1 |
198 |
zero_gravi |
-- #################################################################################################
|
2 |
|
|
-- # << NEO430 - True Random Number Generator >> #
|
3 |
|
|
-- # ********************************************************************************************* #
|
4 |
|
|
-- # This unit implements a true random number generator which uses an inverter chain as entropy #
|
5 |
|
|
-- # source. The inverter chain is constructed as GARO (Galois Ring Oscillator) TRNG. The single #
|
6 |
|
|
-- # inverters are connected via simple latches that are used to enbale/disable the TRNG. Also, #
|
7 |
|
|
-- # these latches are used as additional delay element. By using unique enable signals for each #
|
8 |
|
|
-- # latch, the synthesis tool cannot "optimize" one of the inverters out of the design. Further- #
|
9 |
|
|
-- # more, the latches prevent the synthesis tool from detecting combinatorial loops. #
|
10 |
|
|
-- # The output of the GARO is de-biased by a simple von Neuman random extractor and is further #
|
11 |
|
|
-- # post-processed by an 8-bit LFSR for improved whitening. #
|
12 |
|
|
-- # #
|
13 |
|
|
-- # Sources: #
|
14 |
|
|
-- # - GARO: "Experimental Assessment of FIRO- and GARO-based Noise Sources for Digital TRNG #
|
15 |
|
|
-- # Designs on FPGAs" by Martin Schramm, Reiner Dojen and Michael Heigly, 2017 #
|
16 |
|
|
-- # - Latches for platform independence: "Extended Abstract: The Butterfly PUF Protecting IP #
|
17 |
|
|
-- # on every FPGA" by Sandeep S. Kumar, Jorge Guajardo, Roel Maesyz, Geert-Jan Schrijen and #
|
18 |
|
|
-- # Pim Tuyls, Philips Research Europe, 2008 #
|
19 |
|
|
-- # - Von Neumann De-Biasing: "Iterating Von Neumann's Post-Processing under Hardware #
|
20 |
|
|
-- # Constraints" by Vladimir Rozic, Bohan Yang, Wim Dehaene and Ingrid Verbauwhede, 2016 #
|
21 |
|
|
-- # ********************************************************************************************* #
|
22 |
|
|
-- # BSD 3-Clause License #
|
23 |
|
|
-- # #
|
24 |
|
|
-- # Copyright (c) 2020, Stephan Nolting. All rights reserved. #
|
25 |
|
|
-- # #
|
26 |
|
|
-- # Redistribution and use in source and binary forms, with or without modification, are #
|
27 |
|
|
-- # permitted provided that the following conditions are met: #
|
28 |
|
|
-- # #
|
29 |
|
|
-- # 1. Redistributions of source code must retain the above copyright notice, this list of #
|
30 |
|
|
-- # conditions and the following disclaimer. #
|
31 |
|
|
-- # #
|
32 |
|
|
-- # 2. Redistributions in binary form must reproduce the above copyright notice, this list of #
|
33 |
|
|
-- # conditions and the following disclaimer in the documentation and/or other materials #
|
34 |
|
|
-- # provided with the distribution. #
|
35 |
|
|
-- # #
|
36 |
|
|
-- # 3. Neither the name of the copyright holder nor the names of its contributors may be used to #
|
37 |
|
|
-- # endorse or promote products derived from this software without specific prior written #
|
38 |
|
|
-- # permission. #
|
39 |
|
|
-- # #
|
40 |
|
|
-- # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS #
|
41 |
|
|
-- # OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF #
|
42 |
|
|
-- # MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE #
|
43 |
|
|
-- # COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, #
|
44 |
|
|
-- # EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE #
|
45 |
|
|
-- # GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED #
|
46 |
|
|
-- # AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING #
|
47 |
|
|
-- # NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED #
|
48 |
|
|
-- # OF THE POSSIBILITY OF SUCH DAMAGE. #
|
49 |
|
|
-- # ********************************************************************************************* #
|
50 |
|
|
-- # The NEO430 Processor - https://github.com/stnolting/neo430 #
|
51 |
|
|
-- #################################################################################################
|
52 |
|
|
|
53 |
|
|
library ieee;
|
54 |
|
|
use ieee.std_logic_1164.all;
|
55 |
|
|
use ieee.numeric_std.all;
|
56 |
|
|
|
57 |
|
|
library neo430;
|
58 |
|
|
use neo430.neo430_package.all;
|
59 |
|
|
|
60 |
|
|
entity neo430_trng is
|
61 |
|
|
port (
|
62 |
|
|
-- host access --
|
63 |
|
|
clk_i : in std_ulogic; -- global clock line
|
64 |
|
|
rden_i : in std_ulogic; -- read enable
|
65 |
|
|
wren_i : in std_ulogic; -- write enable
|
66 |
|
|
addr_i : in std_ulogic_vector(15 downto 0); -- address
|
67 |
|
|
data_i : in std_ulogic_vector(15 downto 0); -- data in
|
68 |
|
|
data_o : out std_ulogic_vector(15 downto 0) -- data out
|
69 |
|
|
);
|
70 |
|
|
end neo430_trng;
|
71 |
|
|
|
72 |
|
|
architecture neo430_trng_rtl of neo430_trng is
|
73 |
|
|
|
74 |
|
|
-- advanced configuration ------------------------------------------------------------------------------------
|
75 |
|
|
constant num_inv_c : natural := 14; -- length of GARO inverter chain (default=14, max=14)
|
76 |
|
|
constant lfsr_taps_c : std_ulogic_vector(11 downto 0) := "100000101001"; -- Fibonacci LFSR feedback taps
|
77 |
|
|
-- -------------------------------------------------------------------------------------------------------
|
78 |
|
|
|
79 |
|
|
-- control register bits --
|
80 |
|
|
-- < write-only bits > --
|
81 |
|
|
constant ctrl_taps_00_c : natural := 0; -- -/w: TAP 0 enable
|
82 |
|
|
-- ...
|
83 |
|
|
constant ctrl_taps_13_c : natural := 13; -- -/w: TAP 13 enable
|
84 |
|
|
-- < read-only bits > --
|
85 |
|
|
constant ctrl_data_00_c : natural := 0; -- r/-: Random data bit 0
|
86 |
|
|
-- ...
|
87 |
|
|
constant ctrl_data_11_c : natural := 11; -- r/-: Random data bit 11
|
88 |
|
|
-- < remaining bits > --
|
89 |
|
|
constant ctrl_rnd_en_c : natural := 14; -- r/w: TRNG enable
|
90 |
|
|
constant ctrl_rnd_valid_c : natural := 15; -- r/-: Output byte valid
|
91 |
|
|
|
92 |
|
|
-- IO space: module base address --
|
93 |
|
|
constant hi_abb_c : natural := index_size_f(io_size_c)-1; -- high address boundary bit
|
94 |
|
|
constant lo_abb_c : natural := index_size_f(trng_size_c); -- low address boundary bit
|
95 |
|
|
|
96 |
|
|
-- access control --
|
97 |
|
|
signal acc_en : std_ulogic; -- module access enable
|
98 |
|
|
signal wren : std_ulogic; -- full word write enable
|
99 |
|
|
signal rden : std_ulogic; -- read enable
|
100 |
|
|
|
101 |
|
|
-- random number generator --
|
102 |
|
|
signal rnd_inv : std_ulogic_vector(num_inv_c-1 downto 0); -- inverter chain
|
103 |
|
|
signal rnd_enable_sreg : std_ulogic_vector(num_inv_c-1 downto 0); -- enable shift register
|
104 |
|
|
signal rnd_enable : std_ulogic;
|
105 |
|
|
signal tap_config : std_ulogic_vector(13 downto 0);
|
106 |
|
|
signal rnd_sync : std_ulogic_vector(2 downto 0); -- metastability filter & de-biasing
|
107 |
|
|
signal ready_ff : std_ulogic; -- new random data available
|
108 |
|
|
signal rnd_sreg : std_ulogic_vector(11 downto 0); -- sample shift reg
|
109 |
|
|
signal rnd_cnt : std_ulogic_vector(3 downto 0);
|
110 |
|
|
signal new_sample : std_ulogic; -- new output byte ready
|
111 |
|
|
signal rnd_data : std_ulogic_vector(11 downto 0); -- random data register (read-only)
|
112 |
|
|
|
113 |
|
|
-- Randomness extractor (von Neumann De-Biasing) --
|
114 |
|
|
signal db_state : std_ulogic;
|
115 |
|
|
signal db_enable : std_ulogic; -- valid data from de-biasing
|
116 |
|
|
signal db_data : std_ulogic; -- actual data from de-biasing
|
117 |
|
|
|
118 |
|
|
begin
|
119 |
|
|
|
120 |
|
|
-- Access Control -----------------------------------------------------------
|
121 |
|
|
-- -----------------------------------------------------------------------------
|
122 |
|
|
acc_en <= '1' when (addr_i(hi_abb_c downto lo_abb_c) = trng_base_c(hi_abb_c downto lo_abb_c)) else '0';
|
123 |
|
|
wren <= acc_en and wren_i;
|
124 |
|
|
rden <= acc_en and rden_i;
|
125 |
|
|
|
126 |
|
|
|
127 |
|
|
-- Write access -------------------------------------------------------------
|
128 |
|
|
-- -----------------------------------------------------------------------------
|
129 |
|
|
wr_access: process(clk_i)
|
130 |
|
|
begin
|
131 |
|
|
if rising_edge(clk_i) then
|
132 |
|
|
if (wren = '1') then
|
133 |
|
|
rnd_enable <= data_i(ctrl_rnd_en_c);
|
134 |
|
|
tap_config(13 downto 0) <= data_i(ctrl_taps_13_c downto ctrl_taps_00_c);
|
135 |
|
|
end if;
|
136 |
|
|
end if;
|
137 |
|
|
end process wr_access;
|
138 |
|
|
|
139 |
|
|
|
140 |
|
|
-- True Random Generator ----------------------------------------------------
|
141 |
|
|
-- -----------------------------------------------------------------------------
|
142 |
|
|
entropy_source: process(rnd_enable_sreg, rnd_enable, rnd_inv, tap_config)
|
143 |
|
|
begin
|
144 |
|
|
for i in 0 to num_inv_c-1 loop
|
145 |
|
|
if (rnd_enable = '0') then -- start with a defined state (latch reset)
|
146 |
|
|
rnd_inv(i) <= '0';
|
147 |
|
|
-- uniquely enable latches to prevent synthesis from removing chain elements
|
148 |
|
|
elsif (rnd_enable_sreg(i) = '1') then -- latch enable
|
149 |
|
|
-- here we have the inverter chain --
|
150 |
|
|
if (i = num_inv_c-1) then -- left most inverter?
|
151 |
|
|
if (tap_config(i) = '1') then
|
152 |
|
|
rnd_inv(i) <= not rnd_inv(0); -- direct input of right most inverter (= output signal)
|
153 |
|
|
else
|
154 |
|
|
rnd_inv(i) <= '0';
|
155 |
|
|
end if;
|
156 |
|
|
else
|
157 |
|
|
if (tap_config(i) = '1') then
|
158 |
|
|
rnd_inv(i) <= not (rnd_inv(i+1) xor rnd_inv(0)); -- use final output as feedback
|
159 |
|
|
else
|
160 |
|
|
rnd_inv(i) <= not rnd_inv(i+1); -- normal chain: use previous inverter's output as input
|
161 |
|
|
end if;
|
162 |
|
|
end if;
|
163 |
|
|
end if;
|
164 |
|
|
end loop; -- i
|
165 |
|
|
end process entropy_source;
|
166 |
|
|
|
167 |
|
|
-- unique enable signals for each inverter latch --
|
168 |
|
|
inv_enable: process(clk_i)
|
169 |
|
|
begin
|
170 |
|
|
if rising_edge(clk_i) then
|
171 |
|
|
-- using individual enable signals for each inverter - derived from a shift register - to prevent the synthesis tool
|
172 |
|
|
-- from removing all but one inverter (since they implement "logical identical functions")
|
173 |
|
|
-- this also allows to make the trng platform independent
|
174 |
|
|
rnd_enable_sreg <= rnd_enable_sreg(num_inv_c-2 downto 0) & rnd_enable; -- activate right most inverter first
|
175 |
|
|
end if;
|
176 |
|
|
end process inv_enable;
|
177 |
|
|
|
178 |
|
|
|
179 |
|
|
-- Processing Core ----------------------------------------------------------
|
180 |
|
|
-- -----------------------------------------------------------------------------
|
181 |
|
|
processing_core: process(clk_i)
|
182 |
|
|
begin
|
183 |
|
|
if rising_edge(clk_i) then
|
184 |
|
|
-- synchronize output of GARO --
|
185 |
|
|
rnd_sync <= rnd_sync(1 downto 0) & rnd_inv(0); -- no more metastability
|
186 |
|
|
|
187 |
|
|
-- von Neumann De-Biasing state --
|
188 |
|
|
db_state <= (not db_state) and rnd_enable; -- just toggle -> process in every second cycle
|
189 |
|
|
|
190 |
|
|
-- sample random data & post-processing --
|
191 |
|
|
if (rnd_enable = '0') then
|
192 |
|
|
rnd_cnt <= (others => '0');
|
193 |
|
|
rnd_sreg <= (others => '0');
|
194 |
|
|
elsif (db_enable = '1') then -- valid de-biased output?
|
195 |
|
|
if (rnd_cnt = "1010") then
|
196 |
|
|
rnd_cnt <= (others => '0');
|
197 |
|
|
else
|
198 |
|
|
rnd_cnt <= std_ulogic_vector(unsigned(rnd_cnt) + 1);
|
199 |
|
|
end if;
|
200 |
|
|
rnd_sreg <= rnd_sreg(10 downto 0) & (xor_all_f(rnd_sreg and lfsr_taps_c) xor db_data); -- LFSR post-processing
|
201 |
|
|
end if;
|
202 |
|
|
|
203 |
|
|
-- data output register --
|
204 |
|
|
if (new_sample = '1') then
|
205 |
|
|
rnd_data <= rnd_sreg;
|
206 |
|
|
end if;
|
207 |
|
|
|
208 |
|
|
-- data ready flag --
|
209 |
|
|
if (rnd_enable = '0') or (rden = '1') then -- clear when deactivated or on data read
|
210 |
|
|
ready_ff <= '0';
|
211 |
|
|
elsif (new_sample = '1') then
|
212 |
|
|
ready_ff <= '1';
|
213 |
|
|
end if;
|
214 |
|
|
end if;
|
215 |
|
|
end process processing_core;
|
216 |
|
|
|
217 |
|
|
-- John von Neumann De-Biasing --
|
218 |
|
|
debiasing: process(db_state, rnd_sync)
|
219 |
|
|
variable tmp_v : std_ulogic_vector(2 downto 0);
|
220 |
|
|
begin
|
221 |
|
|
-- check groups of two non-overlapping bits from the input stream
|
222 |
|
|
tmp_v := db_state & rnd_sync(2 downto 1);
|
223 |
|
|
case tmp_v is
|
224 |
|
|
when "101" => db_enable <= '1'; db_data <= '1'; -- rising edge -> '1'
|
225 |
|
|
when "110" => db_enable <= '1'; db_data <= '0'; -- falling edge -> '0'
|
226 |
|
|
when others => db_enable <= '0'; db_data <= '-'; -- invalid
|
227 |
|
|
end case;
|
228 |
|
|
end process debiasing;
|
229 |
|
|
|
230 |
|
|
-- new valid byte available? --
|
231 |
|
|
new_sample <= '1' when (rnd_cnt = "1010") and (rnd_enable = '1') and (db_enable = '1') else '0';
|
232 |
|
|
|
233 |
|
|
|
234 |
|
|
-- Read access --------------------------------------------------------------
|
235 |
|
|
-- -----------------------------------------------------------------------------
|
236 |
|
|
rd_access: process(clk_i)
|
237 |
|
|
begin
|
238 |
|
|
if rising_edge(clk_i) then
|
239 |
|
|
data_o <= (others => '0');
|
240 |
|
|
if (rden = '1') then
|
241 |
|
|
data_o(ctrl_data_11_c downto ctrl_data_00_c) <= rnd_data;
|
242 |
|
|
data_o(ctrl_rnd_en_c) <= rnd_enable;
|
243 |
|
|
data_o(ctrl_rnd_valid_c) <= ready_ff;
|
244 |
|
|
end if;
|
245 |
|
|
end if;
|
246 |
|
|
end process rd_access;
|
247 |
|
|
|
248 |
|
|
|
249 |
|
|
end neo430_trng_rtl;
|