{"id":"06da5ddb-c177-4a24-9276-cd4d796f946b","arxiv_id":"1908.03898","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"The authors define two template-based secret unknown cipher families for non-volatile FPGAs, claiming class sizes of 2^1350 and 2^1234 ciphers.","lead":"This paper proposes giving FPGAs unique, uncloneable identities by having each chip randomly generate and permanently lock in its own secret cipher during production. It matters for hardware security because such digital identities could replace noisy analog PUFs, but the required FPGA self-mutation capability is not yet available.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Central feasibility claim rests on an FPGA infrastructure that the paper itself admits does not exist; the reported prototype implements only the static ciphers, not the self-mutation process.","rationale":"The Reader's verdict identifies the same load-bearing weakness: the SUC creation concept depends on a non-volatile FPGA that can internally decrypt, manipulate, lock, and hide the bitstream, and the paper explicitly states that such infrastructure does not exist. My stress-test pass confirms that this is not a minor implementation detail but the central claim of the paper. The prototype evidence covers only the static cipher modules' area and speed, not the mutation or personalization process. The security analysis also largely equates cloning-resistance entropy with the cipher-class size, but the physical unclonability guarantee additionally depends on the unobservable, irreversible bitstream mutation infrastructure. Since the paper honestly admits the missing infrastructure, the issue is not internal inconsistency or authorial misrepresentation; it is that the feasibility claim is forward-looking and unverified. The Reader's REJECT verdict is therefore appropriate, and my analysis does not change it.","tokens_in":25099,"tokens_out":4354,"duration_ms":48964,"concrete_test":"Attempt to execute the full Fig. 7 flow on a current Microsemi SmartFusion2 device: generate EBS' with a reserved SUC template, and implement the GENIE that, after internal decryption, locates and rewrites the 16 configuration bits of one LUT in the NI-SUC template and then irreversibly locks further reconfiguration. If the vendor's documented tools and device interfaces cannot expose or modify those bitstream bits, the enabling assumption in Section V.C fails and the central feasibility claim is not instantiated; if the test succeeds only after modifying the vendor bitstream management as the paper acknowledges is necessary, then the reported prototype remains incomplete and the feasibility claim is conditional rather than demonstrated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central contribution is to 'show the feasibility' of self-mutating unknown cipher modules in a non-volatile FPGA environment (Abstract, Section I). The proposed mechanism requires that the FPGA internally decrypt its encrypted bitstream, let a GENIE controller rewrite reserved template bits under TRNG control, irreversibly lock the result, and then delete the GENIE (Section V.B, Fig. 5). The authors explicitly concede that no such fabric currently exists: 'FPGA fabrics allowing even the proposed approach do not contemporarily exist' (Section I), and Section V.C states that Microsemi's bitstream management 'requires to be modified' to allow bitstream manipulation, to reveal the locations of template bits, and to enable the one-way lock. The SmartFusion2 prototype reported in Tables II and III implements only the static NI-SUC and I-SUC encryption/decryption logic; it does not implement the bitstream mutation, the GENIE manipulator, the internal decryption-to-clear-bitstream step, or the irreversible lock. Thus the load-bearing condition for the central feasibility claim, namely that a device can perform an unobservable, irreversible internal mutation of its own configuration, is not demonstrated and is not available in current hardware. If such infrastructure never materializes, the claimed SUC-creation technique cannot be instantiated; the paper then reduces to a cipher-class design plus a concept proposal, not a demonstrated feasibility result.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a technique for creating Secret Unknown Ciphers (SUCs) inside non-volatile SoC FPGAs by manipulating an encrypted configuration bitstream on-chip under TRNG control. It introduces two cipher classes, NI-SUC and I-SUC, with claimed class sizes of about 2^1350 and 2^1234, reports hardware and software complexity measurements from a SmartFusion2 prototype, and gives security analyses covering linear, differential, and post-quantum attacks. The stated main contribution is to show the feasibility of self-mutating unknown cipher modules in a non-volatile FPGA environment as a digital replacement for analog PUFs.","tokens_in":25515,"tokens_out":8926,"duration_ms":100802,"significance":"If the self-mutation process were actually realizable, SUCs could offer a useful digital alternative to analog PUFs, avoiding fuzzy extractors and operational inconsistency. The manuscript makes some constructive contributions: it gives concrete cipher-template designs, the class-size arithmetic is straightforward, and the reported resource usage for the static ciphers is low. However, the central feasibility claim is not demonstrated by the prototype, and the security claims largely reduce to class-size entropy rather than validated attack complexity. The paper is therefore more a concept proposal than a demonstrated feasibility result, and its significance as a research contribution is substantially lower than claimed.","major_comments":[{"comment":"The abstract's central claim, 'to show the feasibility of self-mutating unknown cipher-modules,' is not supported by the reported experimental work. Section I explicitly concedes that 'FPGA fabrics allowing even the proposed approach do not contemporarily exist,' and Section V.C states that Microsemi's bitstream management 'requires to be modified' to allow bitstream manipulation, to reveal template bit locations, and to enable the one-way lock. The SmartFusion2 measurements in Tables II and III implement only the static NI-SUC and I-SUC encryption/decryption logic; the GENIE, the internal decryption of EBS' to BS', the on-the-fly bitstream manipulation, and the irreversible lock are neither implemented nor measured. Thus the prototype supports the cipher templates but not the mutation process that is the stated main contribution.","section":"I and V.C, Fig. 5"},{"comment":"The security level is defined as CRE = log2 S and then reported as the achieved security, e.g., 'cloning resistance entropy of 1350 bits' in Section VI.E and the post-quantum attack complexities in Section VIII.C. This is circular: it assumes that an attacker's effort equals exhaustive search over the cipher class S, but no argument is given that recovering a specific instance from challenge-response pairs requires that search. The class-size arithmetic is internally consistent, but it does not, by itself, establish a security level against linear, differential, algebraic, or structural attacks; the separate cryptanalysis in Section VIII does not close this gap.","section":"II.C and VI.E/VII.F"},{"comment":"The linear and differential cryptanalysis sections do not substantiate the claimed 'at least 2^120' data complexity for ciphers with 30 or more rounds. The paper cites Biryukov-Shamir and Borghoff et al. structural attacks on ciphers with secret S-boxes ([33]–[36]) but does not analyze whether those techniques apply to the proposed 31-round NI-SUC and 32-round I-SUC constructions. The Lemmas only give minimum active S-box counts for two-round trails; they are not accompanied by a full characteristic over the whole cipher or by an analysis of the S-box-recovery step that the paper itself acknowledges is necessary. The security bound is therefore not demonstrated.","section":"VIII.A-B"},{"comment":"The post-quantum bounds of O(2^137) and O(2^163) are obtained by taking square roots of the S-box class sizes (2^274 and 2^326) and applying Grover's algorithm. This again equates class size with attack complexity. The presentation is also ambiguous: the text says the effective attack complexity is computed 'without considering the cardinality of the key scheduling for NI-SUC,' but the relationship of these numbers to the total reported class sizes (2^1350 and 2^1234) is not explained. No quantum attack model is given in which the class-search predicate can be evaluated efficiently, so these figures should not be presented as proven security levels.","section":"VIII.C"}],"minor_comments":[{"comment":"The displayed equations for the class cardinalities, especially equations (6) and (16), are garbled in the text and should be rewritten in a standard, unambiguous form.","section":"VI.A, VI.E, VII.F"},{"comment":"The numerical approximations '20.41 032 2396' and '17.151 20 245 9' appear corrupted; they should be replaced by clear decimal values or exact integers.","section":"VI.B and VII.B"},{"comment":"Figure 6 contains many stray 'X' characters that obscure the intended bitstream representation and should be redrawn.","section":"Fig. 6"},{"comment":"Reference [41] is incomplete and incorrectly formatted; it should cite P. W. Shor, 'Algorithms for quantum computation: discrete logarithms and factoring,' FOCS 1994.","section":"References"},{"comment":"The avalanche statistics are based on 1,000 SUC instances and 100 messages per instance, but no confidence intervals are provided; this is acceptable as an illustration but not as a statistical validation.","section":"VIII.D"}],"recommendation":"reject","confidential_remarks":"The manuscript reads as a position/concept paper, but its title and abstract claim a demonstrated feasibility result. The gap between the claims and the evidence is the primary reason for rejection; the unsupported self-mutation infrastructure and the circular security metric are load-bearing. If the authors were to resubmit, they would need to either reposition the paper as a speculative concept study or demonstrate the mutation process on hardware that actually supports the required on-chip bitstream manipulation."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is a coherent proposal for a digital, clone-resistant identity primitive built from secret unknown ciphers (SUCs), and it contains real new material: two block-cipher families (NI-SUC and I-SUC) with claimed class sizes above 2^1000, designed to map cleanly onto FPGA LUT structures, plus a template-based bitstream-mutation flow. The hardware complexity tables are helpful, and the involutive diffusion layer for I-SUC is a neat design choice. The authors are also refreshingly honest: they explicitly state that no current FPGA supports the required self-reconfiguration, and that Microsemi's bitstream management would need modification.\n\nThat honesty makes the central problem clearer. The abstract and introduction claim to \"show the feasibility\" of self-mutating unknown cipher-modules in a non-volatile FPGA environment. What the prototype actually demonstrates is the static encryption/decryption logic of the two ciphers on a SmartFusion2 board. Nothing in the prototype exercises the mutation process: no GENIE controller rewriting template bits, no internal decryption of an encrypted bitstream, no irreversible lock, no deletion step. So the load-bearing feasibility claim rests on an infrastructure that the paper itself says does not exist today. If that infrastructure never materializes, the paper reduces to a cipher-class design plus a vision statement.\n\nThe security analysis is also thinner than the claims. The cloning-resistance entropy is defined as log2 S, so the security level is largely a restatement of the class size, not a derived cryptanalytic bound. The linear and differential bounds are plausible—the 4-round minimum S-box counts seem right—but they don't address structural attacks on ciphers with secret S-boxes beyond citing Biryukov-Shamir and Borghoff et al. and then asserting that optimal S-boxes mitigate those attacks. The post-quantum section is just Grover's algorithm applied to the class size, which is fine but not new.\n\nNone of this makes the paper worthless. The cipher designs are concrete, the complexity numbers are useful, and the concept is worth airing. The right framing would be a proposal plus a preliminary cryptanalytic evaluation, not a demonstrated feasibility result. I'd send it to a serious referee—there is enough substance to justify the time—but the referee should be told to focus on the gap between the claimed feasibility and the prototype evidence. If the authors reframe the contribution and add an explicit limitations section about what the prototype does not show, it could become a decent workshop or second-tier journal paper.\n\nFor peer review: accept into the review process, with the expectation of either heavy revision or rejection based on the central claim.","headline":"A genuine new cipher-class proposal with honest admissions, but the paper's central claim of demonstrating self-mutating bitstream feasibility is not supported by the experiments.","tokens_in":25887,"tokens_out":1668,"would_cite":false,"duration_ms":19989,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that future non-volatile FPGAs can make themselves clone-resistant by self-mutating a pre-compiled cipher template into a per-device Secret Unknown Cipher, with two proposed cipher classes of $2^{1350}$ and $2^{1234}$…","keywords":["secret unknown cipher","physically unclonable function","FPGA bitstream manipulation","non-volatile FPGA","self-reconfiguration","clone resistance","SPN block cipher","true random number generator"],"falsifier":"A reader can test the central claim on current silicon by loading the proposed encrypted template bitstream into an unmodified non-volatile SoC FPGA and attempting the GENIE's decrypt, rewrite, and lock sequence; the device does not expose the clear bitstream or template bit positions, so the sequence cannot complete. If, on any modified device, reloading the original encrypted bitstream or reading back the configuration restores the pre-mutation state, the irreversible-unknown property fails and the unit would be cloneable.","tokens_in":51,"feed_emoji":"🔐","tokens_out":11106,"duration_ms":212441,"temperature":0.7,"pith_summary":"This paper claims that a non-volatile FPGA can be made physically clone-resistant by having it create its own Secret Unknown Cipher (SUC): a device-internal random selection from a cipher class so large that the resulting cipher is unknown even to its designer. The mechanism is a pre-compiled cipher-layout template inside the configuration bitstream, plus a mutation generator that rewrites only template bits under the control of the FPGA's true random number generator, then deletes itself and locks the device irreversibly. Two concrete cipher families are designed to fit FPGA LUT resources: a non-involutive class with $2^{1350}$ members and an involutive class with $2^{1234}$ members. If the mechanism worked, SUCs would give each device a consistent digital identity, replacing analog PUFs without error-correction hardware. The paper prototypes the cipher logic on a commercial non-volatile SoC FPGA, while admitting that the self-mutation infrastructure itself does not yet exist in any commercial device.","feed_headline":"A chip that rewrites its own cipher becomes uncloneable","feed_subtitle":"Two cipher-template classes with $2^{1350}$ and $2^{1234}$ variants promise digital identities without PUF error correction.","key_machinery":"The object that carries the argument is the cipher-layout template together with a bitstream manipulator called the GENIE. The template is a block of free FPGA fabric and non-volatile memory wired into the normal application bitstream with harmless default contents; because its positions are known at compile time, the GENIE can overwrite only those bits while the bitstream is being decrypted and loaded, selecting S-boxes and key-schedule LUT contents according to true random bits. After one use, the GENIE is deleted and the device is irreversibly locked, so the resulting Secret Unknown Cipher is permanent, unobservable, and not reproducible. The two proposed template structures, NI-SUC and I-SUC, are substitution-permutation block ciphers whose component mappings (optimal 4-bit S-boxes, involutive S-boxes, fixed or involutive diffusion permutations, and LUT-based random key schedules) are chosen precisely because they map one-to-one onto FPGA LUT configuration bits.","core_discovery":"Secret Unknown Ciphers are presented as practically creatable: a non-volatile SoC FPGA can hold a pre-compiled cipher-layout template and, during enrollment, modify only the template's configuration bits under the control of its internal true random number generator, thereby committing each device to one unknown cipher selected from a class so large that neither the designer, the manufacturer, nor the trusted authority can know or reproduce it. The paper proposes two concrete template families adapted to FPGA LUT resources: NI-SUC, a 31-round substitution-permutation network with 16 optimal 4-bit S-boxes and 32 random round keys stored in 64 LUTs, giving $2^{1350}$ possible ciphers; and I-SUC, a 32-round involutive SPN with involutive S-boxes and a fixed involutive diffusion layer, giving $2^{1234}$ possible ciphers. It reports prototypes of both cipher cores in a real SoC FPGA technology, with about 212 to 226 LUTs and 72 flip-flops and 896 to 1152 bytes of software overhead, and argues that avalanche behavior becomes near-ideal within a few rounds and that linear and differential attacks require more than $2^{120}$ chosen plaintexts. The central conclusion is that digital, consistent, clone-resistant identities are feasible at low cost, with the acknowledged caveat that the self-mutating bitstream infrastructure requires FPGA vendor changes that do not yet exist.","pith_inferences":["Editorial inference: The same template-mutation mechanism, if built, would generalize to unknown hash functions and stream ciphers, since the only real requirements are known template bit locations and TRNG-controlled LUT contents.","Editorial inference: The actual engineering bottleneck is vendor bitstream management; a public proof of concept would need an FPGA that exposes template bit addresses to an on-chip GENIE and then irreversibly blocks readback, a feature currently absent from commercial parts.","Editorial inference: A natural testable extension is to simulate the full mutation loop on a model FPGA bitstream, feed it many TRNG streams, and verify that the resulting cipher instances are distinct, avalanche-sound, and unrecoverable from the final locked state.","Editorial inference: The one-time-ticket protocol implies that an enrolled device cannot be re-enrolled after the GENIE is deleted, which could make SUCs useful for anti-counterfeiting and secure software-update chains, not just identification."],"forward_implications":["If the required non-volatile FPGA infrastructure appears, each unit gets a unique permanent cipher chosen from $2^{1350}$ or $2^{1234}$ possibilities, making identical devices overwhelmingly unlikely.","Because the cipher is digital and permanently locked, identity verification becomes repeatable without fuzzy extractors: a challenge-response pair authenticates the unit, then is consumed as a one-time ticket.","The prototyped cores cost about 212 to 226 LUTs and 72 flip-flops, with 896 to 1152 bytes of software overhead, so the identity module could fit into otherwise free FPGA fabric.","The security analysis implies that classical linear and differential attacks need more than $2^{120}$ chosen plaintexts, and Grover-style quantum search still leaves roughly $2^{137}$ to $2^{163}$ operations of work.","Because the GENIE is deleted and the design locked, the trusted authority cannot recreate or share the cipher, shifting clone-resistance from the manufacturer to the end user."],"supporting_citations":[{"why":"Introduces the original bio-inspired electronic-mutation concept that this work develops into FPGA bitstream mutation.","marker":"[7]"},{"why":"Earlier presentation of clone-resistant structures in Microsemi SoC units that this paper extends into the full GENIE/template creation process.","marker":"[11]"},{"why":"Supplies the exhaustive classification of optimal 4-bit S-boxes used as the NI-SUC substitution-layer library.","marker":"[30]"},{"why":"Supplies the count and properties of optimal involutive 4-bit S-boxes used for the I-SUC substitution layer.","marker":"[31]"},{"why":"Provides the involutive linear transformation that is adapted into the I-SUC diffusion layer.","marker":"[32]"},{"why":"Structural cryptanalysis of substitution-affine networks with unknown S-boxes sets the attack baseline the paper must resist.","marker":"[34]"},{"why":"Cryptanalysis of PRESENT-like ciphers with secret S-boxes motivates the paper's decision to use only optimal S-boxes with strong differential properties.","marker":"[36]"}],"fun_headline_variants":["Self-mutating FPGAs pick secret ciphers for uncloneable ID","FPGA mutates its own cipher to resist cloning","Secret unknown ciphers made real in self-mutating FPGAs","Chip that randomly rewrites cipher becomes clone-proof"],"cache_read_input_tokens":28032,"weakest_assumption_plain":"The construction assumes a non-volatile FPGA that can decrypt its own bitstream internally, rewrite template bits under true-random control, and then irreversibly lock itself and erase all trace of the process; the paper states that no such commercial device exists today and that the closest vendor technology would require modified bitstream management.","fun_headline_variants_meta":{"raw":{"variants":["Self-mutating FPGAs pick secret ciphers for uncloneable ID","FPGA mutates its own cipher to resist cloning","Secret unknown ciphers made real in self-mutating FPGAs","Chip that randomly rewrites cipher becomes clone-proof"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000185,"raw_usage":{"total_tokens":1413,"prompt_tokens":1127,"completion_tokens":286,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":743,"completion_tokens_details":{"reasoning_tokens":211}},"tokens_in":743,"tokens_out":286,"duration_ms":3309,"temperature":1.0,"reasoning_tokens":211,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T13:58:57.294730+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A reader can test the central claim on current silicon by loading the proposed encrypted template bitstream into an unmodified non-volatile SoC FPGA and attempting the GENIE's decrypt, rewrite, and lock sequence; the device does not expose the clear bitstream or template bit positions, so the sequence cannot complete. If, on any modified device, reloading the original encrypted bitstream or reading back the configuration restores the pre-mutation state, the irreversible-unknown property fails and the unit would be cloneable.","supporting_citations":[{"cited_title":"Bio -inspired electronic-mutation with genetic properties for secured identification,","cited_arxiv_id":null,"evidence_quote":"Introduces the original bio-inspired electronic-mutation concept that this work develops into FPGA bitstream mutation."},{"cited_title":"Clone-resistant structures in Microsemi SoC units,","cited_arxiv_id":null,"evidence_quote":"Earlier presentation of clone-resistant structures in Microsemi SoC units that this paper extends into the full GENIE/template creation process."},{"cited_title":"On the Classification of 4 Bit S-Boxes,","cited_arxiv_id":null,"evidence_quote":"Supplies the exhaustive classification of optimal 4-bit S-boxes used as the NI-SUC substitution-layer library."},{"cited_title":"On the Security of 4 -Bit Involutive S -Boxes for Lightweight Designs,","cited_arxiv_id":null,"evidence_quote":"Supplies the count and properties of optimal involutive 4-bit S-boxes used for the I-SUC substitution layer."},{"cited_title":"A new class of substitution-permutation networks,","cited_arxiv_id":null,"evidence_quote":"Provides the involutive linear transformation that is adapted into the I-SUC diffusion layer."},{"cited_title":"Structural cryptanalysis of SASAS,","cited_arxiv_id":null,"evidence_quote":"Structural cryptanalysis of substitution-affine networks with unknown S-boxes sets the attack baseline the paper must resist."},{"cited_title":"Cryptanalysis of PRESENT -like ciphers with secret S -boxes,","cited_arxiv_id":null,"evidence_quote":"Cryptanalysis of PRESENT-like ciphers with secret S-boxes motivates the paper's decision to use only optimal S-boxes with strong differential properties."}],"review_version":1}