Paper 2016/253

Run-time Accessible DRAM PUFs in Commodity Devices

Wenjie Xiong, André Schaller, Nikolaos A. Anagnostopoulos, Muhammad Umair Saleem, Sebastian Gabmeyer, Stefan Katzenbeisser, and Jakub Szefer


A Physically Unclonable Function (PUF) is a unique and stable physical characteristic of a piece of hardware, which emerges due to variations in the fabrication processes. Prior works have demonstrated that PUFs are a promising cryptographic primitive to enable secure key storage, hardware-based device authentication and identification. So far, most PUF constructions require addition of new hardware or FPGA implementations for their operation. Recently, intrinsic PUFs, which can be found in commodity devices, have been investigated. Unfortunately, most of them suffer from the drawback that they can only be accessed at boot time. This paper is the first to enable the run-time access of decay-based intrinsic DRAM PUFs in commercial off-the-shelf systems, which requires no additional hardware or FPGAs. A key advantage of our PUF construction is that it can be queried during run-time of a Linux system. Furthermore, by exploiting different decay times of individual DRAM cells, the challenge-response space is increased. Finally, we introduce lightweight protocols for device authentication and secure channel establishment, that leverage the DRAM PUFs at run-time.

Available format(s)
Publication info
Published by the IACR in CHES 2016
physically unclonable functions
Contact author(s)
wenjie xiong @ yale edu
2016-07-22: last of 3 revisions
2016-03-08: received
See all versions
Short URL
Creative Commons Attribution


      author = {Wenjie Xiong and André Schaller and Nikolaos A.  Anagnostopoulos and Muhammad Umair Saleem and Sebastian Gabmeyer and Stefan Katzenbeisser and Jakub Szefer},
      title = {Run-time Accessible DRAM PUFs in Commodity Devices},
      howpublished = {Cryptology ePrint Archive, Paper 2016/253},
      year = {2016},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.