2498
8, AUGUST 2022
A 0.186-pJ per Bit Latch-Based True Random
Number Generator Featuring Mismatch
Compensation and Random
Noise Enhancement
Ruilin Zhang , Graduate Student Member, IEEE, Xingyu Wang , Graduate Student Member, IEEE,
Kunyang Liu , Member, IEEE, and Hirofumi Shinohara , Member, IEEE
Abstract— This article proposes a mismatch self-compensation
latch-based true random number generator (TRNG) that har-
vests a metastable region’s enhanced random noise. The pro-
posed TRNG exhibits high randomness across a wide voltage
(0.3–1.0 V) and temperature (−20 ◦ C–100 ◦ C) range by employing
XOR of only four entropy sources (ESs). To achieve a full
entropy output, an 8-bit von Neumann post-processing with
waiting (VN8W) is used. The randomness of the TRNG’s output
is verified by NIST SP 800-22 and NIST SP 800-90B tests. The
proposed TRNG, fabricated in 130-nm CMOS, achieves state-
of-the-art energy of 0.186 pJ/bit at 0.3 V with a core (four
ESs + XOR circuits) area of 661 μm2 and a total area of
5561 μm2 , including VN8W. The robustness against power noise
injection attacks is also demonstrated. An accelerating aging test
revealed that the TRNG achieves a stable operation after 19 h
of aging, which is equivalent to the 11-year life reliability. The
mismatch-to-noise ratio analysis revealed that the XOR-OUT
of TRNG core has more than 6σ robustness against random
mismatch variations.
Index Terms— Attack tolerant, cryptography, hardware secu-
rity, latch, long-term reliability, low energy consumption, true
random number generator (TRNG).
I. I NTRODUCTION
H IGH entropy random numbers (RNs) are the founda-
tion of cryptographic systems. A pseudo-RN genera-
tor (PRNG) or a true RN generator (TRNG) can generate
them. A PRNG uses a deterministic algorithm, such as a
hash function, to generate RNs. These RNs have good statis-
tical quality. However, because of the algorithm’s knowledge,
RNs are predictable, resulting in reduced security. On the
contrary, a TRNG utilizes physical device noise to generate
unpredictable true RNs, which is the root source of hardware
security.
Manuscript received 12 August 2021; revised 25 October 2021 and
8 December 2021; accepted 16 December 2021. Date of publication 18 March
2022; date of current version 25 July 2022. This article was approved by
Associate Editor Dennis Sylvester. This work was supported in part by ROHM
Company Ltd. and in part by the VLSI Design and Education Center (VDEC),
The University of Tokyo, in collaboration with Cadence Design Systems, Inc.,
and Mentor Graphics, Inc. (Corresponding author: Ruilin Zhang.)
The authors are with the Graduate School of Information, Production
and Systems, Waseda University, Kitakyushu 808-0135, Japan (e-mail:
zrlsmile@asagi.waseda.jp; shinohara.hiro@waseda.jp).
Color versions of one or more figures in this article are available at
https://doi.org/10.1109/JSSC.2021.3137312.
Digital Object Identifier 10.1109/JSSC.2021.3137312
0018-9200 © 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.
Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
IEEE JOURNAL OF SOLID-STATE CIRCUITS, VOL. 57, NO.
Several random phenomena in silicon devices have been
well exploited in the literature. For instance, TRNGs have used
entropy sources (ESs), such as random telegraph noise [1],
Si nanodevices noise [2], SiN MOSFET noise [3], or soft gate
oxide breakdown noise [4]. The above noises have the merit
of large noise magnitude. However, these noises are directly
harvested by amplifiers, followed by a comparator [1]–[3] or
numerous counters [4]. Therefore, the related TRNGs are not
power-efficient. Furthermore, the addition of a photomask [3]
increases the manufacturing cost.
Thermal noise is present in all electrical circuits. Although
the magnitude of its original noise is less than that of the
abovementioned noises, it can be directly amplified by an
amplifier [5] or a single inverter using multi-time amplifi-
cation [6]. In most cases, thermal noise is harvested indi-
rectly, for example, jitter in ring oscillators (ROs) [5], [7],
[8] or static random access memory (SRAM) bitline leakage
current [9]; chaotic map with SAR ADC structure [10]; and
metastability in sense-amp [11] or in latches [12]– [18]. RO-
based TRNGs are frequently designed with simplicity and
exhibit noise injection attack tolerance through an automatic
tuning loop [8]. However, many inverters in RO not only
occupy a large area but also consume a lot of power due to
successive charge and discharge during operation. By utilizing
the existing SRAM bitcell array, the design presented in [9]
realized unified dynamic and static entropy generation with
low area and design cost. The work presented in [10] achieved
an ultralow-power TRNG design by sharing an analog-to-
digital converter.
Latch-based TRNGs are a good fit for wide use due to
their low power consumption and small size. This is due to
the latch’s simple structure and the fact that data generation
requires only a one-time voltage transition. However, a mis-
match in the latch’s inverter pair biases the output, resulting in
low randomness. To overcome it, a capacitance-based charge
pump in [12] and [13] is used. This analog method consumes
space and power. The design in [14]–[16] requires a complex
calibration circuit and feedback control loop to compensate for
mismatches. 256 latches are needed in [17] to generate 1-bit
TRNG output.
In this article, based on [18], we propose a latch-based
TRNG without calibration and a feedback control circuit.
ZHANG et al.: 0.186-pJ PER BIT LATCH-BASED TRNG 2499

Fig. 1. Concept of mismatch compensation. (a) Inverter pair. (b) Conventional

method. (c) This approach. Fig. 2. ES latch circuit.

It is achieved by enhancing the noise-to-mismatch ratio in TABLE I

two ways. First, place an initial state point of metastable T RANSISTOR S IZE OF THE ES L ATCH C IRCUIT
operation S on a metastable point M and target for mismatch
self-compensation. Second, through resistance and capaci-
tance (RC) delayed feedback, damped oscillation in a single
inverter increases the random noise. The raw randomness of
the TRNG output in the presence of the process, voltage,
and temperature (PVT) is ensured via only 4-bit XOR post-
processing. An 8-bit von Neumann post-processing with wait-
ing (VN8W) [19], [20] is used for cryptography-grade full
entropy extraction.
The robustness against power noise injection attacks is also
verified. Furthermore, considering the randomness drop due to
wear-out, the accelerated aging test [21] is conducted, showing
that the proposed TRNG has an equivalent 11-year life span.
In addition, to verify the TRNG’s mismatch compensation
ability against random process variations, the mismatch-to-
noise ratio [22] is quantified both in measurement results and
stochastic calculations. The results show the TRNG’s high
robustness with a random variation tolerance of 6σ .
The remainder of this article is organized as follows.
Section II shows the proposed TRNG structure. Section III Fig. 3. Control signal waveform.
describes the random noise enhancement using the damped
oscillation system. Section IV presents the experimental results C G by gate capacitance, and three switches S1 –S3 . Sizes
and comparisons with previous works. Section V discusses of transistors are summarized in Table I. To overcome the
mismatch-to-noise ratio analysis. Finally, this article is sum- clock feedthrough-induced randomness drop, the switches
marized in Section VI. are designed with equal sizes of nMOS and pMOS pairs.
In addition, the common-mode feedthrough noise of the pair
of switches is canceled through the differential operation.
II. TRNG S TRUCTURE Although the circuit is designed to be symmetric, it still has
A. Latch-Based Entropy Source Circuit some residual systematic bias, which is relieved by noise
Fig. 1(a) shows the basic structure of a latch-based enhancement and taking the XOR of four ESs, as shown in
TRNG. Because of process variations, its voltage transfer Section V.
curves (VTCs) are asymmetric. Therefore, when a power-on The ES latch has two basic phases: the equalization phase
latch is used as the TRNG’s initial state, the final results will (S1 ON, S2 OFF) and the evaluation phase (S1 OFF, S2 ON).
be largely biased “1” bits or “0” bits, as shown in Fig. 1(b). Switch signals are generated by a clock driver from two inputs,
We propose that the initial state S is placed on the cross point CLK1 and CLK2, as shown in Fig. 3. Each switch signal
M, which is also known as the metastable point. The advantage includes a complementary pair. The SEN signal is used for
is that M is located in the watershed line of “1” and “0,” reading VGL and VGR differences using a sense circuit. There
even when the VTCs are changed because of device mismatch. is a short S1 OFF and S2 OFF phase between the equalization
Hence, the TRNG can produce an equal number of “1” and and evaluation phases to prevent their overlapping.
“0” bits. Furthermore, on M, the random noise is amplified,
as shown in Fig. 1(c). The proposed TRNG achieves mismatch B. Mismatch Compensation
self-compensation with low circuit effort in this way. The mismatch compensation is achieved in two steps.
Fig. 2 shows the proposed ES latch circuit. Each side Step 1 (Equalization Phase): The equalized voltages VeqL
includes a large resistor R by transmission gate with a and VeqR are stored on each side at C G and parasitic capaci-
10× longer gate length than the latch inverter, capacitor tance C D , as shown in Fig. 4(a).

Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
2500 IEEE JOURNAL OF SOLID-STATE CIRCUITS, VOL. 57, NO. 8, AUGUST 2022

Fig. 7. Mismatch compensation efficiency versus C G .

Results of the transient simulation without noise for the

circuit with 20-mV nMOS artificial mismatch Vmis_n in Fig. 4
are summarized in Fig. 6. As C G increases from 5 to 40 fF,
Fig. 4. Two steps of mismatch compensation. (a) Equalization.
S gradually approaches M. Fig. 7 compares the simulation and
(b) Evaluation. theoretical results using (1).
There is a tradeoff between the mismatch compensation and
noise filtering effect for the size of C G . From compensation
efficiency, the mismatch (d) is inversely proportional to C G :
d ∝ (1 − ηcom ) ∝ (1/C G ). On the other hand, the thermal
noise power is expressed in (kT /C) considering a low pass
√ the thermal noise voltage σn is inversely
filtering by C. Then,
proportional to C G . The randomness of a latch circuit
output is evaluated by the mismatch-to-noise ratio (d/σn ) [22].
Fig. 5. Position of the initial state S. A smaller ratio is better √ for randomness. From the above
discussion, d/σn ∝ (1/ C G ). Thus, randomness is improved
using larger C G . However, larger C G consumes more power.
In this design, C G is set to 10 fF, achieving more than 60%
compensation efficiency, as shown in Fig. 7.

C. Noise Enhancement
The equalization phase is divided into a low-resistance (LR)
phase and high-resistance (HR) phase by turning S3 ON and
OFF , respectively, as shown in Fig. 2. During the LR phase, the
gate and drain voltages in each inverter are quickly equalized,
as shown in Fig. 8. The LR phase time should be larger than
the time in which the differences of the average drain and
Fig. 6. Position of S as a function of C G . gate voltages from the equilibrium condition become smaller
enough than the noise voltage. In the HR phase, a damped
oscillation is introduced by adding RC delay time in the
Step 2 (Beginning of the Evaluation Phase): VeqL and VeqR feedback loop. Small noise is amplified into large-amplitude
are used to set the initial state S (VeqR *, VeqL *) close to M, noise with a random phase. The details of noise enhancement
as shown in Figs. 4(b) and 5. are discussed in Section III.
The coordinate of M in the ideal case of infinity inverter
gain is (VeqR , VeqL ). The position of S is affected by C D D. Full Entropy Extraction
through charge redistribution. However, the initial S can be As shown in Fig. 9, we proposed a TRNG architecture to
placed close to M by setting C G  C D . Equation (1) shows ensure full entropy extraction under PVT variations. It con-
the compensation efficiency (ηcom ). As a result, the mismatch sists of a TRNG core block and a VN8W [19] post-processing
is self-compensated block. The TRNG core block includes four ESs and 4-bit XOR
∗
VeqL ∗
− VeqR 1− CD circuits. Each ES is built with a CLK driver, an ES latch, and
CG 2C D
ηcom  = ≈1− a sense circuit.
VeqL − VeqR 1+ CD
CG
CG The randomness extraction process is divided into two
(when C G  C D ). (1) steps. In the first step, the four ESs are post-processed by

Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
ZHANG et al.: 0.186-pJ PER BIT LATCH-BASED TRNG 2501

Fig. 10. Half ES latch circuit with initial voltage setting switches for the
damped oscillation system analysis.

Fig. 8. Simulated noise waveforms in the equalization phase.

Fig. 11. Monte Carlo noise simulation of 100 runs under non-equilibrium
Fig. 9. Full entropy extraction structure. initial voltage.

4-bit XOR. This generates high- to middle-level randomness

raw outputs (XOR-OUT). Then, VN8W is used to remove
residual bias and correlations to obtain a cryptography level
full entropy bitstream (VN-OUT). Extraction efficiency (ExE)
is defined as m-bit VN-OUT over n-bit XOR-OUT. VN8W
achieves 62.21% ExE at zero input bias, which is 2.49× larger
than the original von Neumann method. While VN8W has a
larger area overhead, it brings higher throughput and higher
energy efficiency for the TRNG core. By using the low energy
implementation [19], total energy can be minimized.

III. N OISE E NHANCEMENT

To quantify the random noise enhanced by the damped
oscillation, we simulated a half ES latch circuit with two
identical switches, i.e., S, as shown in Fig. 10. Switch S
intentionally sets the initial voltage of VG and VD to Vinitial ,
which is different from the equilibrium voltage Veq to analyze
the damped oscillation system. Note that, by setting the LR
phase for the equilibrium initial state, the system will skip the
damped oscillation and go into a random noise dominant state
immediately in the HR phase, as shown in Fig. 8.
Monte Carlo noise simulations of 100 runs are repeated
with the resistor gate length (L reg ) varying from 0.13 to 9 μm.
Fig. 11 shows the simulation waveforms when L reg is 5 μm.
Fig. 12. Random noise and damping ratio versus resistor gate length.
Because of the non-equilibrium initial state, VD shows a
large swing at first and then exhibits damped oscillation. The
damping ratio ζ can be derived from the waveform according
to ln(A1 /A2 ) = 2πζ /(1 − ζ 2 )1/2 , where A1 and A2 are two
successive peaks. When the oscillation swings decay, noise
waveforms become dominant. Phases of noise waveforms are
observed to be random across the runs. The noise peak-to-peak
voltage, Vpp, and root mean square σn are used to quantify
the noise level. Fig. 12 summarizes the average results of

Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
2502
Fig. 13. Root mean square of noise voltage versus noise GF.
Fig. 14. PSD of random noise in the HR phase.
100 runs. When L reg reaches 2 μm, the system changes from
overdamped (ζ > 1) to underdamped (0 < ζ < 1). The system
is in full oscillation state (ζ = 0) when L reg is 9 μm. In the
damped oscillation mode, as L reg increases, the Vpp and σn
values of random noise increase. Vpp is five to six times the
σn value.
The relationship between σn and the swings ratio a
(=A2 /A1 ) in the damped oscillation is investigated. We intro-
duce a gain factor (GF) from an analogous to the sum of
geometric progression, as shown in the following equation:
1 including four ESs and 4-bit XOR, occupied an area of
GF = . (2)
1−a
Fig. 13 shows a linear relationship between σn and GF. σn
of noise is enhanced with the GF. Table II summarizes the
simulation results of the half ES latch circuit. It indicated
stable random noise voltage across voltage and temperature
variations.
Fig. 14 shows the power spectral density (PSD) of random
noise with different L reg values. When L reg = 0.13 μm, the
system is overdamped, and the PSD is nearly flat until reaching
the cutoff frequency. When L reg = 5 and 7 μm, the system is
underdamped, and noises are shaped with damped oscillation.
The flat PSD in the low-frequency region grows as L reg , and
Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
IEEE JOURNAL OF SOLID-STATE CIRCUITS, VOL. 57, NO. 8, AUGUST 2022
TABLE II
S UMMARY OF THE D AMPED O SCILLATION PARAMETERS AND R ANDOM
N OISE U NDER V OLTAGE AND T EMPERATURE VARIATIONS
W HEN L reg = 5 μm
Fig. 15. Chip micrographs of the TRNG core and VN8W.
the corresponding R increases by the factor of 4kT R (V2 /Hz).
In the middle-frequency range, a mild peak in resonance with
damped oscillation appears. This part dominates the total noise
power. In the high-frequency range, L reg has little effect.
The bandwidth defined by 3 dB below the peak of PSD is
f L = 63.2 MHz and f H = 96 MHz, and f L = 58.7 MHz
and f H = 66.7 MHz when L reg = 5 and 7 μm, respectively.
Their f H / f L ratios of 1.52 and 1.14 are much larger than that
of full oscillation (<1.01 at L reg = 9 μm). Thus, as can be
seen from Fig. 11, even if phases are aligned in the beginning,
they become random in a few cycles.
In this design, L reg is set to 5 μm (equivalent value is
0.43 M at 1.0 V/27 ◦ C during the HR phase), which achieves
2.26-mV σn and 12.9-mV Vpp of random noise in simulation.
Compared with 0.13-μm L reg , both Vpp and σn are enhanced
by three times.
IV. E XPERIMENTAL R ESULTS
The latch-based TRNG is designed and implemented in
130-nm standard CMOS technology. Fig. 15 shows chip
micrographs of the TRNG core and VN8W. The TRNG core,
661 μm2 , which is 0.0391 × 106 F 2 when normalized with
the feature size F (130 nm in this case). VN8W occupied an
area of 4900 μm2 (0.2899 × 106 F 2 ).
A. Randomness Verification and Autocorrelation Check
To verify the randomness of XOR-OUT and VN-OUT, 12
TRNGs in six chips are tested across a wide range of supply
voltage VD D (0.3–1.0 V) and temperature (−20 ◦ C–100 ◦ C).
The average Shannon entropy of XOR-OUT and average min-
entropy (=− log2 max(P1, 1 − P1), where P1 is the probabil-
ity of “1”) of VN-OUT variations on VD D and temperature are
shown in Fig. 16(a) and (b), respectively. The Shannon entropy
ZHANG et al.: 0.186-pJ PER BIT LATCH-BASED TRNG 2503

TABLE III
NIST SP 800-22 T EST R ESULTS FOR L OW-V OLTAGE C ORNER AND T EMPERATURE C ORNERS

TABLE IV
NIST SP 800-90B IID T EST R ESULTS FOR L OW-V OLTAGE C ORNER AND
T EMPERATURE C ORNERS

gate voltages. Fig. 17 shows that XOR-OUT autocorrelation

Fig. 16. Randomness verification (a) under voltage variations and (b) under
temperature variations.
factors are located in the 95% confidence interval. Meanwhile,
VN8W also has a de-correlation capability [19], which further
enhances the quality of the TRNG output.
The NIST SP 800-22 test site [23] is used to evaluate
randomness. The condition to pass a test is P − value ≥ 0.01.
The results for a total 12M bits of VN-OUT under low-voltage
corner 0.3 V/20 ◦ C and a total 16M bits of VN-OUT under
temperature corners 0.5 V/−20, 100 ◦ C, as summarized in
Table III, demonstrate the randomness of the TRNG. The
related NIST SP 800-90B IID test [24] results are summarized
in Table IV.

is greater than 0.90, excluding the point at 0.4 V/20 ◦ C, which
is 0.898. After VN8W post-processing, the min-entropy of
VN-OUT is greater than 0.978 for approximately 6k random
bitstream, which is within the stochastic error and high enough
for cryptography applications.
Bit correlation is another problem limiting many TRNGs,
which can degrade the quality of TRNG raw output. In this
study, a correlation problem is avoided by maintaining a
sufficient LR phase time, i.e., fully equalizing the drain and
B. Energy Consumption and Throughput
Fig. 18 shows the AC characteristics of one TRNG chip. The
TRNG core current and cycle time versus supply voltage are
shown in Fig. 18(a). About 50% of cycle time was used for LR
time to ensure the equilibrium condition. The related energy
consumption of XOR-OUT, VN-OUT, and the total energy,
including VN8W post-processing, is shown in Fig. 18(b). The
proposed TRNG achieved a minimum energy consumption
of 0.186 pJ/bit at 0.3 V: 0.114 VN-OUT + 0.072 VN8W.

Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
2504
Fig. 17. Autocorrelation check result.
Fig. 18. AC characteristics. (a) Current and cycle time. (b) Energy
consumption.
The energy consumption of VN8W is smaller than that of
TRNG core (VN-OUT). If the original von Neumann was
applied, the energy of only VN-OUT would exceed 0.28
(0.114 × 2.49) pJ/bit. After VN8W post-processing, the final
throughput is 0.00787 Mb/s at 0.3 V and 2.39 Mb/s at 1.0 V.
C. Power Noise Injection Attack
A TRNG may lose randomness under a noise injection
attack. The power noise injection attack has been reported to
affect RO-based TRNG [25]. To verify this attack tolerance,
one chip with two TRNGs (#1, #2) is measured under a
supply noise frequency range of 0.1–59.335 MHz with a 1.1×
Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
IEEE JOURNAL OF SOLID-STATE CIRCUITS, VOL. 57, NO. 8, AUGUST 2022
Fig. 19. Power noise injection attacks. (a) Supply noise frequency depen-
dence. (b) Supply noise voltage Vpp dependence. (c) Bit map.
growth step. This frequency range covers the simulated noise
bandwidth of f L = 7.9 MHz and f H = 18 MHz at 0.7 V.
The noise voltage is 0.2-V peak-to-peak. Fig. 19(a) shows the
dependence of the probability of “1” (P1) of XOR-OUT on
the noise frequency. Several peaks and bottoms were observed
in the frequency range of 1–10 MHz, but P1 remained within
0.3–0.8. We selected four peak position frequencies (1.192,
2.810, 4.114, and 6.800 MHz) and implemented the attack
under noise Vpp variations from 0 to 0.6 V. As summarized
in Fig. 19(b), the Shannon entropy slightly drops at 0.2 and
0.6 Vpp. However, after VN8W post-processing, the average
min-entropy is 0.999 at both 0.2 and 0.6 Vpp. Randomness
is verified by NIST SP 800-22 tests, as shown in Table V.
It also passed all NIST SP 800-90B IID tests, as shown
ZHANG et al.: 0.186-pJ PER BIT LATCH-BASED TRNG
TABLE V
NIST SP 800-22 T EST R ESULTS U NDER P OWER
N OISE I NJECTION ATTACK
TABLE VI
NIST SP 800-90B IID T EST R ESULTS U NDER
P OWER N OISE I NJECTION ATTACK
in Table VI. One 10k bitmap under a noise frequency of
4.114 MHz/0.6 Vpp is shown in Fig. 19(c).
The wide bandwidth of the damped oscillation and their
frequency variations among eight feedback inverters within
a TRNG core due to random V th variation performed well
to avoid a rapid entropy degradation and enhance tolerance
against the power noise injection attack.
D. Long-Term Reliability
The performance of the CMOS circuit may degrade over
time. To verify long-term reliability, an accelerated aging test
is conducted on one chip with two TRNGs by maintaining
the supply voltage at 2.0 V and the ambient temperature at
125 ◦ C without clock inputs for a long period. Fig. 20(a)
and (b) shows the average Shannon entropy of four ES
outputs (ES-OUT) and two XOR-OUT versus the aging time,
respectively. At each data point, the TRNG is measured at VD D
from 0.5 to 0.8 V at 25 ◦ C. Fig. 20(a) shows that ES-OUT
entropy becomes better after 11 h of aging and slightly drops
Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
2505
Fig. 20. Shannon entropy versus aging time for (a) single ES output: ES-OUT
and (b) 4-bit XOR output: XOR-OUT.
after 19 h of aging. However, the XOR-OUT Shannon entropy
is always greater than 0.9 before and after 19 h of aging
[see Fig. 20(b)]. This indicates that the TRNG has an equiva-
lent life of approximately 11 years under the nominal operating
condition of 0.6 V/25 ◦ C [21].
E. Comparisons
Table VII summarizes the comparison with previous works.
The proposed TRNG operates across a wide voltage and
temperature range without any calibration or feedback control.
Although the throughput is not high compared with works
in [9], [11], and [16], it has the smallest energy of 0.186 pJ/bit.
Its robustness against power noise injection attacks is verified.
Furthermore, the equivalent 11-year life reliability of the
TRNG is confirmed.
V. M ISMATCH - TO -N OISE R ATIO A NALYSIS
In this section, the mismatch-to-noise ratio is analyzed to
discuss robustness against random process variations. Accord-
ing to the model, the latch output is “1” when the sum
of mismatch and noise voltages is positive, and assuming a
Gaussian noise voltage distribution, the relationship between
the probability of “1” P1 and the mismatch-to-noise ratio is
expressed in the following equation [22]:
 
d
P1 =  (3)
σn
where d represents the mismatch, σn stands for the root
mean square of the noise voltage, and (x) is the cumulative
2506 IEEE JOURNAL OF SOLID-STATE CIRCUITS, VOL. 57, NO. 8, AUGUST 2022

TABLE VII
C OMPARISON W ITH P RIOR W ORKS

Fig. 21. ExE of VN8W and target range.

distribution function of the normal distribution N (0, 1). There-

fore, by taking the inverse function −1 (P1), the mismatch-
to-noise ratio can be quantified. To realize ExE of 50% or
more by VN8W post-processing, P1 of XOR-OUT bitstream
should satisfy 0.27 ≤ P1 ≤ 0.73 [19] (see Fig. 21). Thus,
d/σn should be located within the interval of [−0.61, 0.61]
[where 0.61 = −1 (0.73)].
To analyze the effect of damped oscillation on noise
enhancement and 4-bit XOR, ten chips with 20 XOR-OUT
and 40 ES-OUT are measured at 0.6 V/20 ◦ C under HR =
0 μs (without noise enhancement) and HR = 2 μs (with
noise enhancement, 4× larger than the nominal condition for
sufficient margin under chip variations), respectively. For each
cell output, 200k bits are recorded to calculate the P1 value.
The distribution histograms of d/σn are shown in Fig. 22.
Fig. 22. Measurement results of d/σn , (a) ES-OUT @ HR = 0 μs,
(b) ES-OUT @ HR = 2 μs, (c) XOR-OUT @ HR = 0 μs, and
(d) XOR-OUT @ HR = 2 μs.
ES-OUT @ HR = 0 μs has μ = −0.927 and σ = 1.335,
which is reduced to nearly half by introducing HR time (2 μs)
for noise enhancement. The d/σn ratios are further improved
by applying 4-bit XOR. XOR-OUT achieved μ = −0.118
(0.127× of ES-OUT), σ = 0.358 (0.268×) @ HR = 0 μs,
μ = −0.0396 (0.0568×), and σ = 0.0812 (0.105×) @ HR =
2 μs. When we consider 6σ random variation for the case of
mass production, μ ± 6σ ranges from −0.5268 to 0.4476.
This is within the target range of ±0.61.

Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
ZHANG et al.: 0.186-pJ PER BIT LATCH-BASED TRNG
Fig. 23. Standard deviation of the mismatch-to-noise ratio: XOR-OUT versus
ES-OUT.
To confirm the effect of 4-bit XOR, a stochastic calcula-
tion with four steps has been performed: 1) generate four
random d/σn data with a normal distribution N (μ, σES−OUT
2
);
2) calculate P1ES−OUT using (3); 3) derive P1XOR-OUT ; and
4) obtain d/σn of XOR-OUT. Equation (4) of P1XOR-OUT is
used in 3), where ei stands for the bias in P1ES−OUT . The
process is repeated 5000 times for each σES−OUT , which ranges
from 0.5 to 2

4
P1XOR-OUT = 0.5 − 24−1 ei . (4)
i=1
Fig. 23 summarizes the results. The measurement data agree
well with the stochastic calculation lines. This demonstrates
the accuracy of the measurement results.
VI. C ONCLUSION
This study proposed a latch-based TRNG without cal-
ibration and feedback control loop. This is achieved via
three techniques: mismatch compensation by setting the ini-
tial state on the metastable point, random noise enhance-
ment by damped oscillation, and full entropy extraction
by 4-bit XOR and VN8W post-processing. The prototype
TRNG is fabricated in 130-nm CMOS with a 0.329 ×
106 -F 2 area. High randomness is achieved across a wide volt-
age (0.3–1.0 V) and temperature (−20 ◦ C–100 ◦ C) range. Fur-
thermore, the proposed TRNG has robustness against power
noise injection attacks. Its randomness is verified through
NIST SP 800-22 and NIST SP 800-90B IID tests. An accel-
erated aging test shows that the TRNG has an equivalent
11-year life. Finally, the mismatch-to-noise ratio measurement,
along with stochastic calculations, shows our TRNG’s high
robustness within 6σ variations.
R EFERENCES
[1] R. Brederlow, R. Prakash, C. Paulus, and R. Thewes, “A low-power
true random number generator using random telegraph noise of single
oxide-traps,” in IEEE Int. Solid-State Circuits Conf. (ISSCC) Dig. Tech.
Papers, Feb. 2006, pp. 1666–1675.
[2] S. Fujita, K. Uchida, S. Yasuda, R. Ohba, H. Nozaki, and T. Tanamoto,
“Si nanodevices for random number generating circuits for cryptographic
security,” in IEEE Int. Solid-State Circuits Conf. (ISSCC) Dig. Tech.
Papers, Feb. 2004, pp. 294–295.
Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
2507
[3] M. Matsumoto, S. Yasuda, R. Ohba, K. Ikegami, T. Tanamoto, and
S. Fujita, “1200 μm2 physical random-number generators based on SiN
MOSFET for secure smart-card application,” in IEEE Int. Solid-State
Circuits Conf. (ISSCC) Dig. Tech. Papers, Feb. 2008, pp. 414–624.
[4] N. Liu, N. Pinckney, S. Hanson, D. Sylvester, and D. Blaauw, “A true
random number generator using time-dependent dielectric breakdown,”
in IEEE Symp. VLSI Circuits Dig. Tech. Papers, Jun. 2011, pp. 216–217.
[5] C. S. Petrie and J. A. Connelly, “A noise-based IC random number
generator for applications in cryptography,” IEEE Trans. Circuits Syst. I,
Fundam. Theory Appl., vol. 47, no. 5, pp. 615–621, May 2000.
[6] X. Wang, H. Liu, R. Zhang, K. Liu, and H. Shinohara, “An inverter-
based true random number generator with 4-bit Von-Neumann post-
processing circuit,” in Proc. IEEE 63rd Int. Midwest Symp. Circuits
Syst. (MWSCAS), Aug. 2020, pp. 285–288.
[7] M. Bucci, L. Germani, R. Luzzi, A. Trifiletti, and M. Varanonuovo,
“A high-speed oscillator-based truly random number source for crypto-
graphic applications on a smart card IC,” IEEE Trans. Comput., vol. 52,
no. 4, pp. 403–409, Apr. 2003.
[8] K. Yang, D. Blaauw, and D. Sylvester, “An all-digital edge racing true
random number generator robust against PVT variations,” IEEE J. Solid-
State Circuits, vol. 51, no. 4, pp. 1022–1031, Apr. 2016.
[9] S. Taneja, V. K. Rajanna, and M. Alioto, “36.1 unified in-memory
dynamic TRNG and multi-bit static PUF entropy generation for ubiqui-
tous hardware security,” in IEEE Int. Solid-State Circuits Conf. (ISSCC)
Dig. Tech. Papers, Feb. 2021, pp. 498–500.
[10] M. Kim, U. Ha, K. J. Lee, Y. Lee, and H.-J. Yoo, “A 82-nW chaotic
map true random number generator based on a sub-ranging SAR ADC,”
IEEE J. Solid-State Circuits, vol. 52, no. 7, pp. 1953–1965, Jul. 2017.
[11] V. R. Pamula, X. Sun, S. M. Kim, F. U. Rahman, B. Zhang, and
V. S. Sathe, “A 65-nm CMOS 3.2-to-86 Mb/s 2.58 pJ/bit highly digital
true-random-number generator with integrated de-correlation and bias
correction,” IEEE Solid-State Circuits Lett., vol. 1, no. 12, pp. 237–240,
Dec. 2018.
[12] D. J. Kinniment and E. G. Chester, “Design of an on-chip random num-
ber generator using metastability,” in Proc. IEEE ESSCIRC, Sep. 2002,
pp. 595–598.
[13] C. Tokunaga, D. Blaauw, and T. Mudge, “True random number generator
with a metastability-based quality control,” IEEE J. Solid-State Circuits,
vol. 43, no. 1, pp. 78–85, Jan. 2008.
[14] S. K. Mathew et al., “2.4 Gbps, 7 mW all-digital PVT-variation tolerant
true random number generator for 45 nm CMOS high-performance
microprocessors,” IEEE J. Solid-State Circuits, vol. 47, no. 11,
pp. 2807–2821, Nov. 2012.
[15] S. K. Mathew et al., “μrNG: A 300–950 mV, 323 Gbps/W all-
digital full-entropy true random number generator in 14 nm FinFET
CMOS,” IEEE J. Solid-State Circuits, vol. 51, no. 7, pp. 1695–1704,
May 2016.
[16] S. K. Satpathy et al., “An all-digital unified physically unclonable
function and true random number generator featuring self-calibrating
hierarchical Von Neumann extraction in 14-nm tri-gate CMOS,” J. Solid-
State Circuits, vol. 54, no. 4, pp. 1074–1085, Apr. 2019.
[17] N. Torii, H. Kokubo, D. Yamamoto, K. Itoh, M. Takenaka, and
T. Matsumoto, “ASIC implementation of random number generators
using SR latches and its evaluation,” EURASIP J. Inf. Secur., vol. 2016,
no. 1, pp. 1–12, May 2016.
[18] R. Zhang et al., “A 0.186-pJ per bit latch-based true random number
generator with mismatch compensation and random noise enhancement,”
in Proc. Symp. VLSI Circuits, Jun. 2021, pp. 1–2.
[19] R. Zhang, X. Wang, and H. Shinohara, “Energy-efficient post-processing
technique having high extraction efficiency for true random number
generators,” IEICE Trans. Electron., vol. E104.C, no. 7, pp. 300–308,
2021.
[20] R. Zhang, S. Chen, C. Wan, and H. Shinohara, “High-throughput Von
Neumann post-processing for random number generator,” in Proc. Int.
Symp. VLSI Design, Automat. Test (VLSI-DAT), Apr. 2018, pp. 1–4.
[21] K. Liu, X. Chen, H. Pu, and H. Shinohara, “A 0.5-V hybrid SRAM
physically unclonable function using hot carrier injection burn-in for
stability reinforcement,” IEEE J. Solid-State Circuits, vol. 56, no. 7,
pp. 2193–2204, Jul. 2021.
[22] H. Shinohara, B. Zheng, Y. Piao, B. Liu, and S. Liu, “Analysis and
reduction of SRAM PUF bit error rate,” in Proc. Int. Symp. VLSI Design,
Automat. Test (VLSI-DAT), Apr. 2017, pp. 1–4.
[23] National Institute of Standards and Technology (NIST). (2010). NIST SP
800-22: Download Documentation and Software. [Online]. Available:
https://csrc.nist.gov/Projects/Random-Bit-Generation/Documentation-
and-Software
2508
[24] National Institute of Standards and Technology (NIST). (2018). NIST SP
800-90B: Recommendation for the Entropy Sources Used for Random Bit
Generation. [Online]. Available: https://csrc.nist.gov/publications/detail/
sp/800-90b/final
[25] A. T. Markettos and S. W. Moore, “The frequency injection attack on
ring-oscillator-based true random number generators,” in Cryptographic
Hardware and Embedded Systems. Berlin, Germany: Springer, 2009,
pp. 317–331.
Ruilin Zhang (Graduate Student Member, IEEE)
received the B.S. degree from the Beijing Uni-
versity of Chemical Technology, Beijing, China,
in 2015, and the M.S. degree from Waseda Univer-
sity, Fukuoka, Japan, in 2017, where she is currently
pursuing the Ph.D. degree.
Her current research interests include true random
number generators (TRNGs) design, TRNG post-
processing, and hardware security.
Xingyu Wang (Graduate Student Member, IEEE)
received the B.S. degree in advanced energy material
and devices from Southeast University, Nanjing,
China, in 2018, and the M.S. degree in electri-
cal engineering from Waseda University, Fukuoka,
Japan, in 2019, where he is currently pursuing the
Ph.D. degree.
His research interests include hardware security
and mixed-signal VLSI design.
Authorized licensed use limited to: University of Texas at Austin. Downloaded on March 26,2024 at 20:38:16 UTC from IEEE Xplore. Restrictions apply.
IEEE JOURNAL OF SOLID-STATE CIRCUITS, VOL. 57, NO. 8, AUGUST 2022
Kunyang Liu (Member, IEEE) received the B.E.
degree in electronic and information engineering
from the South China University of Technology
(SCUT), Guangzhou, China, in 2015, and the M.E.
and Ph.D. degrees from the Graduate School of
Information, Production and Systems, Waseda Uni-
versity, Kitakyushu, Japan, in 2017 and 2021,
respectively.
He has been with the Information, Production
and Systems Research Center, Waseda University,
since April 2021, where he is currently an Assis-
tant Professor. His current research interests include physically unclonable
function (PUF) circuit design, PUF post-processing techniques, true random
number generator (TRNG) circuit design, and hardware security.
Dr. Liu was a recipient of the IEEE SSCS A-SSCC Student Travel Grant
Award in 2018 and the IEEE Fukuoka Section Excellent Student Award in
2020. He also serves as a Reviewer for the IEEE J OURNAL OF S OLID -S TATE
C IRCUITS .
Hirofumi Shinohara (Member, IEEE) received the
B.S. and M.S. degrees in electrical engineering
and the Ph.D. degree in informatics from Kyoto
University, Kyoto, Japan, in 1976, 1978, and 2008,
respectively.
In 1978, he joined the LSI Laboratory, Mitsubishi
Electric Corporation, Itami, Japan, where he was
involved in the research and development of Metal
Oxide Semiconductor (MOS) static random access
memories (SRAMs), memory compilers, logic build-
ing blocks, and neuro-chips. From 2003 to 2009,
he was engaged in the development of basic logic circuits, memory macros,
and design methodology for advanced CMOS technologies in Renesas Tech-
nology Corporation, Itami. He moved to the Semiconductor Technology
Research Academic Center (STARC), Yokohama, Japan, in 2009 and directed
a joint research project on extremely low-power circuits and systems that
operate near/sub-threshold regions with universities in Japan. Since 2015,
he has been a Professor with the Graduate School of Information, Production
and Systems, Waseda University, Kitakyushu, Japan. His current research
interests include energy-efficient random circuits for security, such as physical
unclonable functions, true random number generators, and low-power analog
circuits.
Dr. Shinohara has been serving on the International Technical Program
Committee of the IEEE International Solid-State Circuits (ISSCC) since
2017 and the IEEE International Symposium on VLSI Design, Automation
and Test (VLSI-DAT) since 2016.