{"id":"a1c00ff4-8d15-4544-98b8-270598529b33","arxiv_id":"2506.17795","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"A unified PUF-TRNG using a soft-data sponge function passes NIST 800-22, NIST 800-90B, AIS-31, and DieHarder tests at 2.67 Mbps on Zynq FPGAs.","lead":"The authors build a true random number generator on FPGAs by reusing a physical unclonable function and adding a new 'soft-data' sponge post-processor that mixes static manufacturing variation with measurement noise. The resulting bitstreams pass four standard randomness test suites at about 2.67 Mbit/s, with min-entropy estimates around 0.94 to 0.999 per bit.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed full bit of dynamic entropy from XORing 12 low-order path-delay bits is never measured on the raw source, so the 'true random' claim is unsupported.","rationale":"The reader's weakest-assumption identification matches the most load-bearing concern: the paper's TRNG claim rests on a dynamic entropy source whose per-bit entropy is asserted, not measured. The paper reports extensive statistical testing of the post-processed output, but every one of those tests can pass for a deterministic pseudorandom generator. The only source-level evidence is a NIST SP 800-22 run on nonce bit sequences (Section IV.E), which is insufficient because such tests check distributional properties, not unpredictability. The NIST SP 800-90B results in Table II are computed on conditioned output, so they do not satisfy the standard's entropy-source validation requirement. This gap is not a minor omission: it directly undermines the classification of the design as a true random number generator. That said, the statistical claims themselves are not contradicted by this concern, and the reader's CONDITIONAL verdict appropriately requests response rather than outright rejection. The concrete test—applying NIST SP 800-90B to raw nonce bits and optionally disabling nonce randomization—would settle whether the asserted full bit of dynamic entropy actually exists. Because the identified concern is exactly the reader's weakest assumption, agreement is 'agree' and the verdict is unchanged.","tokens_in":14342,"tokens_out":3376,"duration_ms":45286,"concrete_test":"Collect the raw nonce bit sequences produced by XORing 12 consecutive low-order delay bits over many bootstrap/phase operations on all five boards, before they enter the sponge, and run NIST SP 800-90B min-entropy estimation (IID and non-IID tracks) plus an autocorrelation/long-run analysis. If the per-bit min-entropy is not near 1, or if the nonce sequences show predictability across phases under fixed temperature/voltage, the claimed dynamic entropy source is not validated. As a secondary check, generate output with nonces forced to a constant value; if the final output still passes all statistical suites with similar min-entropy, that confirms the statistical passes cannot be attributed to fresh dynamic entropy.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central security claim of a TRNG depends on the dynamic entropy source: the 341 nonce bits per phase are supposed to provide fresh, unpredictable entropy that randomizes the LFSR and sponge parameters. Section III.A asserts that XORing the low-order bits of 12 consecutive path-delay measurements yields one full bit of dynamic entropy, and says this was determined from FPGA experiments, but no raw-source entropy estimate, autocorrelation analysis, or noise characterization is reported. Section IV.E applies NIST SP 800-22 to 100,000-bit nonce sequences, but statistical pass/fail tests are not a substitute for min-entropy estimation and do not establish that the bits are unpredictable or independent. The NIST SP 800-90B min-entropy values in Table II are computed on the final output after 2,048 iterations of deterministic post-processing; such values are expected even for a deterministic PRNG and cannot validate the noise source. Without direct measurement of the raw nonce entropy, the output could be a deterministic function of the static PUF data and a predictable LFSR, and the distinction between a statistical-looking bitstream and a true random bitstream is not established. NIST SP 800-90B explicitly targets entropy-source evaluation; that step is missing here.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes a unified PUF-TRNG architecture built on the SiRF strong PUF, combining static path-delay differences with dynamic noise captured in the low-order bits of time-to-digital-converter (TDC) measurements. A novel soft-data sponge construction (DVDiff, GPEV, SF chaining, BitGen) post-processes digitized delay values over 2,048 iterations to generate random bit sequences. The authors report that 40 Mbit sequences per board pass NIST SP 800-22, 10 MByte sequences pass NIST SP 800-90B with worst-case min-entropy between 0.941 and 0.946, all AIS-31 tests pass, and all DieHarder tests pass on five Zynq ZYBO boards; they also report a 2.67 Mbps bit rate and about 5% resource overhead over the stand-alone SiRF PUF.","tokens_in":1539,"tokens_out":2052,"duration_ms":74035,"significance":"If the raw dynamic entropy source were properly validated, this would be a valuable compact unified PUF-TRNG with unusually comprehensive statistical testing, and the reuse of the PUF infrastructure is practically attractive. The paper deserves credit for running four statistical test suites, for comparing against OpenSSL, and for reporting resource utilization and throughput. However, the central contribution is currently conditional on an unverified entropy-source claim: the statistical evidence as presented does not establish that the output is truly random, because the entropy source itself is never assessed and the post-processed stream is used for validation.","major_comments":[{"comment":"The claim that XORing the low-order bits of 12 consecutive path-delay measurements yields one full bit of dynamic entropy is never supported by a direct measurement of the raw source. The paper says this was determined from FPGA experiments but provides no raw-source min-entropy estimate, autocorrelation analysis, or noise characterization. Section IV.E applies NIST SP 800-22 to 100,000-bit nonce sequences, but a statistical pass of a distilled sequence does not quantify the entropy rate or independence of the underlying source. Because the TRNG's true-randomness claim rests entirely on this dynamic entropy, the paper must provide an entropy-source-level evaluation, e.g., NIST SP 800-90B on the raw nonce bits, and ideally show that the min-entropy per raw bit is at least 1/12.","section":"Section III.A and Section IV.E"},{"comment":"The NIST SP 800-90B min-entropy estimates are computed on the final output after 2,048 iterations of deterministic post-processing. As the authors themselves note, the sponge is a pseudo-random permutation; a deterministic bijection fed with constant or very low-entropy input can produce output that passes IID tests and yields high min-entropy estimates (cf. any PRNG). Therefore the values in Table II cannot validate the entropy source. NIST SP 800-90B is explicitly intended for entropy-source evaluation, and applying it only to the post-processed stream is not a substitute.","section":"Section IV.B and Table II"},{"comment":"The manuscript repeatedly states that the soft-data sponge 'adds entropy' to the random bit sequences and 'completely exhausts the underlying entropy.' A deterministic permutation over a finite state space cannot add Shannon or min-entropy; it can only mix and decorrelate. This is not merely a phrasing issue: it obscures the fact that all entropy must originate from the raw path-delay noise and the nonce bits. If the raw source has insufficient entropy, the sponge cannot make the output truly random. The paper should either correct this claim or provide a rigorous argument for how the construction increases entropy.","section":"Abstract and Section III.E"},{"comment":"Several key parameters (XOR count of 12, RC and TCC ranges, SF bound, number of sponge iterations, TDC resolution) are described as having been chosen on the basis of FPGA experiments, and the reported configuration was tuned until the statistical suites passed. Because the same families of boards are used both for parameter selection and for final evaluation, the reported pass rates constitute an in-sample assessment. The paper should provide a clear separation between a design/tuning phase and a validation phase (e.g., a hold-out set of boards or a pre-specified parameter-selection rule) to rule out overfitting as the cause of the statistical quality.","section":"Section III (parameter selection)"}],"minor_comments":[{"comment":"The caption and text refer to '222 DV Dcs' and '22 DV Dcs'; these appear to be formatting losses for 2 to the power 22 (4,194,304). Please use proper superscript notation consistently.","section":"Fig. 6 caption and Section III.C"},{"comment":"341 nonce bits is 42.625 bytes, so describing them as 'approximately 42 bytes' is imprecise; 'about 43 bytes' would be more accurate.","section":"Section III.A"},{"comment":"The DieHarder section says 'the amount of data is unknown but in the range of 250 GigaBytes.' This is vague; please report the exact number of bits or bytes used for each board.","section":"Section IV.D"},{"comment":"The description of the two 11-bit LFSRs does not explain how the per-sample pseudo-random selection works within a single iteration, given that the seeds are merely incremented and decremented at the start of each iteration. Please clarify.","section":"Section III.C.1"},{"comment":"The notation in Eqs. (2)-(4) is confusing: using max(DVD) after defining DVD as a set, and then writing max over all j in |DVD| of DVD_j, mixes set-level and element-level operations. Please rewrite with explicit indexing.","section":"Equations (2)-(4)"}],"recommendation":"major_revision","confidential_remarks":"The core architectural idea is interesting and the empirical effort is substantial, but the missing raw-entropy evaluation is a genuine blocker for a TRNG paper. The recommendation may be upgraded if the authors provide direct min-entropy measurements of the raw nonce source and a credible parameter-selection protocol. The paper's heavy reliance on self-citations to the SiRF PUF is understandable but should be balanced with a clearer statement of what is new in the TRNG contribution beyond the post-processing."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is the first TRNG built on the SiRF PUF, and the soft-data sponge post-processor is a genuine new twist. The engineering is careful, the test coverage is broad, and the ~5% area overhead for a unified PUF-TRNG is attractive. But the paper never measures the thing that makes a TRNG a TRNG: the raw dynamic entropy source. That is not a minor gap; it is the load-bearing claim.\n\nWhat is good: reusing the PUF's post-processing chain with a mode switch is sensible; the SF-chaining correlation analysis in Fig. 7 is exactly the kind of diagnostic that should be in every TRNG paper; the suite coverage (NIST SP 800-22, SP 800-90B, AIS-31, DieHarder) is thorough for the output stream; and the DieHarder comparison with OpenSSL is a nice sanity check. The claim that the architecture adds only about 5% area over the standalone SiRF PUF is concrete and useful. The self-citation to the prior SiRF PUF work is appropriate, since this paper extends that architecture.\n\nWhere it wobbles: Section III.A asserts that XORing 12 low-order TDC bits yields one full bit of dynamic entropy, based on unspecified FPGA experiments, and that claim is the foundation of the TRNG. The paper validates the nonce bits only with NIST SP 800-22 pass/fail, which cannot distinguish a good PRNG from a noise source. The SP 800-90B min-entropy numbers in Table II are computed on the output after 2,048 iterations of deterministic post-processing; those numbers would look similar for a deterministic generator and cannot justify the entropy source. The statement that the sponge 'adds entropy' is also wrong in the cryptographic sense; a deterministic permutation mixes and diffuses entropy, it does not create it. The 'pseudo-random permutation' property of SF chaining is asserted, not proven. And the RC/TCC ranges and XOR count appear to have been tuned until the tests passed, which is common in this literature but should be stated plainly.\n\nNone of this means the architecture is broken. It may well be a solid unified PUF-TRNG. But the paper currently asks the reader to take the entropy source on faith, and that is exactly where a TRNG should be held to evidence. A revision that adds SP 800-90B on the raw nonce bits (or at least a documented noise characterization from the TDC) and rewrites the entropy language would make this a much stronger paper.\n\nWho it is for: hardware security researchers working on integrated PUF-TRNGs and FPGA TRNG design. It deserves a serious referee; with the entropy-source hole fixed, it could be a useful reference. I would send it to review, but I would insist on the raw-source evaluation before acceptance.","headline":"A plausible, well-tested unified PUF-TRNG whose load-bearing entropy-source claim is never directly measured; needs revision before it can be trusted as a TRNG.","tokens_in":15163,"tokens_out":2286,"would_cite":false,"duration_ms":25041,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper shows that a single FPGA design can act as both a strong PUF and a TRNG: soft delay values run through a sponge function, and the output passes four randomness test suites.","keywords":["true random number generator","physical unclonable function","SiRF PUF","soft-data sponge","time-to-digital converter","FPGA","min-entropy","statistical testing"],"falsifier":"Run NIST SP 800-90B's entropy-source tests on the raw TDC low-order-bit stream before the 12-bit XOR and sponge processing; if the estimated min-entropy per bit is substantially below 1, or adjacent bits are autocorrelated, the claimed one full bit of dynamic entropy per 12 measurements fails and the TRNG's entropy budget collapses.","tokens_in":14178,"feed_emoji":"🎲","tokens_out":7294,"duration_ms":74071,"temperature":0.7,"pith_summary":"This paper proposes a single FPGA circuit that acts as both a strong physical unclonable function (PUF) and a true random number generator (TRNG). It claims that by reusing the SiRF PUF's path-delay measurement hardware and adding a soft-data sponge post-processing step, the circuit produces random bit streams that pass NIST SP 800-22, NIST SP 800-90B, AIS-31, and DieHarder tests. The reported worst-case min-entropy across five boards is between 0.941 and 0.999, with a bit rate of about 2.67 Mbps and only about 5% area overhead over the standalone PUF. This matters because a compact unified hardware security primitive could supply both key generation and random-number generation for resource-constrained systems.","feed_headline":"One FPGA circuit yields a PUF and a TRNG at 2.67 Mbps","feed_subtitle":"Soft-data sponge on SiRF PUF delay measurements passes NIST, AIS-31, and DieHarder with 5% overhead.","key_machinery":"The load-bearing object is the soft-data sponge: a modified duplex sponge construction that permutes fixed-point values in a range around ±64 through chaining, rather than operating on bitstrings like SHA-3. Its absorption phase uses two 11-bit LFSRs to pseudo-randomly pair stored delay values (DVDiff), followed by GPEV linear transforms that standardize the difference distribution against temperature and voltage; its permutation phase is the Spread-Factor module, which offsets each compensated difference by a running factor and folds outliers back into a bounded band, creating a triangular SF distribution and destroying correlations introduced by reusing the same delay values across iterations. BitGen then squeezes one bit per value by its sign. The randomized Range Constant and Trim Code Constant inject nonce-derived unpredictability into the transforms.","core_discovery":"The paper's central claim is that static manufacturing-variation entropy from the SiRF PUF can be combined with dynamic measurement noise from a time-to-digital converter (TDC) to yield a TRNG without building a separate entropy circuit. The key move is a new post-processing chain modeled on a duplex sponge that runs on soft fixed-point delay values rather than bits. Each iteration of the sponge loop recombines stored delay values, compensates for temperature and voltage with the GPEV linear transforms, permutes values through spread-factor chaining, and squeezes one bit per processed value based on sign. The authors report that SF chaining is necessary: without it, correlated copies of difference sequences produce 100% Pearson correlations and the bitstreams fail the statistical suites; with it, correlations stay below ±10% and the bitstreams pass. They also report that XORing the low-order bits of 12 consecutive TDC measurements yields one full bit of dynamic entropy, providing 341 nonce bits per 4,096 path measurements to randomize the sponge parameters. The NIST SP 800-22 suite passed except for a single non-overlapping template subtest on one board, where 36 of 40 strings passed rather than the required 37.","pith_inferences":["The entropy-generating step that most deserves independent scrutiny is the 12-bit XOR distillation; the paper validates it only with post-processed bitstream tests, so a natural extension is to run NIST SP 800-90B directly on the raw XORed noise stream before the sponge.","If the raw noise assumption holds, the same soft-data sponge recipe could plausibly be ported to other delay-based PUFs, such as arbiter or ring-oscillator designs, turning any of them into a unified PUF-TRNG without a separate oscillator-based entropy core; the paper does not test this portability.","The reported DieHarder run lasted over 20 days, but the paper does not address aging or radiation-induced drift in TDC noise, so a longer-term reliability study would test whether the entropy source degrades over device lifetime.","A single marginal failure in one non-overlapping template subtest on one board is not discussed beyond being reported; a stricter multi-board replication with more than 40 sequences per board would show whether that shortfall is a statistical fluke or a systematic weakness."],"forward_implications":["A single compact module can serve both PUF-based key generation and TRNG duty in a hardware security module, since the TRNG reuses more than 95% of the standalone SiRF PUF's logic and adds only about 5% area.","The reported pass rates across four statistical suites, including long-run DieHarder data, suggest the output meets common acceptance criteria for cryptographic random bit sequences.","Because the GPEV compensation is built into the sponge chain, the design carries a built-in defense against temperature and supply-voltage shifts that often destabilize PUF-based entropy.","Bit generation scales with clock frequency, so the 2.67 Mbps rate is not a hard ceiling; raising the FPGA clock would roughly double throughput."],"supporting_citations":[{"why":"Defines the SiRF PUF whose static entropy, TDC measurement infrastructure, and post-processing modules the TRNG reuses.","marker":"[6]"},{"why":"Supplies the sponge-construction concept that the soft-data post-processing chain is modeled on.","marker":"[19]"},{"why":"The NIST SP 800-22 suite used to validate the generated bit sequences.","marker":"[20]"},{"why":"The NIST SP 800-90B suite used to estimate min-entropy and test IID behavior.","marker":"[21]"},{"why":"The AIS-31 suite used as additional statistical validation.","marker":"[22]"},{"why":"The DieHarder suite used for long-run testing of the generated bitstreams.","marker":"[23]"},{"why":"Identifies the ZYBO Z7-10 FPGA platform on which the five-device experiments were run.","marker":"[24]"}],"fun_headline_variants":["Unified PUF-TRNG on one FPGA uses soft-data sponge","Soft-data sponge converts SiRF PUF noise into TRNG","Strong PUF and TRNG combined in single FPGA at 2.67 Mbps","SiRF PUF's dynamic entropy drives novel TRNG design","One circuit: PUF and TRNG pass NIST and DieHarder"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The design's randomness rests on the claim that XORing the low-order bits of 12 consecutive TDC path-delay measurements produces one full bit of independent physical noise, an assertion the paper bases on FPGA experiments but does not check with a source-level entropy test.","fun_headline_variants_meta":{"raw":{"variants":["Unified PUF-TRNG on one FPGA uses soft-data sponge","Soft-data sponge converts SiRF PUF noise into TRNG","Strong PUF and TRNG combined in single FPGA at 2.67 Mbps","SiRF PUF's dynamic entropy drives novel TRNG design","One circuit: PUF and TRNG pass NIST and DieHarder"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.0003,"raw_usage":{"total_tokens":1814,"prompt_tokens":1109,"completion_tokens":705,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":725,"completion_tokens_details":{"reasoning_tokens":610}},"tokens_in":725,"tokens_out":705,"duration_ms":6816,"temperature":1.0,"reasoning_tokens":610,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T23:23:56.909722+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run NIST SP 800-90B's entropy-source tests on the raw TDC low-order-bit stream before the 12-bit XOR and sponge processing; if the estimated min-entropy per bit is substantially below 1, or adjacent bits are autocorrelated, the claimed one full bit of dynamic entropy per 12 measurements fails and the TRNG's entropy budget collapses.","supporting_citations":[{"cited_title":"Shift Register, Reconvergent-Fanout (SiRF) PUF Implementation on an FPGA,","cited_arxiv_id":null,"evidence_quote":"Defines the SiRF PUF whose static entropy, TDC measurement infrastructure, and post-processing modules the TRNG reuses."},{"cited_title":"Sponge-based pseudo-random number generators,","cited_arxiv_id":null,"evidence_quote":"Supplies the sponge-construction concept that the soft-data post-processing chain is modeled on."},{"cited_title":"A statistical test suite for random and pseudorandom number generators for cryptographic applications,","cited_arxiv_id":null,"evidence_quote":"The NIST SP 800-22 suite used to validate the generated bit sequences."},{"cited_title":"A proposal for: Functionality classes for random number generators,","cited_arxiv_id":null,"evidence_quote":"The AIS-31 suite used as additional statistical validation."},{"cited_title":"DieHarder: A Random Number Test Suite,","cited_arxiv_id":null,"evidence_quote":"The DieHarder suite used for long-run testing of the generated bitstreams."},{"cited_title":"[Online]","cited_arxiv_id":null,"evidence_quote":"Identifies the ZYBO Z7-10 FPGA platform on which the five-device experiments were run."}],"review_version":1}