Paper 2019/1473

Splitting the Interpose PUF: A Novel Modeling Attack Strategy

Nils Wisiol, Christopher Mühl, Niklas Pirnay, Phuong Ha Nguyen, Marian Margraf, Jean-Pierre Seifert, Marten van Dijk, and Ulrich Rührmair


We demonstrate that the Interpose PUF proposed at CHES 2019, an Arbiter PUF based design for so-called Strong Physical Unclonable Functions (PUFs), can be modeled by novel machine learning strategies up to very substantial sizes and complexities. Our attacks require in the most difficult cases considerable, but realistic, numbers of CRPs, while consuming only moderate computation times, ranging from few seconds to few days. The attacks build on a new divide-and-conquer approach that allows us to model the two building blocks of the Interpose PUF separately. For non-reliability based Machine Learning (ML) attacks, this eventually leads to attack times on \((k_\text{up},k_\text{down})\)-Interpose PUFs that are comparable to the ones against \(\max\{k_\text{up}, k_\text{down}\}\)-XOR Arbiter PUFs, refuting the original claim that Interpose PUFs provide security similar to $(k_\text{down}+\frac{k_\text{up}}{2})$-XOR Arbiter PUFs (CHES 2019). On the technical side, our novel divide-and-conquer technique might also be useful in analyzing other designs where XOR Arbiter PUF challenge bits are unknown to the attacker.

Available format(s)
Publication info
Published by the IACR in TCHES 2020
Physical Unclonable FunctionStrong PUFsMachine LearningModeling AttacksInterpose PUF
Contact author(s)
nils wisiol @ fu-berlin de
2020-04-09: revised
2019-12-23: received
See all versions
Short URL
Creative Commons Attribution


      author = {Nils Wisiol and Christopher Mühl and Niklas Pirnay and Phuong Ha Nguyen and Marian Margraf and Jean-Pierre Seifert and Marten van Dijk and Ulrich Rührmair},
      title = {Splitting the Interpose PUF: A Novel Modeling Attack Strategy},
      howpublished = {Cryptology ePrint Archive, Paper 2019/1473},
      year = {2019},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.