Key derivation from PUFs

1. An electronic cryptographic device arranged to determine a cryptographic key, the cryptographic device being arranged for an enrollment phase and a later reconstruction phase, the cryptographic device comprising:

a physically unclonable function arranged to produce a first noisy bit string during the enrollment phase and a second noisy bit string during the reconstruction phase, and

a processor circuit configured to

determine, during the enrollment phase, debiasing data from the first noisy bit string, the debiasing data marking a first part of the first noisy bit string as low bias susceptible, and marking a second part of the first noisy bit string as high bias susceptible,

determine during the enrollment phase a first noise reduction data for the first part, and a second noise reduction data for the second part, noise reduction data allowing later correction during the reconstruction phase of differences between the second noisy bit string and the first noisy bit string,

identify during the reconstruction phase a first part and a second part in the second noisy bit string based on the debiasing data,

perform a first correction of differences between the first part of the second noisy bit string and the first part of the first noisy bit string based on the first noise reduction data thus obtaining first corrected bits, and perform a second correction of differences between the second part of the second noisy bit string and the second part of the first noisy bit string based on the second noise reduction data thus obtaining second corrected bits, wherein the first correction and second correction are independent from each other,

compute at least one cryptographic key from the first corrected bits and the second corrected bits.

2. An electronic cryptographic device as in claim 1 , wherein the processor circuit is configured to select, during the enrollment phase, one or more first code words from an error correcting code and one or more second code words from an error correcting code, wherein

determining a bit of the first noise reduction data comprises computing the offset between a corresponding bit in the first part of the first noisy bit string and a corresponding bit in the one or more first code words, and

determining a bit of the second noise reduction data comprises computing the offset between a corresponding bit in the second part of the first noisy bit string and a corresponding bit in the one or more second code words.

3. An electronic cryptographic device as in claim 2 , wherein the one or more first code words are as long or longer as the first noisy bit string, wherein the one or more second code words are as long or longer as the first noisy bit string, each bit in the first noisy bit string corresponding to a bit in the one or more first code words and to a bit in the one or more second code words.

4. An electronic cryptographic device as in claim 2 , wherein the processor circuit is configured to:

determine the offsets between the first noisy bit string and the one or more first code words only for the bits in the first part of the first noisy bit string, and

determine the offsets between the first noisy bit string and the one or more second code words only for the bits in the second part of the first noisy bit string.

5. An electronic cryptographic device as in claim 2 , wherein the processor circuit is arranged to select the one or more first or second code words from the first or second error correcting code by encoding one or more further code words from a further error correcting code.

6. An electronic cryptographic device as in claim 2 , wherein the error correcting code is a concatenated code wherein the inner code is a repetition code.

7. An electronic cryptographic device as in claim 1 , wherein performing a first correction of differences comprises;

obtaining one or more noisy first code words, by applying the first noise reduction data to bits in the first part of the second noisy bit string, and marking as erasures-bits, the bits in the one or more noisy first code words corresponding to bits in the second part of the second noisy bit string,

correcting said one or more noisy first code words using an error correcting algorithm, and/or wherein performing a second correction of differences comprises

obtaining one or more noisy second code words, by applying the second noise reduction data to bits in the second part of the second noisy bit string, and marking as erasures-bits, the bits in the one or more noisy second code words corresponding to bits in the first part of the second noisy bit string, and

correcting said one or more noisy second code words using an error correcting algorithm.

8. An electronic cryptographic device as in claim 1 , wherein the first and second noisy bit string are partitioned in a first and second sequence of bit pairs respectively, the processor circuit being configured to identify bits in unequal bit pairs in the first sequence of bit pairs as low bias susceptible, and to identify bits in equal bit pairs in the first sequence of bit pairs as high bias susceptible.

9. An electronic cryptographic device as in claim 8 , wherein

the debiasing data comprises a single bit for each pair in the first sequence of bit pairs identifying the pair as low or high bias susceptible,

the first noise reduction data comprises a single bit for each pair in the first part of the first noisy bit string, said bit indicating the offset between the pair in the first part of the first noisy bit string and a corresponding pair in one or more first code words, and

the second noise reduction data comprises a single bit for each pair in the second part of the first noisy bit string, said bit indicating the offset between the pair in the second part of the first noisy bit string and a corresponding pair in the one or more second code words.

10. An electronic cryptographic device as in claim 1 , wherein the combined bit size of the debiasing data, first noise reduction data and second noise reduction data equals the bit size of the first noisy bit string.

11. An electronic cryptographic device as in claim 1 , wherein the processor circuit is arranged to compute a single cryptographic key from at least part of the first corrected bits and at least part of the second corrected bits.

12. An electronic cryptographic device as in claim 1 , wherein the processor circuit is arranged to compute a first cryptographic key from at least part of the first corrected bits and a second cryptographic key from at least part of the second corrected bits.