PUF-based key provisioning and reconstruction

Reset starts the hardware boot path

The moment rst_n deasserts, the Main FSM leaves M_RESET without firmware input. There is no enrollment command or register write that starts this sequence; the SEC module begins key recovery as part of reset handling.

Design rationale: keeping provisioning and reconstruction outside the APB command set prevents firmware from accidentally or deliberately re-triggering the process. The APB interface is observational during this sequence.

Initializing the flash interface

The FSM first waits in M_BOOT_WAIT_SPI: it waits while the QSPI master initialises the W25Q64JV — setting the Quad-Enable bit so all four data lines can be used — and reports init_done.

From this point onward, every flash access in the module uses this one master and its command FIFO: boot reads, helper data, counter updates, application records, and address-guard checks.

Enrollment flag selects the path

The FSM reads a single word at flash address 0x000180 — the ENROLLED flag.

• Blank flash (flag ≠ 0x01…) → no completed provisioning is recorded → enrollment (steps 4–7).
• Flag set → helper data exists → reconstruction (steps 8–9), the path taken on every normal boot.

Both paths aim to reach M_READY with a validated 128-bit key loaded inside ASCON and no key value written to flash.

Sampling the SRAM PUF response

The Main FSM starts the Fuzzy Extractor in enrollment mode. Its raw material is an SRAM PUF: at power-up, each uninitialized SRAM cell resolves to 0 or 1 according to device-specific variation. The response is repeatable enough to use after error correction, but not bit-identical across boots.

• 2805 bits of PUF response feed the helper-data path.
• 131 further bits become the device secret R; its 128 MSBs are used as the ASCON key.

Because some cells change value between boots, the following stages add redundancy and correction.

Generating helper data

Enrollment uses a fuzzy-commitment construction:

• The BCH encoder expands the secret R into a 255-bit codeword C that can survive up to 18 bit errors.
• Each codeword bit is repeated 11× → 2805 bits of redundancy (C_rep).
• The HDA XORs it with the PUF response: W = C_rep ⊕ PUF.

The resulting helper data W is public. It is useful for reconstruction only together with a matching PUF response; it does not directly contain R.

Writing helper data to flash — write 1

The FE's SPI adapter erases the first 4 KB sector and programs all 88 words of W to flash address 0x000000. This region is special: after boot completes, the QSPI master's address guard rejects later writes or erases that would overlap this region. Such requests are dropped and reported as fatal errors.

The write order is intentional: W first, key fingerprint and counter second, and the enrollment flag last.

Key fingerprint, counter, and enrollment flag

To validate later reconstruction, the Main FSM sends R to ASCON, which computes ASCON-Hash256(K). The 8 hash words are written to flash at 0x000160. The key itself is never written anywhere.

Continuing the crash-safe write order (helper data W was write 1, previous step):

• Write 2: hash(K) → 0x000160, initial counter ceiling → 0x001000
• Write 3: ENROLLED flag → 0x000180 — written last

Interrupted enrollment: if power is lost before the flag write, the next boot still observes "not enrolled" and repeats enrollment.

Reconstructing the key on later boots

On a normal boot the flag is set, so the FE applies the inverse procedure using a new PUF readout:

• W is read back from flash and XORed with the new PUF response: C'_rep = W ⊕ PUF'.
• The repetition decoder majority-votes each group of 11 bits.
• The BCH decoder corrects up to 18 remaining bit errors and recovers R.

With a matching PUF response and the stored helper data, the reconstruction path recovers the same 128-bit key.

Validating the reconstructed key

Before the recovered key is used, ASCON hashes it and the Main FSM compares the result word-by-word against the fingerprint stored at 0x000160.

• Match → the key is latched inside ASCON, key_valid rises, the module proceeds to ready.
• Mismatch (PUF response outside correction range, corrupted helper data, wrong chip) → M_FATAL_ERROR. The module does not proceed until reset.

The counter is also restored in this stage. Reading the stored reservation ceiling prevents nonce reuse after reset.

Ready state and APB status

The Main FSM reaches M_READY. Firmware can then read the status register at offset 0x000:

• bit 0 ready = 1, bit 1 busy = 0
• bit 2 enrolled = 1 — helper data exists and was used
• bit 3 key_valid = 1 — the hash check passed
• bit 4 error = 0 (otherwise: code at 0x004)

Software involvement in enrollment is limited to observation. From here, the encryption and decryption data path can accept requests.