SPRUJ17H March 2022 – October 2024 AM2631 , AM2631-Q1 , AM2632 , AM2632-Q1 , AM2634 , AM2634-Q1
TRNG provides a true, non-deterministic Noise Source coupled to an Deterministic Random Bit Generator (DRBG). Non-deterministic Number Random Bit Generator (NRBG) is required to assist the Host processor with key derivation operations like IKE, etc. This can also be used to create initialization vectors (IVs) required for certain encryption modes.
The TRNG module supports the following features:
The random numbers are accessible to the Host in four 32-bit registers allowing 128-bit random number to be read with a single burst read. The TRNG module is integrated with four 128-bit blocks of memory as a random data buffer, which allows for an improved speed of operation. Acknowledging the 'data ready' (interrupt) state causes the TRNG module to move a new value, if available in the data buffer, to the TRNG output registers. Once the TRNG is programmed to start generating numbers, it always tries to keep the data buffer (configured to store four 128-bit numbers) filled completely, so pulling out data starts the regeneration of a new number by the DRBG.
An AES based Block Cipher Deviation Function (BC-DF, as defined in SP800-90A standard) is available for use with the NRBG. The TRNG module also works as a DRBG. The CTR-DRBG is also implemented with AES-256 as the underlying block cipher. Both the BC-DF and the DRBG functions share a dedicated AES core inside the TRNG module. The TRNG module uses 8 Free Running Oscillators (FROs), and has an approximate startup time of 1.5 seconds.
Figure 7-111 is a simplified block diagram of the TRNG module.
The true entropy source uses FROs as basic building block. The accumulation of timing jitter, caused (for the largest part) by shot noise, creates uncertainty intervals for the output transitions of each FRO. Sampling within an uncertainty interval generates a single bit of entropy, which is 'accumulated' in a 'toggle' flip-flop. As the uncertainty interval is very narrow compared to the cycle time of a FRO, the mean amount of entropy generated per sample is very small (less than 1/100 bit per sample). To increase the entropy generation rate, multiple FROs are used in parallel.
The FROs are asynchronous to one another and asynchronous to the sampling clock to make their behavior truly non-deterministic. The FROs are kept separate from the TRNG core module.
The outputs of the FROs are sampled (synchronized) to the TRNG clock frequency to become 'fro_clk'. The samples are fed into an error detection circuit in the TRNG core module that checks for repeating patterns coming out of a FRO. If a repeating pattern persists for a configurable number of samples, the FRO is suspect of having synchronized to (a harmonic of) the sampling interval. This drastically reduces the amount of entropy generated by that FRO, so the error detection circuit signals this as a FRO 'error event'.
As error events may happen under normal operating circumstances, the FRO control circuits first attempt to restart a FRO that had one. A second error event causes the FRO to be shut down automatically. As there are multiple FROs to begin with, shutting down a FRO will reduce the amount of entropy generated, but it will not immediately jeopardize the TRNG functionality. Still, a limit can be configured below which the number of operational FROs is not allowed to drop – if this limit is crossed, an interrupt can be generated on the Host processor. Software on the Host processor can then attempt to prevent frequent locking of a FRO by 'de-tuning' it to a slightly different frequency via the TRNG_FRODETUNE register.
The 'fro_clk' outputs are processed to accumulate entropy and then shifted into the main shift register at a configurable rate for testing purposes. The shifting rate should be chosen so that each set of eight shifted sample bits contains at least one bit of entropy.