Why choosing the right PUF matters more than simply having one
In the previous post, we explored an important idea: not all PUFs are created equal. In real industrial environments, a PUF is not evaluated solely on whether it works in theory, but on whether it can deliver stability, security, and manufacturability at scale.
And while writing that post, I kept coming back to a question I had heard many times before:
โSo what actually makes different PUFs different?โ
To be honest, I initially thought of PUF as a single technology category. But the more I studied it, the more I realized that PUF is really an umbrella term for several different approaches to generating hardware identity.
The key difference comes down to this:
What physical characteristic of the semiconductor is being used to create the device identity?
Some PUFs rely on memory initialization patterns.
Others rely on timing differences inside circuits.
And some use the physical structure of the semiconductor itself.
Although they are all called โPUF,โ the way they generate identity is fundamentally different โ and those differences directly affect:
- long-term stability
- environmental resilience
- manufacturability
- and ultimately, security reliability in the real world
In this post, weโll take a practical look at three widely discussed PUF architectures โ SRAM PUF, RO PUF, and VIA PUFโข โ and explore how they differ from an industrial security perspective.
๐ VIA PUFโข is a proprietary trademarked technology developed by ICTK.
PUFs Differ in What They โReadโ to Create Identity
At its core, a PUF (Physically Unclonable Function) is built around one simple idea:
Using physical variations inside a semiconductor to generate a unique device identity.
The difference lies in which physical characteristic is being measured.
- Some PUFs read the startup state of memory.
- Some compare tiny timing differences between circuits.
- Others leverage the semiconductor structure itself.
That means the conversation is no longer just:
โDoes this device have a PUF?โ
but increasingly:
โWhat kind of PUF is it using โ and how reliable is it under real-world conditions?โ
SRAM PUF โ Using the Startup State of Memory
SRAM PUF is one of the most widely recognized forms of PUF.
The reason is fairly simple: SRAM already exists inside most modern semiconductors.
That made SRAM PUF relatively easy to adopt without introducing entirely new hardware structures, which helped accelerate both academic research and industrial experimentation.
When SRAM powers on, tiny manufacturing variations cause certain memory cells to settle into either a 0 or 1 state slightly faster than others. SRAM PUF uses this startup pattern as a unique device fingerprint.
The concept is intuitive and practical:
- Existing SRAM structures can be reused
- Additional hardware overhead is relatively low
- Integration into MCUs* and SoCs* is comparatively straightforward
However, SRAM PUF also introduces several technical challenges.
Because startup values can shift depending on environmental conditions, many implementations require additional correction mechanisms such as ECC (Error Correction Code) or helper data.
Another topic increasingly discussed in the industry is bias-related behavior in advanced semiconductor nodes below 10nm.
As processes become more scaled down, maintaining randomness and stability becomes increasingly difficult, and research around bias and consistency continues to evolve.
SRAM PUF remains an important and widely adopted architecture, but as industrial requirements continue to grow, long-term stability, resilience, and scalability are becoming even more critical evaluation factors.
RO PUF โ Using Tiny Timing Differences in Circuits
RO PUF (Ring Oscillator PUF) generates identity by comparing frequency differences between multiple ring oscillators.
A ring oscillator is essentially a small circuit intentionally designed to continuously oscillate. Even when two circuits are designed identically, microscopic manufacturing variations cause them to operate at slightly different speeds.
RO PUF leverages those tiny timing differences as a unique hardware fingerprint.
This approach has several advantages:
- The architecture is relatively easy to understand
- FPGA-based* research is highly active
- It has been widely used in experimental and academic environments
However, RO PUF is also sensitive to:
- temperature
- voltage
- electrical noise
Because oscillation speed can vary under changing conditions, additional design considerations are often required for stable industrial deployment.
In other words, with RO PUF, the real challenge is not simply generating uniqueness โ it is maintaining that uniqueness consistently over time and across environments.
VIA PUFโข โ Leveraging the Semiconductor Structure Itself
VIA PUFโข takes a different approach from SRAM-based or timing-based PUF architectures.
Instead of relying on startup memory patterns or oscillator frequency variations, VIA PUFโข uses the physical characteristics of Via structures inside the semiconductor.
Put simply, it generates identity from microscopic structural differences in the pathways that connect circuits within the chip itself.
Just as every human fingerprint is slightly different, every semiconductor also contains tiny physical variations created during manufacturing. VIA PUFโข uses those structural variations to generate unique and random cryptographic keys.
What makes this approach particularly interesting is not simply what it measures, but how consistently those characteristics can be maintained in real industrial environments.
VIA PUFโข has been continuously validated with a focus on:
- environmental stability
- aging reliability
- and manufacturability
In the PUF industry, discussions around process dependency are fairly common. VIA PUFโข is sometimes questioned in this context as well.
But in practical industrial applications, the more important question is not whether a technology is tied to a specific process node โ it is whether the identity can remain stable and reproducible across manufacturing environments and long operational lifetimes.
VIA PUFโข has undergone validation across multiple process environments while continuing to evolve toward scalable industrial deployment.
Interestingly, these discussions are not unique to VIA PUFโข alone. SRAM PUF architectures are also actively studied in relation to bias and randomness consistency challenges in highly scaled semiconductor processes below 10nm.
Ultimately, the real benchmark for industrial security may not be:
โWhich process was used?โ
but rather:
โCan the identity remain stable, reproducible, and trustworthy over time?โ
โIs VIA PUFโข Low in Entropy?โ โ The Real Question Is Key Generation Capability
Another topic that frequently appears in PUF discussions is entropy.
In security, entropy essentially refers to:
How unpredictable something is.
Some people question whether VIA PUFโข provides sufficient entropy.
This question often arises because VIA PUFโข uses a fundamentally different approach from architectures like SRAM PUF, which generate large startup bit patterns.
But in real-world security systems, what matters most is not simply the apparent number of random bits.
The more important question is:
Can the system reliably generate cryptographic keys at the required security level?
In VIA PUFโข evaluations, experimental results have shown that when more than 2,000 bits of source data are secured, sufficient entropy characteristics can be achieved for generating 256-bit security keys.
In other words, industrial security is not simply about maximizing visible randomness.
It is about generating keys that are:
- secure
- reproducible
- stable
- and usable in real systems
This is likely to become an increasingly important conversation as the industry continues to mature around hardware identity technologies.
In the End, Industrial Deployment Matters More Than Theory
One thing became increasingly clear while researching this topic:
PUF technology is difficult to evaluate based on theory alone.
Because in real industrial environments, technologies must survive conditions such as:
- mass production at scale
- long operational lifetimes
- harsh environmental changes
- and sophisticated security attacks
That means the future competition may not simply be about:
โWhich PUF is being used?โ
but rather:
โWhich PUF can maintain trust reliably in real-world deployment?โ
Final Thoughts
When people traditionally discussed semiconductor security, the conversation usually started with encryption algorithms, key lengths, or secure elements.
But while learning about PUF technologies, I began to see security differently.
At its core, modern device security increasingly comes down to one question:
How do we create an identity that cannot be cloned?
And even within the category called โPUF,โ the architectural philosophy and implementation approach can vary significantly.
As Zero-Trust Device Security continues to evolve, the industry may gradually shift its focus from:
โHow strong is the encryption?โ
to:
โHow trustworthy and sustainable is the hardware identity itself?โ
And PUF technology will likely remain at the center of that transition.
Read more
Why choosing the right PUF matters more than simply having one
In the previous post, we explored an important idea: not all PUFs are created equal. In real industrial environments, a PUF is not evaluated solely on whether it works in theory, but on whether it can deliver stability, security, and manufacturability at scale.
And while writing that post, I kept coming back to a question I had heard many times before:
To be honest, I initially thought of PUF as a single technology category. But the more I studied it, the more I realized that PUF is really an umbrella term for several different approaches to generating hardware identity.
The key difference comes down to this:
Some PUFs rely on memory initialization patterns.
Others rely on timing differences inside circuits.
And some use the physical structure of the semiconductor itself.
Although they are all called โPUF,โ the way they generate identity is fundamentally different โ and those differences directly affect:
In this post, weโll take a practical look at three widely discussed PUF architectures โ SRAM PUF, RO PUF, and VIA PUFโข โ and explore how they differ from an industrial security perspective.
๐ VIA PUFโข is a proprietary trademarked technology developed by ICTK.
PUFs Differ in What They โReadโ to Create Identity
At its core, a PUF (Physically Unclonable Function) is built around one simple idea:
The difference lies in which physical characteristic is being measured.
That means the conversation is no longer just:
but increasingly:
SRAM PUF โ Using the Startup State of Memory
SRAM PUF is one of the most widely recognized forms of PUF.
The reason is fairly simple: SRAM already exists inside most modern semiconductors.
That made SRAM PUF relatively easy to adopt without introducing entirely new hardware structures, which helped accelerate both academic research and industrial experimentation.
When SRAM powers on, tiny manufacturing variations cause certain memory cells to settle into either a 0 or 1 state slightly faster than others. SRAM PUF uses this startup pattern as a unique device fingerprint.
The concept is intuitive and practical:
However, SRAM PUF also introduces several technical challenges.
Because startup values can shift depending on environmental conditions, many implementations require additional correction mechanisms such as ECC (Error Correction Code) or helper data.
Another topic increasingly discussed in the industry is bias-related behavior in advanced semiconductor nodes below 10nm.
As processes become more scaled down, maintaining randomness and stability becomes increasingly difficult, and research around bias and consistency continues to evolve.
SRAM PUF remains an important and widely adopted architecture, but as industrial requirements continue to grow, long-term stability, resilience, and scalability are becoming even more critical evaluation factors.
RO PUF โ Using Tiny Timing Differences in Circuits
RO PUF (Ring Oscillator PUF) generates identity by comparing frequency differences between multiple ring oscillators.
A ring oscillator is essentially a small circuit intentionally designed to continuously oscillate. Even when two circuits are designed identically, microscopic manufacturing variations cause them to operate at slightly different speeds.
RO PUF leverages those tiny timing differences as a unique hardware fingerprint.
This approach has several advantages:
However, RO PUF is also sensitive to:
Because oscillation speed can vary under changing conditions, additional design considerations are often required for stable industrial deployment.
In other words, with RO PUF, the real challenge is not simply generating uniqueness โ it is maintaining that uniqueness consistently over time and across environments.
VIA PUFโข โ Leveraging the Semiconductor Structure Itself
VIA PUFโข takes a different approach from SRAM-based or timing-based PUF architectures.
Instead of relying on startup memory patterns or oscillator frequency variations, VIA PUFโข uses the physical characteristics of Via structures inside the semiconductor.
Put simply, it generates identity from microscopic structural differences in the pathways that connect circuits within the chip itself.
Just as every human fingerprint is slightly different, every semiconductor also contains tiny physical variations created during manufacturing. VIA PUFโข uses those structural variations to generate unique and random cryptographic keys.
What makes this approach particularly interesting is not simply what it measures, but how consistently those characteristics can be maintained in real industrial environments.
VIA PUFโข has been continuously validated with a focus on:
In the PUF industry, discussions around process dependency are fairly common. VIA PUFโข is sometimes questioned in this context as well.
But in practical industrial applications, the more important question is not whether a technology is tied to a specific process node โ it is whether the identity can remain stable and reproducible across manufacturing environments and long operational lifetimes.
VIA PUFโข has undergone validation across multiple process environments while continuing to evolve toward scalable industrial deployment.
Interestingly, these discussions are not unique to VIA PUFโข alone. SRAM PUF architectures are also actively studied in relation to bias and randomness consistency challenges in highly scaled semiconductor processes below 10nm.
Ultimately, the real benchmark for industrial security may not be:
but rather:
โIs VIA PUFโข Low in Entropy?โ โ The Real Question Is Key Generation Capability
Another topic that frequently appears in PUF discussions is entropy.
In security, entropy essentially refers to:
Some people question whether VIA PUFโข provides sufficient entropy.
This question often arises because VIA PUFโข uses a fundamentally different approach from architectures like SRAM PUF, which generate large startup bit patterns.
But in real-world security systems, what matters most is not simply the apparent number of random bits.
The more important question is:
In VIA PUFโข evaluations, experimental results have shown that when more than 2,000 bits of source data are secured, sufficient entropy characteristics can be achieved for generating 256-bit security keys.
In other words, industrial security is not simply about maximizing visible randomness.
It is about generating keys that are:
This is likely to become an increasingly important conversation as the industry continues to mature around hardware identity technologies.
In the End, Industrial Deployment Matters More Than Theory
One thing became increasingly clear while researching this topic:
PUF technology is difficult to evaluate based on theory alone.
Because in real industrial environments, technologies must survive conditions such as:
That means the future competition may not simply be about:
but rather:
Final Thoughts
When people traditionally discussed semiconductor security, the conversation usually started with encryption algorithms, key lengths, or secure elements.
But while learning about PUF technologies, I began to see security differently.
At its core, modern device security increasingly comes down to one question:
And even within the category called โPUF,โ the architectural philosophy and implementation approach can vary significantly.
As Zero-Trust Device Security continues to evolve, the industry may gradually shift its focus from:
to:
And PUF technology will likely remain at the center of that transition.
Read more