GENERATION CIRCUIT FOR PHYSICALLY VEILED KEYS

Abstract

According to the invention, a generation circuit for physically masked keys is described, comprising an entropy source, a masking circuit designed to receive a first entropy source output signal and a second entropy source output signal and to output them depending on a masking control signal, a signal forwarding circuit, and a latch circuit designed to, in a first mode, charge a first node with a current supplied by the signal forwarding circuit and charge the second node with a current supplied by the signal forwarding circuit, and, in a second mode, to latch the state of the first node and the state of the second node and to output a physically masked key bit according to the latch states of the first node and the second node.

Description

[0001] The present disclosure relates to generation circuits for physically obfuscated keys.

[0002] Physically non-clonable functions (PUFs) are used to generate physically obfuscated keys (POKs). PUFs can be implemented by circuits, components, processes, or other entities capable of producing an output, such as a digital bit, a digital word, or a function that provides resistance to cloning.

[0003] Typically, a PUF value (and thus one or more POK bits) can be generated based on inherent physical characteristics of a device, such as individual physical characteristics of a transistor, like a transistor threshold voltage that varies due to local process variations during manufacturing. The PUF value or POK does not need to be stored within the device, as the PUF can be generated repeatedly. It is virtually impossible to clone a device with a PUF implemented in a way that would produce the same PUF output with a different device.

[0004] There are circuits that can effectively generate POKs. However, it is desirable that an attacker cannot discover information about a device's POKs by monitoring the circuitry, as this could allow the attacker to clone the devices.

[0005] According to various embodiments, a generation circuit for physically obfuscated keys is provided, which includes the following: • an entropy source designed to output a first entropy source output signal and a second entropy source output signal; • a masking circuit designed to receive the first entropy source output signal and the second entropy source output signal and, depending on a masking control signal supplied to the masking circuit, either ◯ to output the first entropy source output signal as a first intermediate signal and the second entropy source output signal as a second intermediate signal or ◯ to output the second entropy source output signal as the first intermediate signal and the first entropy source output signal as the second intermediate signal • a signal relay circuit with a first controlled current source and a second controlled current source, wherein the signal relay circuit is designed to control the first controlled current source by the first intermediate signal and to control the second controlled current source by the second intermediate signal and to supply the current supplied by the first controlled current source at a first node and the current supplied by the second controlled current source at a second node; and • a latch circuit designed to ◯ in a first mode, to load the first node with the current supplied by the first controlled power source, and to load the second node with the current supplied by the second controlled power source, and ◯ in a second mode to latch the state of the first node and the state of the second node and output a physically obfuscated key bit according to the latch states of the first node and the second node.

[0006] In the drawings, similar reference numerals generally refer to the same parts across different views. The drawings are not necessarily to scale; instead, they generally emphasize an illustration of the principles of the invention. The following description describes various aspects with reference to the following drawings, in which the following applies: Fig. Figure 1 shows an electronic device. Fig. Figure 2 shows a POK generation circuit (POK: physically obfuscated key) for generating one bit of a POK. Fig. Figure 3 shows an exemplary voltage-time diagram and a trigger signal according to one embodiment. Fig. Figure 4 shows an example of a POK generation circuit in more detail. Fig. Figure 5 shows a POK generation circuit according to an embodiment that is resistant to laser voltage probing or similar attacks. Fig. Figure 6 shows a POK generation circuit according to one embodiment.

[0007] The following detailed description refers to the accompanying drawings, which illustrate specific details and aspects of this disclosure in which the invention can be implemented. Other aspects may be used, and structural, logical, and electrical modifications may be made without deviating from the scope of the invention. The various aspects of this disclosure are not necessarily mutually exclusive, as some aspects of this disclosure may be combined with one or more other aspects of this disclosure to form new aspects.

[0008] Fig. Figure 1 shows an electronic device 100.

[0009] The electronic device is a data processing device, such as a microcontroller, a smart card (of any form factor), a secure microcontroller, root-trust hardware, an (embedded) secure element (ESE), a trusted platform module (TPM), or a hardware security module (HSM). The electronic device can refer to a single chip, i.e., an integrated circuit, such as a system-on-a-chip (SoC).

[0010] The electronic device 100 comprises a processor 101 (e.g., a CPU), a memory (e.g., a RAM) 102, and a POK generation circuit 103. The POK generation circuit 103 provides a multi-bit POK, for example, when the electronic device 100 is powered on or upon request. For POK generation, the POK generation circuit 103 uses one or more entropy sources that provide it with secret information, which can be considered fingerprinting information of the electronic device 100. For example, the processor 101 will only perform a specific function if the POK generation circuit 103 provides a valid POK. This protects against cloning the electronic device.

[0011] Fig. Figure 2 shows a POK(bit) generation circuit 200 for generating one bit of a POK (here also referred to as a "POK bit"). The POK(bit) generation circuit 200 can be a sub-circuit of a larger POK generation circuit. For example, the POK generation circuit 103 incorporates several of the POK(bit) generation circuits 200 as sub-circuits, so that it can generate a POK consisting of multiple (POK) bits, for example, when requested to do so by the CPU 104. Although the circuit in Figure 2 provides only one POK bit, for simplicity it is referred to as the POK generation circuit 200 (this also applies to the other examples below).

[0012] The POK generation circuit 200 comprises a first circuit C1 for generating a current signal I1, which is supplied via node NO1 to a third circuit C3. Based on the current signal I1, a voltage signal OUT is generated at node NO1, which is based on random parametric variations of one or more elements in the first circuit C1. A second circuit C2 is provided in the POK generation circuit 200 to generate a second current I2, which is supplied via node NO2 to the third circuit C3. The second current I2 is based on random parametric fluctuations of at least one element in the second circuit C2.

[0013] The third circuit, C3, provides a load circuit and can be operated in a first mode, hereinafter referred to as the amplification mode, and a second mode, hereinafter referred to as the latch mode. Depending on whether the third circuit, C3, operates in amplification mode or latch mode, different stable states are maintained for the POK generation circuit. These stable states result in different values ​​for the voltage signals OUT and OUT_N at nodes NO1 and NO2, depending on the operating mode. A stable state of the circuit is maintained when the potentials and currents at the various nodes are in a steady state, i.e., essentially maintained for at least a certain period of time.

[0014] The trigger signal TRIGGER causes circuit C3 to operate either as an amplifier or as a latch. When the trigger signal TRIGGER is low, the third circuit C3 operates as an amplifier and generates a differential voltage V. d, which is proportional to the offset I1 - I2 = ΔI. During amplification mode, the output signals OUT and OUT_n are therefore analog signals. When the trigger signal TRIGGER is raised, the third circuit, C3, switches to latch mode, which provides the digitization or latching of the PUF signal by pulling the higher of the two signals OUT and OUT_n to a high supply potential and the lower of the two signals OUT and OUT_n to a low supply potential. In one embodiment, the high supply potential can be VDD and the low supply potential can be ground, referred to herein as GND. The signals OUT and OUT_n are then held or latched to VDD or GND to provide the POK bit.

[0015] In one embodiment, the POK generation circuit 200 comprises a first transistor in the first circuit C1, wherein an operating characteristic of the first transistor is represented by the first output signal OUT. Furthermore, a second transistor is provided in the second circuit C2, wherein an operating characteristic of the second transistor is represented by the second output signal OUT_n. The transistors can be, for example, metal-oxide-semiconductor field-effect transistors (MOSFETs) or other field-effect transistors. The measurable output of each MOSFET pair can, in one embodiment, be the difference between their drain currents, which is highly susceptible to fluctuations that naturally occur during the manufacturing process. The transistor pairs, i.e., the circuits C1 and C2, can therefore be considered to form an entropy source.

[0016] In one embodiment, the POK generation circuit 200 comprises a first array of transistors in the first circuit C1, wherein the first output signal OUT is an operating feature of the first array of transistors, and a second array of transistors in the second circuit C2, wherein the second output signal OUT_n is an operating feature of the second array of transistors.

[0017] Fig. Figure 3 shows an exemplary voltage-time diagram 300 and a trigger signal according to one embodiment. At the beginning of the generation of a POK bit, nodes NO1 and NO2 are forced into a predetermined state such that the voltages at both nodes NO1 and NO2 are identical, for example, zero voltage. The predetermined state in which both are forced to the same potential is an unstable state for the POK generation circuit 200.

[0018] The POK generation circuit 200 is designed to generate a first potential at the first output node NO1 based on the first current I1 and a second potential at the second node NO2 based on the second current I2. The POK generation circuit 200 is designed to gradually transition the first and second potentials from an unstable state to a corresponding stable state, which is maintained until the end of the amplification mode. In latch mode, the POK generation circuit 200 generates a first latch potential at the first output node NO1 and a second latch potential at the second output node NO2 based on these stable states.

[0019] According to various embodiments, the difference V dThe difference between the stable state of the first potential and the second potential is smaller than the difference value between the first latch potential and the second latch potential. The difference value V d The difference between the stable state of the first potential and the stable state of the second potential depends on the random parametric variations in the first circuit C1 and the second circuit C2. The first circuit C1 and the second circuit C2 therefore form an entropy source, or PUF.

[0020] Fig. Figure 4 shows an example of a POK generation circuit 400 in more detail.

[0021] In this embodiment, the third circuit C3 comprises a first NMOS (n-channel metal oxide semiconductor) transistor N1, a second NMOS transistor N2, a third NMOS transistor N3 and a fourth NMOS transistor N4, and the circuit CS comprises a fifth NMOS transistor N5, a sixth NMOS transistor N6, a seventh NMOS transistor N7 and an eighth NMOS transistor N8.

[0022] The drain and gate of NMOS transistor N1, the drain of NMOS transistor N2, and the gate of NMOS transistor N4 are connected to the first output node NO1 of the first circuit C1. The drain and gate of NMOS transistor N3, the drain of NMOS transistor N4, and the gate of NMOS transistor N2 are connected to the second output node NO2 of the second circuit C2.

[0023] The drain of NMOS transistor N5 is connected to the source of NMOS transistor N1, the drain of NMOS transistor N6 is connected to the source of NMOS transistor N2, the drain of NMOS transistor N8 is connected to the source of NMOS transistor N4, and the drain of NMOS transistor N7 is connected to the source of NMOS transistor N3. The gates of NMOS transistors N5 and N7 are connected to a trigger node TR to receive a trigger signal TRIGGER_n, and the gates of NMOS transistors N6 and N8 are connected to VDD.

[0024] The sixth NMOS transistor N6 and the eighth NMOS transistor N8 are optional and can be replaced by direct connections between the source of NMOS transistor N2 and ground, respectively, and between the source of NMOS transistor N4 and ground.

[0025] Two nominal bias signals, bias1 and bias2, are supplied to a PMOS (p-channel metal oxide semiconductor) cascode current mirror, which is connected in Fig. 4 is designated PC. Process variations in the current-generating transistors cause a current mismatch I1 - I2 = ΔI. In one embodiment, small-area, well-matched transistors are used to avoid a systematic offset.

[0026] The third circuit, C3, is implemented using four matched NMOS transistors, N1, N2, N3, and N4. NMOS transistors N1 and N3 are diode-connected and thus behave as positive impedances, while N2 and N4 are cross-coupled and can be considered negative impedances in differential mode.

[0027] In this embodiment, NMOS transistors N5, N6, N7, and N8 are used to implement switching between amplification and latch modes. The actual switching is implemented by the fifth NMOS transistor, N5, and the seventh NMOS transistor, N7, which are triggered via a trigger node, TR, with an inverted trigger signal, TRIGGER_n. NMOS transistors N6 and N8 are intended to maintain the alignment between NMOS transistor N1 and NMOS transistor N2, and between NMOS transistor N3 and NMOS transistor N4, but otherwise have no function. The gates of transistors N6 and N8 are connected to VDD, which causes them to be always active.

[0028] During amplification mode, the inverted trigger signal TRIGGER_n is “1”, which sets the NMOS transistors N5 and N7 to active.

[0029] At the start of amplification mode, nodes NO1 and NO2 are forced to the same potential, for example, 0 V, and then released. After release, node NO1 is charged by current I1, and node NO2 is charged by current I2, causing an increase in the potentials at nodes NO1 and NO2. Even a small difference in currents I1 and I2 results in a difference in the potentials at nodes NO1 and NO2. Assuming, for example, that current I1 is slightly higher than current I2, node NO1 will be closer to the NMOS transistor threshold potential. In other words, NMOS transistors N1 and N4 will become active before NMOS transistors N2 and N3.

[0030] Once the NMOS transistors N1, N2, N3, and N4 are active, the positive admittances due to NMOS transistors N1 and N3 cancel out the negative differential admittances due to NMOS transistors N2 and N4, respectively. It can be shown that if the currents I1 and I2 have different values, an asymmetrical stable state is obtained where the potentials at NO1 and NO2 are different, assuming realistic NMOS transistor properties. Transistors N1 and N3 act as diodes with respect to the gate terminal. Therefore, unlike in latch mode, nodes NO1 and NO2 are biased across transistors N1 and N3, which are acting as diodes. This configuration causes the circuit to reach a stable state where the potentials at NO1 and NO2 are different, but not relative to either VDD or GND (ground).low supply potential) can be drawn, as in a latch. The gain can then be determined by the difference in conductance values ​​between the diode transistors and the positive feedback transistors.

[0031] In amplification mode, noise can be filtered and any dynamic effects that might occur during its activation are discarded. Capacitors can be connected to nodes NO1 and NO2, as shown in Fig. Figure 4 shows how to further filter and reduce the effect of noise, thereby increasing the robustness of the circuit. Capacitors can be added without negatively affecting the amplified offset, and decision reliability is not affected even with mismatched capacitances, since the latch mode is only triggered when the steady state in amplification mode is reached, where the potentials at nodes NO1 and NO2 are sufficiently separated.

[0032] In other words, while in a pure latching circuit, starting from equal potentials at nodes NO1 and NO2, the decision can be reversed by slight changes in potentials or currents due to noise, the amplification mode allows such effects to be at least better managed than in latching mode. The degree to which the amplification mode can tolerate noise depends on the ratio of noise intensity to mismatch. Essentially, in a pure latching mode, the circuit decides its state depending on whether node NO1 or NO2 rises faster. This can also depend on several parasitic effects, not just the static current mismatch between I1 and I2.

[0033] Latch mode begins when the inverted trigger signal TRIGGER_n drops to "0", causing NMOS transistors N5 and N7 to turn off. With NMOS transistors N5 and N7 off, NMOS transistors N1 and N3 draw no current. Therefore, the cross-coupled NMOS transistor N2 and NMOS transistor N4 allow the load to act directly as a latch. As described above, in latch mode, the direction in which the latch engages depends on which of nodes NO1 and NO2 charges faster to the threshold potential at which N2 and N4 become active. Because the potential at nodes NO1 and NO2 is already sufficiently separated at the start of latch mode due to the previous amplification mode, the latching process is less susceptible to noise, and reversal of a latching process due to noise is less likely.

[0034] As in Fig. As illustrated in Figure 2, during amplification mode the potential difference Vd between out and out_n is low, averaging less than 50 mV in one embodiment. Such a small delta cannot be resolved by optical attacks. However, when switching to latch mode, Vd increases. d The voltage is close to the core voltage of the electronic device, which is typically on the order of 1 V. Therefore, despite the small size of the connected transistors, optical detection of the relative voltages is expected to be possible. Consequently, secrets (i.e., information about the POK bits) can leak out.

[0035] Fig. Figure 5 shows a POK generation circuit 500 according to an embodiment that is resistant to laser voltage probing or similar attacks.

[0036] Compared to the POK generation circuit 400 from Fig. In section 4, two additional components, C4 and C5, are added. They separate C1 and C2, i.e., the origin of the device-specific (e.g., chip-specific) POK bit (i.e., the entropy source), from the gain and latch circuit C3. In other words, C4 and, in particular, C5 decouple C3 from C1 and C2.

[0037] C4 is a controlled crossing element. It has a control input called a mask. Depending on the mask value, the currents I1 and I2 either flow directly to nodes cross1 and cross2, or they are crossed, so that I1 flows to cross2 and I2 to cross1.

[0038] The junction in C4 can be implemented using transmission gates consisting of an NMOS and a PMOS transistor (or using only a single MOS type, i.e., NMOS or PMOS). The junction element C4 is designed such that the currents I1 and I2 are only negligibly affected by these transistors.

[0039] Circuit C5 emulates circuit C3 in amplification mode. Transistors N11 and N12 take over the roles of transistors N1 and N3. Therefore, nodes cross1 and cross2 show similar voltages to out and out_n (see Fig. 2) in amplification mode. Accordingly, the voltage difference between cross1 and cross2 is too small to be measured optically.

[0040] Nevertheless, the potential difference between cross1 and cross2 leads to different currents through transistors N9 and N10. These currents can be interpreted as simulations of I1 and I2. Depending on the value of the mask input at C4, the current through N9 is either a simulation of I1 or I2, and the current through N10 is either I2 or I1.

[0041] Since the voltage isolation in latch mode only affects transistors N9, N10, and the transistors in C3, optical readout is only possible after the currents have crossed, or even after they haven't. Even if an attacker could read the isolated voltages all at once without knowing the masking bit, no information would be transmitted. Furthermore, all current optical attacks are far from being able to read this information all at once. Dozens of repeated isolation events must be superimposed to obtain the necessary information. A randomly changing mask input makes these attacks impossible.

[0042] A good match between transistors N11 and N12, N1 and N3, and N9 and N10 is required to reliably generate the inverted output when the mask bit is changed. Monte Carlo simulations show that this is achievable with reasonable transistor sizes.

[0043] Extending the POK generation circuit with a crossover circuit (or masking circuit, C4 in the example above) and a forwarding circuit (or decoupling circuit, C5 in the example above) enables the generation of a device-specific (e.g., chip-specific) bit sequence (fingerprint) while avoiding the vulnerability to optical attacks.

[0044] In summary, according to various embodiments, a circuit is provided as described in Fig. 6 illustrates.

[0045] Fig. Figure 6 shows a generation circuit for physically obfuscated keys (POK) 600 according to one embodiment.

[0046] The POK generation circuit 600 includes an entropy source 601 (or in other words a PUF) which is designed to output a first entropy source output signal and a second entropy source output signal.

[0047] The POK generation circuit 600 also includes a masking circuit 602 (C4 in the example of Fig. 5), which is designed to receive the first entropy source output signal and the second entropy source output signal and, depending on a (e.g., digital) masking control signal (e.g., a mask bit) supplied to the masking circuit, either • to output the first entropy source output signal as a first intermediate signal (at a first output of the masking circuit) and the second entropy source output signal as a second intermediate signal (at a second output of the masking circuit; e.g., in response to the masking control signal having a first value) or • to output the second entropy source output signal as the first intermediate signal (at the first output of the masking circuit) and the first entropy source output signal as the second intermediate signal (at a second output of the masking circuit). In other words, depending on the masking control signal, the masking circuit either swaps (or interchanges) the first and second entropy source output signals, or it does not; that is, the masking circuit distributes the entropy source output signals to its outputs depending on the masking control signal (e.g., in response to the masking control signal having a second value).

[0048] The POK generation circuit 600 also includes a signal forwarding circuit 603 (C5 in the example of Fig. 5. It can also be viewed as a decoupling circuit, since it decouples the entropy source from the latch circuit) with a first controlled current source and a second controlled current source, wherein the signal propagation circuit is designed to (receive the first intermediate signal and) control the first controlled current source by the first intermediate signal and (receive the second intermediate signal and) control the second controlled current source by the second intermediate signal and the current supplied by the first controlled current source at a first node (NO 1 in the example of Fig. 5), and the current supplied by the second controlled power source at a second node (NO2 in the example of Fig. 5), to deliver.

[0049] The POK generation circuit 600 also includes a latch circuit 604, which is designed to • in a first mode (stabilization mode or "amplification" mode) to load the first node with the current supplied by the first controlled power source, and to load the second node with the current supplied by the second controlled power source, and • in a second mode (latch mode) to latch the state of the first node and the state of the second node and output a physically obfuscated key bit according to the latch states of the first node and the second node.

[0050] In other words, according to various embodiments, the secret generation part is decoupled from the latch circuit, which separates the voltages (reflecting the generated secret, i.e., in the example above, the voltages out and out_n) in latch mode.

[0051] The following are several examples: Example 1 is a generation circuit for physically obfuscated keys, as described in reference to Fig. 6 described. Example 2 is the physically obfuscated key generation circuit from Example 1, where the latch circuit is designed to latch the state of the first node and the state of the second node into digitally inverse digital states (i.e., one is inverse to the other, i.e., one is at a high reference potential and the other is at a low reference potential, or in other words, one is a digital '1' and the other is a digital '0'). Example 3 is the physically obfuscated key generation circuit of Example 1 or 2, where the first controlled current source and the second controlled current source are voltage-controlled current sources. Example 4 is the physically obfuscated key generation circuit from one of Examples 1 to 3, wherein the first entropy source output signal and the second entropy source output signal are analog signals (and accordingly, the first intermediate signal and the second intermediate signal are also analog signals), and the signal forwarding circuit is designed to convert the first intermediate signal into a first voltage and control the first controlled current source with the first voltage, and to convert the second intermediate signal into a second voltage and control the second controlled current source with the second voltage. Example 5 is the physically obfuscated key generation circuit of Example 4, wherein the first controlled current source comprises one or more first transistors, at least one of which is supplied with a high supply potential and at least one of which is controlled at its gate by the first voltage, and wherein the second controlled current source comprises one or more second transistors, at least one of which is supplied with the high supply potential and at least one of which is controlled at its gate by the second voltage. Example 6 is the physically obfuscated key generation circuit from one of Examples 1 to 5, wherein the latch circuit is designed to receive a digital trigger signal, and wherein the latch circuit is designed to transition from the first mode to the second mode in response to a level change of the digital trigger signal. Example 7 is the physically obfuscated key generation circuit from any of Examples 1 to 6, wherein the entropy source includes a third current source designed to provide the first entropy source output signal and a fourth current source designed to provide the fourth entropy source output signal. Example 8 is the physically obfuscated key generation circuit of Example 7, wherein the third power source comprises one or more third transistors and the fourth power source comprises a respective fourth transistor for each third transistor, the gate of which is coupled to the gate of the third transistor. Example 9 is the physically obfuscated key generation circuit of Example 8, wherein the one or more third transistors are connected in series and supplied with a high supply potential, and the one or more fourth transistors are connected in series and supplied with the high supply potential. Example 10 is the physically masked key generation circuit of any of Examples 1 to 9, wherein the masking circuit comprises one or more transmission gates connecting inputs of the masking circuit, wherein the masking circuit receives the first entropy source output signal and the second entropy source output signal with outputs of the masking circuit, wherein the masking circuit provides the first intermediate signal and the second intermediate signal, and wherein the one or more transmission gates are controlled by the masking control signal. Example 11 is the physically obfuscated key generation circuit of one of Examples 1 to 10, comprising several subcircuits, each subcircuit being associated with a respective bit position of a physically obfuscated key, each subcircuit comprising: • an entropy source designed to output a first entropy source output signal and a second entropy source output signal • a masking circuit designed to receive the first entropy source output signal and the second entropy source output signal and, depending on a masking control signal supplied to the masking circuit, either ◯ to output the first entropy source output signal as a first intermediate signal and the second entropy source output signal as a second intermediate signal or ◯ to output the second entropy source output signal as the first intermediate signal and the first entropy source output signal as the second intermediate signal • a signal relay circuit with a first controlled current source and a second controlled current source, wherein the signal relay circuit is designed to control the first controlled current source by the first intermediate signal and to control the second controlled current source by the second intermediate signal and to supply the current supplied by the first controlled current source at a first node and the current supplied by the second controlled current source at a second node; and • a latch circuit designed to, in the first mode, charge the first node with the current supplied by the first controlled current source and charge the second node with the current supplied by the second controlled current source, and in the second mode, latch the state of the first node and the state of the second node and output a physically obfuscated key bit for the bit position associated with the sub-circuit according to the latch states of the first node and the second node.

[0052] Although specific embodiments have been illustrated and described herein, it will be clear to those skilled in the art that a variety of alternative and / or equivalent implementations can be substituted for the specific embodiments shown and described without departing from the scope of the present invention. This application is intended to cover all adaptations or variations of the specific embodiments discussed herein. Therefore, this invention is to be limited only by the claims and their equivalents. Reference sign 100 Electronic Device 101 processor 102 storage locations 103 POK generation circuit 200 POK generation circuit C1-C3 circuits NO1, NO2 nodes 300 Voltage-Time Diagram 400 POK generation circuit N1-N8 transistors C1-C3 circuits NO1, NO2 nodes 500 POK generation circuit P1, P2 transistors N1-N12 transistors C1-C3 circuits NO1, NO2 nodes C4, C5 Additional components 600 POK generation circuit 601 Entropy source 602 Masking circuit 603 Signal forwarding circuit 604 Latch Circuit

Claims

[1] Physically obfuscated key generation circuit, comprising: an entropy source designed to output a first entropy source output signal and a second entropy source output signal; a masking circuit designed to receive the first entropy source output signal and the second entropy source output signal and depending on a masking control signal supplied to the masking circuit, either • to output the first entropy source output signal as a first intermediate signal and the second entropy source output signal as a second intermediate signal or • to output the second entropy source output signal as the first intermediate signal and the first entropy source output signal as the second intermediate signal. a signal transmission circuit with a first controlled current source and a second controlled current source, wherein the signal transmission circuit is designed to control the first controlled current source by the first intermediate signal and to control the second controlled current source by the second intermediate signal and to supply the current supplied by the first controlled current source at a first node and the current supplied by the second controlled current source at a second node; and a latch circuit designed to, in a first mode, load the first node with the current supplied by the first controlled power source, and to load the second node with the current supplied by the second controlled power source, and In a second mode, latch the state of the first node and the state of the second node and output a physically obfuscated key bit according to the latch states of the first node and the second node. [2] A generation circuit for physically obfuscated keys according to claim 1, wherein the latch circuit is designed to latch the state of the first node and the state of the second node into digital inverse digital states. [3] A generating circuit for physically obfuscated keys according to claim 1 or 2, wherein the first controlled current source and the second controlled current source are voltage-controlled current sources. [4] A physically obfuscated key generation circuit according to any one of claims 1 to 3, wherein the first entropy source output signal and the second entropy source output signal are analog signals and the signal forwarding circuit is designed to convert the first intermediate signal into a first voltage and to control the first controlled current source with the first voltage and to convert the second intermediate signal into a second voltage and to control the second controlled current source with the second voltage. [5] A physically obfuscated key generation circuit according to claim 4, wherein the first controlled current source comprises one or more first transistors, at least one of which is supplied with a high supply potential and at least one of which is controlled at its gate by the first voltage, and wherein the second controlled current source comprises one or more second transistors, at least one of which is supplied with the high supply potential and at least one of which is controlled at its gate by the second voltage at its gate. [6] A generating circuit for physically concealed keys according to any one of claims 1 to 5, wherein the latch circuit is designed to receive a digital trigger signal, and wherein the latch circuit is designed to switch from the first mode to the second mode in response to a level change of the digital trigger signal. [7] A physically obfuscated key generation circuit according to any one of claims 1 to 6, wherein the entropy source comprises a third current source designed to provide the first entropy source output signal and a fourth current source designed to provide the fourth entropy source output signal. [8] A physically obfuscated key generation circuit according to claim 7, wherein the third current source comprises one or more third transistors and the fourth current source comprises a fourth transistor for each third transistor, the gate of which is coupled to the gate of the third transistor. [9] Generating circuit for physically obfuscated keys according to claim 8, wherein the one or more third transistors are connected in series and supplied with a high supply potential and the one or more fourth transistors are connected in series and supplied with the high supply potential. [10] A generation circuit for physically masked keys according to any one of claims 1 to 9, wherein the masking circuit comprises one or more transmission gates connecting inputs of the masking circuit, wherein the masking circuit receives the first entropy source output signal and the second entropy source output signal with outputs of the masking circuit, wherein the masking circuit provides the first intermediate signal and the second intermediate signal, wherein the one or more transmission gates are controlled by the masking control signal. [11] A generation circuit for physically obfuscated keys according to any one of claims 1 to 10, comprising several sub-circuits, each sub-circuit being associated with a respective bit position of a physically obfuscated key, each sub-circuit comprising: an entropy source designed to output a first entropy source output signal and a second entropy source output signal; a masking circuit designed to receive the first entropy source output signal and the second entropy source output signal and depending on a masking control signal supplied to the masking circuit, either • to output the first entropy source output signal as a first intermediate signal and the second entropy source output signal as a second intermediate signal or • to output the second entropy source output signal as the first intermediate signal and the first entropy source output signal as the second intermediate signal a signal forwarding circuit with a first controlled current source and a second controlled current source, wherein the signal forwarding circuit is designed to control the first controlled current source by the first intermediate signal and to control the second controlled current source by the second intermediate signal and to supply the current supplied by the first controlled current source at a first node and the current supplied by the second controlled current source at a second node; and a latch circuit designed to, in the first mode, load the first node with the current supplied by the first controlled power source, and to load the second node with the current supplied by the second controlled power source, and In the second mode, latch the state of the first node and the state of the second node and output a physically obfuscated key bit for the bit position associated with the sub-circuit according to the latch states of the first node and the second node.

Images