations.

What is clock jitter, and how is it used in TRNGs?

Variations in clock timing caused by noise, used to create randomness.

Why are TRNGs important for cryptographic security?

They generate unpredictable values for encryption keys, session tokens, and digital signatures.

How do TRNGs differ from Pseudo-Random Number Generators (PRNGs)?

TRNGs use physical randomness, while PRNGs use deterministic algorithms with a seed.

What are key properties of cryptographic hash functions?

Pre-image resistance, collision resistance, and the avalanche effect.

How are hash functions used in security?

They secure passwords, verify data integrity, and generate digital signatures.

What is the difference between DES and AES?

AES is more secure, uses larger key sizes (128, 192, 256-bit), and replaces the outdated DES standard.

What are the four main steps in AES encryption?

SubBytes, ShiftRows, MixColumns, AddRoundKey.

What is cryptography?

The practice of securing information by transforming it into a format that is unreadable to unauthorized users.

What is key management in cryptography?

The management of cryptographic keys, including their generation, distribution, and storage.

What does SSL stand for?

Secure Sockets Layer, a protocol for securing communications over a computer network.

What is a digital signature?

A mathematical scheme for verifying the authenticity and integrity of a message or document.

What is the purpose of encryption?

To protect information by converting it into a code to prevent unauthorized access.

What is the role of a hash function in security?

To convert data into a fixed-size string of characters, which is typically a hash value.

What are block ciphers?

Encryption algorithms that process fixed-size blocks of data, commonly used in symmetric key cryptography.

What is a security token?

A physical device or software that generates a unique code for user authentication.

What does the term 'man-in-the-middle attack' mean?

An attack where a third party intercepts and possibly alters the communication between two parties.

What is the significance of the RSA algorithm?

A widely used asymmetric cryptographic algorithm that relies on the difficulty of factoring large integers.