Attacking an SRAM-Based PUF through Wearout

Physical unclonable functions (PUFs) provide a fast and cheap solution to secret key generation. Natural variations in silicon create unique “fingerprints” that are useful for identification. In a 6T SRAM array, these variations cause individual cells to skew their power-on tendency toward storing a 0 or a 1. Wearout effects interfere with those variations, changing the power-on behavior of an SRAM cell in the opposite direction of a stored bit and affecting its reliability as a PUF. In this work, we take advantage of this effect by exposing an SRAM array to high voltage and temperature to activate and accelerate wearout and show that it can cause significant changes to the SRAM's fingerprint. Then we propose an attack on an SRAM PUF that makes use of these conditions with several stored data patterns to modify its fingerprint and then compare the effectiveness of each pattern at producing false negatives for identification challenges. In doing so, we show that false negatives can be increased to 100% in less than 24 hours, effectively erasing the fingerprint and rendering the PUF unusable.