Physically Unclonable Functions (PUFs) are increasingly being proposed as central building blocks in cryptographic protocols and security architectures. The SRAM-based PUF is a proposed implementation of this primitive which reuses the existing memory of the underlying device and thus enjoys a very low implementation overhead.
In this work we present a side-channel attack based on remanence decay in volatile memory and show how it can be exploited effectively to launch a non-invasive cloning attack against SRAM PUFs. We validate our approach against two SRAM PUF implementations in 65 nm CMOS ASICs. We discuss countermeasures against our attack and propose the constructive use of remanence decay to improve the cloning-resistance of SRAM PUFs.
Joint work with Ahmad-Reza Sadeghi and Christian Wachsmann (TU Darmstadt).