Physically unclonable cryptographic primitives using

0 downloads 2 Views 6MB Size Report
Feb 22, 2016 - quality is ensured by using the manual probe station. It is expected ..... Z.H. and S.J.H. wrote the manuscript All authors discussed the results.

ARTICLES PUBLISHED ONLINE: 22 FEBRUARY 2016 | DOI: 10.1038/NNANO.2016.1

Physically unclonable cryptographic primitives using self-assembled carbon nanotubes Zhaoying Hu1, Jose Miguel M. Lobez Comeras2, Hongsik Park2,3, Jianshi Tang2, Ali Afzali2, George S. Tulevski2, James B. Hannon2, Michael Liehr1 and Shu-Jen Han2* Information security underpins many aspects of modern society. However, silicon chips are vulnerable to hazards such as counterfeiting, tampering and information leakage through side-channel attacks (for example, by measuring power consumption, timing or electromagnetic radiation). Single-walled carbon nanotubes are a potential replacement for silicon as the channel material of transistors due to their superb electrical properties and intrinsic ultrathin body, but problems such as limited semiconducting purity and non-ideal assembly still need to be addressed before they can deliver high-performance electronics. Here, we show that by using these inherent imperfections, an unclonable electronic random structure can be constructed at low cost from carbon nanotubes. The nanotubes are self-assembled into patterned HfO2 trenches using ionexchange chemistry, and the width of the trench is optimized to maximize the randomness of the nanotube placement. With this approach, two-dimensional (2D) random bit arrays are created that can offer ternary-bit architecture by determining the connection yield and switching type of the nanotube devices. As a result, our cryptographic keys provide a significantly higher level of security than conventional binary-bit architecture with the same key size.

T

he exponential growth in the number of connected smart devices, and the resulting volumes of data, pose significant challenges for information security. Most cryptographic primitives rely on the ability to generate, store and retrieve unique ‘keys’. These cryptographic keys (unencrypted) are used as an input to the known encryption engine to generate encrypted output that is used to authenticate the device or information. Conventionally, cryptographic keys are programmed into nonvolatile memory such as erasable programmable read-only memory (EPROM), which is vulnerable to physical and sidechannel attacks. For example, the current consumption difference before and after baking the chip at high temperature (which shifts the charge stored in EPROM) can be easily used to estimate ‘1’ and ‘0’ in the key. Recently, approaches based on inherent physical disorders induced during fabrication have emerged as promising hardware roots-of-trust cryptographic keys as they are infeasible to duplicate1. For example, a unique speckle pattern can be generated when shining light through volumetric scatters2–4 or on surfaces with fine structures5. The physical unclonable function (PUF) format has evolved from non-electronic devices to electronic devices such as integrated circuits1,6,7, radio-frequency identification tags8 and field-programmable gate arrays9. All silicon PUFs exploit processvariation-induced local device mismatches, such as random dopant fluctuation, line edge roughness or polysilicon/high-k granularity. The mismatches arising from these stochastic atomic variations are likely to follow a Gaussian distribution, in which a large portion of the mismatches are very close to zero mean. PUFs based on these small mismatches can be easily disturbed by noise (for example, supply voltage variations) and environmental factors (such as temperature variations) that can lead to a large bit error rate (BER)—as large as 30% in some silicon PUF implementations10. Data pre-processing such as temporal11 or spatial12 majority voting, bit selection using build-in self-tests13, index-based syndromes14 or

repetition code15 to rule out devices with small mismatches as well as post-processing using error correction or fuzzy extractions15 to reduce BER are thus required in silicon PUFs. These data processing techniques incur expensive silicon area overhead and usually require multiple measurements. The helper data used in post-processing also need to be handled carefully to prevent new security threats from possible data leakage and manipulation16. In addition, with the emergence of new devices and circuit systems constructed on non-silicon substrates such as flexible17,18, printable19 or disposable electronics20, new security primitives compatible with various substrates with good security level and quality are desired. Nanotechnology can be used to create conceptually new security primitives that are potentially more robust and tamper-resistant than complementary metal-oxide semiconductor (CMOS) -based security primitives21,22. Most of the existing functional nanomaterials exploit their unique optical properties for anti-counterfeiting applications, either by information encryption23 or naturally occurring randomness24,25. For the ease of integration into a system, particularly for the on-chip security, electronic devices with easy access are more favourable. The key challenge of realizing a nanotechnologybased electronic security system arises from the difficulty of achieving the precise control of the nanomaterials on a large scale to maximize the reliability and entropy. The concept of exploiting randomly formed conducting paths between different input/ output pins by randomly dispersed nanoparticles26 was proposed. However, no experimental demonstration has been reported so far. Resistors based on random structures fabricated by sublithographic features27 employing random self-assembly of lamellar-phase diblock copolymers have also been proposed. The major drawback is the challenge of forming non-random metal leads with similar sub-lithographic resolution to connect each random resistor individually. A memristor-based security primitive has also been proposed recently28. This approach requires aprecise control of the device set voltage and bias duration to generate

1

College of Nanoscale Science and Engineering, State University of New York at Albany, Albany, New York 12203, USA. 2 IBM T. J. Watson Research Center, Yorktown Heights, New York 10598, USA. 3 School of Electronics Engineering, Kyungpook National University, 80 Daehakro, Bukgu, Daegu 702-701, Korea. * e-mail: [email protected]

NATURE NANOTECHNOLOGY | ADVANCE ONLINE PUBLICATION | www.nature.com/naturenanotechnology

© 2016 Macmillan Publishers Limited. All rights reserved

1

ARTICLES

NATURE NANOTECHNOLOGY a

DOI: 10.1038/NNANO.2016.1

Generate random bits (0/1) after electrical measurement

b

− − − − −− − − − − − − − − − − −CNT−SDS

1 0

len gth

− − + + − − ++ − − − − ++ − − ++ − − + − − ++ + − − ++ ++ − − − − NMPI − − NMPI − − SiO2 HfO2

Input/output

Random placement of CNTs

Tre nch

Input/output

Connected by CNT Trench width

Disconnected without CNT

Figure 1 | Random bits based on a 2D carbon nanotube array. a, Schematic of chemical self-assembly of the CNTs in the HfO2 trenches modified by a monolayer. The self-assembly was realized through ion exchange between Na+ in SDS and I− in NMPI. The width of the HfO2 trenches varies from 70 nm to 300 nm. b, Schematic of a randomly connected 2D CNT array featuring a 5 × 5 crossbar structure.

high-quality randomness. No meaningful scale experimental demonstration has so far been achieved to show its feasibility29. In this work, we report a new method of fabricating a highly reliable, controllable and substrate-agnostic random structures using self-assembled carbon nanotubes (CNTs). Well-aligned CNTs are selectively deposited on HfO2 trenches coated with a selfassembled monolayer. The width-dependent self-assembly behaviour of the CNTs is carefully studied on substrates with different trench dimensions to characterize the yield and optimize the placement randomness. 2,560 bits were measured to study the randomness of the CNT-based random structure. The National Institute of Standards and Technology (NIST) randomness test suite30, which is commonly accepted as the standard for random sequence and physical randomness generation certification3,31,32, was used to confirm the quality of the generated random bits. As the bit storage in our technology only relies on the permanent placement properties of the CNTs, it is highly immune to environmental noises, preventing the alteration of the bit information. In addition, the ‘programming’ process has extremely high throughput (completed at wafer scale during CNT array fabrication) and consumes no power. The low fabrication temperature also makes this technology a viable option for serving as stand-alone onchip PUFs as well as interfacing with other existing technologies to create stronger security primitives.

Design of a 2D random structure The CNT placement method was reported in an earlier work33, and is illustrated in Fig. 1. The surface monolayer is formed from 4-(N-hydroxycarboxamido)-1-methylpyridinium iodide (NMPI). The NMPI molecules, containing a hydroxamic acid end group, selectively assemble on HfO2 surface but not on SiO234,35. CNTs wrapped in sodium dodecylsulfate (SDS) were dispersed in water. The negative iodide ion of the NMPI monolayer is exchanged with the positive sodium ion of SDS to form sodium iodide, resulting in a strong Coulombic attraction between the positively charged monolayer and negatively charged surfactant. In this process, CNT deposition on NMPI is facilitated by the attached SDS, as well as being deterred by free SDS surfactants blocking NMPI sites. The yield of nanotube placement can be controlled by tuning the concentrations of the free SDS surfactant, ionic strength and the dimension of the HfO2 trenches. Here we choose to vary the width of the patterned HfO2 trenches to achieve random placement of the CNTs. The trench height was designed to be 7 nm, which is larger than the 2

dimension of the CNTs. As the trench width shrinks from 300 nm to 70 nm, the repulsive force between the negatively charged SiO2 sidewall and negatively charged SDS wrapping around the CNTs (SDS–CNT) becomes more prominent in comparison with the attractive force between the NMPI monolayer and SDS–CNT. By carefully designing the trench dimensions, this competition between the attractive force and the repulsive force can lead to highly random CNT placement inside the trench, as shown in Fig. 1a. There are several approaches to harnessing the inherent randomness of self-assembled CNT bits. By setting different threshold currents, we can obtain unique distributions for each current level. We can also build a ring oscillator or an arbiter36 using CNTs instead of Si to make lower-power devices. However these approaches require sophisticated engineering control of the CNTs and the fabrication process. We use a much simpler and more reliable way by determining the connection type of the CNT devices. Figure 1b shows how the connected (red) and disconnected (blue) CNT units are distributed in a 5 × 5 2D wiring structure. To understand the trench-width dependent behaviour of CNT placement, we carried out numerical calculations based on a multiphysics model that includes electrostatics and ionic transport (see Supplementary Information). Two geometries with trench width/barrier width of 30 nm/30 nm and 80 nm/80 nm were simulated and the resulting electric potential maps are plotted in Fig. 2a,b, respectively. Electrical double layers (EDLs) are formed on the negatively charged SDS–CNT, SiO2 barrier surfaces and positively charged monolayer modified HfO2 surface. At the starting position (x = 0 nm, y = 40 nm) simulated, EDLs are slightly overlapping. When the CNT moves towards the HfO2 surface along the y direction, the overlap increases, and for the 30 nm/30 nm trench/barrier geometry, the overall electromagnetic force in the y direction starts to switch from being repulsive (positive force) to being attractive (negative force) at y = 30 nm, as shown in Fig. 2c. Repeating the same analysis with a shifted starting position (x = −10 nm, y = 40 nm), the CNT has to be within 20 nm of the HfO2 surface to be attracted towards the surface, as shown in Fig. 2c. On the other hand, for the 80 nm/80 nm geometry, CNTs always experience overall attractive forces from the surfaces based on the similar simulation shown in Fig. 2c. Thus diffusion of SDS–CNTs from the bulk solution towards the surface is energetically unfavourable for the geometry with a

NATURE NANOTECHNOLOGY | ADVANCE ONLINE PUBLICATION | www.nature.com/naturenanotechnology

© 2016 Macmillan Publishers Limited. All rights reserved

NATURE NANOTECHNOLOGY

ARTICLES

DOI: 10.1038/NNANO.2016.1

a

d

0.28 V 0.25 0.20 0.15 0.10 0.05 0.00 −0.05 −0.10 −0.15 −0.20

y

x

0

0

−0.28 CNT lateral position (nm)

b e

−30

−20

−10

0

10

20

30

y = 25 nm y = 35 nm

6

SiO2

Lateral force (pN)

4

Monolayer

c 40

−2

F

−6

f 12 y = 25 nm y = 35 nm

9 Vertical force (pN)

25 20 15 Repulsive

CNT vertical position (nm)

30

5

F 0

−4 30/30 nm x = 0 nm 30/30 nm x = −10 nm 80/80 nm x = 0 80/80 nm x = −20 nm

35

10

2

Attractive

6 3 Repulsive 0 Attractive

0

−10

−20

−30

−40

−50

−3

Vertical force (pN)

Figure 2 | Surface charge effects of a patterned substrate on SDS–CNT assembly. a,b, Surface potential near the patterned substrate surface with trench width/barrier width of 30 nm/30 nm (a) and 80 nm/80 nm (b). c, x-component of the electromagnetic force profile as a function of CNT position moving towards the trench surface with the geometry of 30 nm/30 nm and 80 nm/80 nm. d, Surface potential with an off-centred CNT and a trench width/barrier width of 30 nm/30 nm. e,f, x-component (e) and y-component (f) electromagnetic force profiles as a function of CNT position when moving parallel to the surface. a,b have the same coordinate axes and scale (scale bar, 30 nm). The colour bar applies to a,b,d.

small trench width because of the net repulsive force from the patterned surface. To show that the CNTs align along the elongated direction of the placement trench, we also simulated the case when the CNTs moves in parallel with the surface at a fixed separation. The electric potential map of the 30 nm/30 nm geometry with a CNT positioned at (x = −15 nm, y = 25 nm) is shown in Fig. 2d where the periodic boundary condition is applied. EDLs of the CNT, SiO2 and monolayer significantly overlap each other, indicating a strong interaction. This interaction leads to a lateral force (Fig. 2e) that tends to move the CNT to the centre of the trench and this force decays as the separation from the surface increases. Simultaneously the CNT experiences a vertical force with a strength and polarity strongly dependent on the position of the CNT. At y = 35 nm, the vertical force is small and repulsive for all of the x coordinates, whereas at y = 25 nm, a window of attractive force of about 20 nm opens up near the centre of the trench. If the CNT chances to enter that window, the CNT can reach the trench surface. The width of this placement window can

be well controlled by the trench width, providing the design parameter to control CNT placement yield (to ∼50% for the highest randomness).

Harvesting randomness by connection type Figure 3a demonstrates the fabrication of a 2D array of selfassembled CNT devices (see Methods) and Fig. 3b shows a scanning electron microscopy (SEM) image of a 5 × 5 CNT crossbar structure. Figure 3c shows a zoomed-in view of the region enclosed in the yellow box in Fig. 2b, which shows both bit ‘0’ (without a CNT connection) and bit ‘1’ (with a CNT connection). All of the CNTs in different trench widths were electrically examined to analyse the width-dependent self-assembly behaviour. Figure 4a–e shows the semilogarithmic current–voltage (I–V) curves from the measurement of CNT arrays with different trench widths. Figure 4f shows the quantitative yield of connected bits corresponding to Fig. 4a–e. The yield scales with the trench width for both 1,500 and 2,000nm trench lengths, with a transition from 70–100 nm and saturation beyond 150 nm, which is attributed to the abovementioned

NATURE NANOTECHNOLOGY | ADVANCE ONLINE PUBLICATION | www.nature.com/naturenanotechnology

© 2016 Macmillan Publishers Limited. All rights reserved

3

ARTICLES

NATURE NANOTECHNOLOGY

a

b

DOI: 10.1038/NNANO.2016.1

c M2

Metal 2

M1

HSQ

Isolation

M2

Metal 1

CNT CNT SiO2

SiO2 HfO2

rate

HfO 2

subst

M1

Figure 3 | 2D array of self-assembled CNT devices. a, Schematic of device fabrication. b,c, SEM images of a 5 × 5 crossbar structure (b) with a zoomed-in view (c), showing both disconnected and connected devices. Hydrogen silsesquioxane (HSQ) forms an insulator between the two metal layers. The scale bars in b,c are 2 μm and 200 nm respectively.

a

10−6

10−7

10−7

10−7

Is (A)

10−6

10−8

10−8

10−8

10−9

10−9

10−9

10−10

10−10

10−10

0

1

−3 −2 −1

2

0

1

2

200 nm

f

10−7

10−7

10−8

10−8

10−9

10−9

10−10

10−10

VG (V)

1

2

1

2

1.0 0.8

Yield

10−6 Is (A)

10−6

0

300 nm

10−5

0

VG (V)

e

d

−3 −2 −1

−3 −2 −1

VG (V)

VG (V)

10−5

90 nm

10−5

10−6

−3 −2 −1

Is (A)

c

80 nm

10−5

Is (A)

Is (A)

b

70 nm

10−5

0.6 0.4 Trench length 1,500 nm 2,000 nm

0.2 0.0 −3 −2 −1

0

1

2

50

VG (V)

100

150

200

250

300

Trench width (nm)

Figure 4 | Trench-width dependent self-assembly behaviour revealed by I–V curves. a–e, I–V curves from the measurement of CNT arrays with different trench widths. f, Trench-width dependent yield extracted from I–V curves by setting a threshold current to identify the connection yield.

competition between the attractive force and the repelling force. The saturation behaviour is the transition from a reaction-limited process to a diffusion-limited process, where the CNT placement yield is no longer limited by the repelling force from the SiO2 sidewalls, but starts to be limited by the time required for CNTs to diffuse near HfO2 trenches in solution. A time-dependent placement study is required to further understand this behaviour. For an array of a given size, the number of connected units and disconnected units should be equal to achieve the maximum combination randomness (see Supplementary Information). Therefore we choose the trench with an 80 nm width for its ability to realize a connection yield close to 50%. Fig. 5a shows representative I–V curves of about 2,560 devices, all with an 80 nm trench width. We 4

set a threshold current of 10 nA at gate voltage of −3 V to determine the connection type of each bit, and a 64 × 40 random binary bits map is constructed as shown in Fig. 5b. Synthesized CNTs naturally contain both semiconducting and metallic nanotubes37, which is detrimental to electronic applications but beneficial to the creation of more randomized structures. By setting an on–off ratio between currents at gate voltages of −3 and −0.5 V to be larger than 20, we are able to discriminate between semiconducting and metallic CNTs among those connected devices. Binary bits can thus be upgraded to ternary bits (Fig. 5c), which is not possible in most programmable devices. The number of possible combinations in ternary bits (C3) is the number of possible combination in binary bits C2(n, m) times C(m, l ) where n is the total device number, m

NATURE NANOTECHNOLOGY | ADVANCE ONLINE PUBLICATION | www.nature.com/naturenanotechnology

© 2016 Macmillan Publishers Limited. All rights reserved

NATURE NANOTECHNOLOGY d

a

e

10−8

50 40 30 20 10 0

10−9

0.0

0.2

0.4

Yiel 0.6 0.8 d 1.0

10−10 −1

0

1

2

VG(V)

j

Count

Count

Binary bit map

Inter-distance 80 Binary Intra-distance 60 c Ternary bit map 40 20 0 0.0 0.2 0.4 0.6 0.8 1.0 g 100 Ternary 80 60 40 20 0 0.0 0.2 0.4 0.6 0.8 1.0 h 100 Double binary 80 60 40 20 0 Semiconducting Metallic 0.0 0.2 0.4 0.6 0.8 1.0 Normalized hamming distance

Open

Connected

CNT −6 −8 −10 −12

Open

−14 −14 −12 −10 −8 −6 −4 Log(Ion)(A) at 1st test

f 100

Log(Ion)(A) at 85 °C

−2

1.0 0.8 0.6 0.4 y rit 0.2 Pu 0.0

Count

−3

Log(Ion)(A) at 2nd test

In C3 (64 bits)

10−7

−4

Double binary bit map

60 10−6 Is (A)

i

70

10−5

b

ARTICLES

DOI: 10.1038/NNANO.2016.1

−4 CNT −6 −8 −10 −12

0

Open

1 −14 −14 −12 −10 −8 −6 −4 Log(Ion)(A) at 25 °C

Figure 5 | Random bit generation and statistical analysis. a, I–V curves of CNT arrays with 80 nm trench width. b, 64 × 40 random binary bits generated from a. c, 64 × 40 random ternary bits generated from a. d, The combination number of ternary bits on a natural log scale as a function of the yield of connected CNT devices and the purity of the semiconducting devices. The key size is 64 bits. e, Double binary bit map generated by the encoding rule: open (00), semiconducting (01) and metallic (11). The key size is doubled to be 128 bits. The distribution of the normalized intra-distance and inter-distance of 64 bits. f, Binary keys. g, Ternary keys. h, Double binary keys. The distribution of the normalized inter-distance is approximated with Gaussian curves. The means and variances are (0.5000, 0.0038), (0.6219, 0.0042), (0.4447, 0.0030) for binary keys, ternary keys and double binary keys, respectively. i, Repeatability of random bits measured by comparing on-currents of two tests on 200 bits at 25 °C. Red guide line is a linear 1:1 line. j, Stability of random bits measured by comparing on-currents of two tests on 200 bits at 25 and 85 °C. The red guide line is a linear 1:1 line.

is the connected device number, and l is the number of semiconducting devices out of m. We then obtain a simplified formula for ln(C2(n, m)C(m, l )) as ln(C2(n, m)C(m, l )) ≈ −n( y(α ) + αy(β )), where α and β are connection yield and semiconducting purity, respectively (see Supplementary Information). By taking the partial derivative of function ln(C2(n, m)C(m, l))with respect to α and β, we can calculate the largest possible combination based on a 64-bit ternary key to be 3.43 × 1030, which is 11 orders of magnitude more than that of a 64-bit binary key (1.84 × 1019). The function C2(n, m)C(m, l ) is symmetric about the axis of β = 0.5 with the peak a little skewed towards α = 0.67, as plotted in Fig. 5d. Therefore, by optimizing α and β in ternary bit design, the security level of the CNT cryptographic keys can be significantly enhanced without increasing the physical size of the bit array.

Randomness and stability assessment For the statistical study, we picked a reasonable key size of 64 bits for calculating the statistic distance. The intra-distance is a random variable describing the difference between two bit strings from the same device array. The inter-distance is a random variable describing the difference between two bit strings from different device arrays. The most obvious metric for binary vectors is Hamming distance (HD). The HD is calculated by comparing bit-to-bit difference between two strings with the same length. The distribution of the normalized inter-distance of 64-bit binary keys is found to be centred at 0.5 with a variance of 0.0039, as shown in Fig. 5f, whereas the mean for ternary keys is 0.6219 with a variance of 0.0042, as shown in Fig. 5g. That means, about 99.7% of the time

(3σ), any two different keys generated based on this technology differ in at least 32 and 42% of the 64 bit for binary and ternary keys, respectively. The mean inter-distance of ternary keys is larger than binary keys regardless of the key size although the variances stay similar (see Supplementary Information). The low intra-distances (∼0.03) for both binary and ternary keys indicate good repeatability of the CNT-based keys. This measured intra-distance is a very pessimistic estimate of the bit error rate due to the non-ideal contact uniformity between the metal pads and probe array during the highspeed automatic testing. As shown in Fig. 5i, no bit error can be found between two tests on 200 randomly picked bits when the contact quality is ensured by using the manual probe station. It is expected that the intra-distance will approach zero in the final random bit circuit where such contact issue is eliminated. Note that the larger inter-distance from our unique ternary keys results in a larger noise margin between the inter-distance and the intra-distance compared with typical binary keys of the same key size. Ternary keys can also be converted to binary keys with a larger key size to better use the embedded information. By applying the encoding rule: open (‘00’), semiconducting (‘01’) and metallic (‘11’), every ternary bit is converted to two binary bits in the double binary bit map (128 × 40) as shown in Fig. 5e. The resulting distribution of inter-distance in Fig. 5h had a slightly lower mean (0.4447) and variance (0.0030) than the binary keys in Fig. 5b, corresponding to 0.4447(1 − 0.4447)/0.0030 ≈ 82 independent variables, larger than 0.5(1 − 0.5)/0.0038 ≈ 64 independent variables for the binary keys. To generate a truly random structure, it is very important to ensure that very weak or no geometric correlation of random bits

NATURE NANOTECHNOLOGY | ADVANCE ONLINE PUBLICATION | www.nature.com/naturenanotechnology

© 2016 Macmillan Publishers Limited. All rights reserved

5

ARTICLES

NATURE NANOTECHNOLOGY

can exist. The spatial autocorrelation analysis was carried out using data from Fig. 5b, and we show that there is no correlation between any bit and its adjacent four neighbouring bits in our CNT bit array (see Supplementary Information). The random bits also pass the NIST statistical randomness test suite30. The results of the statistical test using 2,560-bit long string are given in Supplementary Table 2. Another important factor for high-quality PUFs is the immunity to environmental noises, which is always the major concern for silicon based PUFs. To demonstrate the high stability of our proposed CNT PUFs, we measured the bit output currents at two different temperatures (25 and 85 °C) from the same 200 bits in Fig. 5j. As can be seen in Fig. 5j, a very large noise margin can be maintained at both temperatures, which is expected from the fact that the permanent CNT connection property determines ‘1’ and ‘0’. The current floor for ‘0’ (bits with no CNT connected) is from the global back-gate dielectric leakage current, that is, the gate leakage current flowing through the probe pads (60 × 60 µm), as we directly used the doped Si substrate as the gate. In a real CNT bit array integrated with other circuits for security applications, there will be no individual probe pad for bit I/O, and this leakage current will be eliminated, providing a further-improved noise margin. On-currents of ‘1’ (bits with CNTs connected) are shown in Fig. 5j to be insensitive to the operation temperature and follow the ideal 1:1 guide line, consistent with the previous report38. Passivation with a proper dielectric layer can be applied to further reduce the environmental impact and improve the stability39.

Versatility and physical unclonability The low-temperature fabrication process of our CNT random structure (1,000,000) Statistical Test Frequency Block Frequency Runs Longest Run Rank FFT Non-overlapping Template Overlapping Template Serial Approximate Entropy Cumulative Sums

p-value 0.635256 0.081778 0.306127 0.398538 0.271552 0.102612 0.029869 0.999976 0.183028 0.681931 0.321027

Pass/Fail Pass Pass Pass Pass Pass Pass Pass Pass Pass Pass Pass

7 NATURE NANOTECHNOLOGY | www.nature.com/naturenanotechnology

© 2016 Macmillan Publishers Limited. All rights reserved.

7

SUPPLEMENTARY INFORMATION Universal Linear Complexity Random Excursions Random Excursions Variant

N/A N/A N/A N/A

DOI: 10.1038/NNANO.2016.1

N/A N/A N/A N/A

Supplementary Figure 3. Bridge faults (F1, F2) introduced by randomly placed CNTs in a full adder. Supplementary Table 3. Output of a full adder in fault-free condition and single fault F1 or F2. Input Output(Cout/S) A B Cin Fault-Free F1 F2 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 0 1 0 1 0 0 1 0 0 0 1 0 1 1 1 0 1 0 1 0 1 0 0 0 1 0 0 0 1 1 0 1 1 0 1 0 0 0 1 1 0 1 0 1 0 0 0 1 1 1 1 1 1 0 0 1

Obfuscating the gate layout by the metallic CNTs Besides the basic CNT transistors structure described in the main text, top gates can be fabricated on each transistor, with gate metal leads connected by metallic CNTs using one more

8 8

NATURE NANOTECHNOLOGY | www.nature.com/naturenanotechnology

© 2016 Macmillan Publishers Limited. All rights reserved.

SUPPLEMENTARY INFORMATION

DOI: 10.1038/NNANO.2016.1

CNT deposition process. The layout is shown in Supplementary Fig. 5. Due to the extremely small dimension of CNTs, this design obfuscates the gate layout and greatly increases the tamper resistance of CNT PUF.

Supplementary Figure 4. Obfuscating the gate layout of a CNT transitor by inserting a metallic CNT lead within the gate lead.

9 NATURE NANOTECHNOLOGY | www.nature.com/naturenanotechnology

© 2016 Macmillan Publishers Limited. All rights reserved.

9

Suggest Documents