IEEE Solid-States Circuits Magazine - Summer 2019 - 69

which remove bias and correlation
from the output bitstream [30], [32],
[53]. Considering the performance
and overhead of typical ciphers (see
the section "Cryptographic Modules"), cipher-based entropy extractors typically degrade throughput
by an order of magnitude, the gate
count by one to three orders of magnitude, and the energy by more than
an order of magnitude.

VLSI 2018
[66]
Entropy
Source/Architecture

Barak-Impagliazzo-Wigderson entropy extractors [B06] leverage the
confusion/diffusion enabled by basic
operations of ciphers (e.g., finite-field
addition and multiplications) at a
moderate sub-k gate complexity. The
Markov chain whitening approach in
[66] reduces the correlation across
subsequent bits, similar to output
subsampling, while reusing the previous bits to have a more favorable

VLSI 2018
[83]

ISSCC 2017
[40]

Metastability Metastability

JSSC 2017
[16]

throughput-correlation tradeoff. As
another important class of entropy
extractors, LFSRs and nonlinear-feedback shift registers (NLSRs) preserve
throughput and perform whitening
[65], [66], [67]. As Figure 15(c) shows,
the energy penalty of entropy extractors correcting only the bias is on the
order of picojoules to tens of picojoules
per bit, and it increases to hundreds of
picojoules in extractors performing

JSSC 2016
[53]

JSSC 2016
[94]

ISSCC 2014
[100]

Jitter

Jitter

Metastability
Metastability
+ Jitter

Jitter

Technology

65 nm

14 nm

65 nm

65 nm

14 nm

40 nm

28 nm

Voltage (V)

0.53-1

0.55-0.75

1.08-1.2

1.2

0.4-0.75

0.6

0.9

1

Throughput (Mb/s)

3.2-86

1,480

8.2-9.9

3,000

8.6-162.5

2

23.16

2

2.37.10

10.8.106

218.103

380.103

5.15.106

519.103

472.103

3

2.58-6.08

2.5

35.5-42.2

1.6

23

11-23

23

4

NIST Pass

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Calibration Needed

Yes

No

No

Yes

No

Yes

No

Entropy Extractor

MC

VN

XOR

No

XOR + BIW

No

No

Resilient Against VDD

Yes

N/A

Yes

N/A

Yes

Yes

Yes

Resilient Against Temp.

Yes

N/A

N/A

N/A

Yes

Yes

N/A

6

Area (F2)
Energy (pJ/b)

1 Digital Allows Low Voltage

2 From Mb/s to Gb/s

3 Size: 20-100 µm

4 Energy From Picojoules to Tens of Picojoules

(a)

Gate Count (Gates)

Energy (pJ/b)

Throughput (Gb/s)

Range

101-103

10-3-10-1

Up to 101

Improvement Over TRNG

102-103

101-102

Up to 106

(b)
XOR

VN

BIW

MC

101

101

102

103

101-104

103-104

100-101

Data
Dependent

101

< 101

No

101

Energy/bit (pJ)

100

100-101

101-102

10-1-102

101-102

Bias Correction

Yes

Yes

Yes

No

Yes

Yes

Whitening

No

No

Yes

Yes

Yes

Yes

Complexity (Gates)
Throughput Reduction

LFSR/NLSR Block Ciphers

Entropy-Extraction Low-Energy Methods Are Comparable to Raw TRNG
Simultaneous Bias Correction and Whitening Are Energy Hungry
(c)
FIGURE 15: A summary of the recent state of the art in (a) TRNGs, (b) PRNGs, and (c) entropy extraction circuits from TRNGs. MC: Markov
chain; BIW: Barak-Impagliazzo-Wigderson.

IEEE SOLID-STATE CIRCUITS MAGAZINE

SU M M E R 2 0 19

69
IEEE Solid-States Circuits Magazine - Summer 2019

Table of Contents for the Digital Edition of IEEE Solid-States Circuits Magazine - Summer 2019
