System and device including reconfigurable physical unclonable functions and threshold cryptography

1. An authenticatable device implementing a threshold sharing of a hardware based identity that comprises a (t, n) threshold sharing of a value, wherein n defines a number of threshold shares of the value and t defines a number of threshold shares needed to recover the value, the authenticatable device comprising:

a plurality of reconfigurable physical unclonable functions (“RPUFs”), wherein each of at least two of the plurality of RPUFs is associated with at least one respective share of the threshold sharing of the value;

a memory; and

at least one processor configured to:

reconfigure, randomly, one of the at least two RPUFs after power-up of the device, wherein the reconfiguring invalidates a share associated with the reconfigured RPUF; and

generate, without generating the value in the memory, information derived from at least t valid threshold shares to enable one or more cryptographic operations that require the value.

2. The device of claim 1 , wherein the at least one processor is further configured to identify invalid shares.

3. The device of claim 2 , wherein the at least one processor is further configured to construct a valid replacement share for the reconfigured RPUF, based on the at least t valid threshold shares.

4. The device of claim 3 , wherein the at least one processor is further configured to store a challenge and helper value for the valid replacement share.

5. The device of claim 1 , wherein the at least one processor is further configured to enroll the at least two RPUFs in the (t, n) threshold sharing of the value without generating the value in the memory.

6. The device of claim 1 , wherein each of the at least two RPUFs is associated with the at least one respective share of the value by an associated challenge and helper pair.

7. The device of claim 6 , wherein the threshold sharing is constructed where n−t is at least two.

8. The device of claim 1 , wherein the at least one processor is configured to enroll the at least two RPUFs in the (t, n) threshold sharing of the value so t valid shares are required to reconstruct the value, where t is less than n.

9. The device of claim 1 , wherein the at least one processor is further configured to trigger a share refresh responsive to enabling a request to execute the one or more cryptographic operations.

10. The device of claim 1 , wherein the at least one processor is further configured to execute one or more cryptographic operations that require the value.

11. The device of claim 10 , wherein the at least one processor is further configured to generate sub-shares associated with the at least t valid threshold shares and blind the sub-shares.

12. The device of claim 11 , wherein the at least one processor is further configured to generate threshold shares of zero values to blind the sub-shares.

13. A computer implemented method for threshold sharing of a hardware based identity comprising a (t, n) threshold sharing of a value on an authentication device, wherein n defines a number of threshold shares of the value and t defines a number of threshold shares needed to recover the value, the method comprising:

randomly reconfiguring, by at least one processor, one of a plurality of reconfigurable physical unclonable functions (“RPUFs”) responsive to power-up of the device, wherein the reconfiguring invalidates a share associated with the reconfigured PUF; and

generating, by the at least one processor without generating the value in memory, information derived from at least t valid threshold shares to enable one or more cryptographic operations that require the value.

14. The method of claim 13 , further comprising identifying, by the at least one processor, invalid shares.

15. The method of claim 14 , further comprising constructing, by the at least one processor, a valid replacement share for an invalid share based on the at least t valid threshold shares.

16. The method of claim 15 , further comprising storing, by the at least one processor, a challenge and helper pair for the valid replacement share.

17. The method of claim 13 , further comprising associating, by the at least one processor, each of at least two of the plurality of the RPUFs with at least one respective share of the value by an associated challenge and helper pair.

18. The method of claim 13 , further comprising triggering, by the at least one processor, a share refresh responsive to enabling a request to execute the one or more cryptographic operations.

19. The method of claim 13 , further comprising executing, by the at least one processor, one or more cryptographic operations that require the value.

20. A non-transitory computer-readable storage medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform a method for threshold sharing of a hardware based identity comprising a (t, n) threshold sharing of a value on an authentication device, wherein n defines a number of threshold shares of the value and t defines a number of threshold shares needed to recover the value, wherein the method comprises:

randomly reconfiguring, by at least one processor, one of a plurality of reconfigurable physical unclonable functions (“RPUFs”) responsive to power-up of the device, wherein the reconfiguring invalidates a share associated with the reconfigured PUF; and

generating, by the at least one processor without generating the value in memory, information derived from at least t valid threshold shares to enable one or more cryptographic operations that require the value.