Synopsys PUF IP: ISO/IEC 20897 Compliant

Synopsys PUFs are ISO/IEC 20897 Compliant

Synopsys has tested its physically unclonable function (PUF) technology in accordance with the International Standard ISO/IEC 20897-1:2020 and International Standard ISO/IEC 20897-2:2022. The positive outcomes of these tests have been bundled in a report, which can be obtained through contacting Synopsys.

The following security requirements have been positively evaluated for Synopsys PUF technology:

• Steadiness
• Randomness
• Uniqueness
• Tamper-resistance
• Physical unclonability

The report concludes: “The assessment presented in this report indicates that the PUF solution based on an SRAM PUF implementation and the Synopsys IP Hardware-based PUF IP module fits nicely within the framework put forward by ISO/IEC 20897. In addition, the presented test and evaluation results indicate that for a representative SRAM PUF implementation, this PUF solution can meet the ISO/IEC 20897 security requirements for the security parameter generation use case.”

ISO/IEC 20897-1:2020

Information security, cybersecurity, and privacy protection — Physically unclonable functions — Part 1: Security requirements

This document specifies the security requirements for PUFs. Specified security requirements concern the output properties, tamper-resistance, and unclonability of a single and a batch of PUFs. Since it depends on the application and which security requirements a PUF needs to meet, this document also describes the typical use cases of a PUF.

Amongst PUF use cases, random number generation is out of scope in this document.

ISO/IEC 20897-2:2022

Information security, cybersecurity, and privacy protection — Physically unclonable functions — Part 2: Test and evaluation methods

This document specifies the test and evaluation methods for PUFs. The test and evaluation methods consist of an inspection of the design rationale of the PUF and a comparison between statistical analyses of the responses from a batch of PUFs or a unique PUF versus specified thresholds.

This document is related to ISO/IEC 19790, which specifies security requirements for cryptographic modules. In those modules, critical security parameters (key) and public security parameters (product serial number, identification code, etc.) are the assets to protect. PUF is one solution to avoid storing security parameters, thereby increasing the overall security of a cryptographic module.