# The algebra of symmetric tensors on smooth projective varieties

Arnaud Beauville  Université Côte d’Azur
CNRS – Laboratoire J.-A. Dieudonné
Parc Valrose
F-06108 Nice cedex 2, France<EMAIL_ADDRESS>
###### Abstract.

We discuss in this note the $\mathbb{C}$-algebra
$H^{0}(X,\mathsf{S}^{\scriptscriptstyle\bullet}T_{X})$ for a smooth complex
projective variety $X$. We compute it in some simple examples and survey a few
cases where it is trivial.

I am indebted to Feng Shao for several useful comments and references.

##  1\. Introduction

Let $X$ be a smooth complex projective variety. We will denote by $T^{*}X$ its
cotangent bundle, and by $\mathbb{P}T^{*}X$ its projectivization. In this note
we are interested in the graded $\mathbb{C}$-algebra

$S(X):=\bigoplus_{p\geq
0}H^{0}(X,\mathsf{S}^{p}T_{X})=\mathcal{O}(T^{*}X)=\bigoplus_{p\geq
0}H^{0}(\mathbb{P}T^{*}X,\mathcal{O}_{\mathbb{P}T^{*}X}(p))\,.$

($\mathcal{O}(T^{*}X)$ is the algebra of regular functions on $T^{*}X$, with
the grading defined by the linear action of $\mathbb{C}^{*}$.)

Despite its simple definition, this is an intriguing object, which is usually
quite complicated, even for a variety as simple as the quadric (see
Proposition 3 below). We describe it in some particular cases in §2. Then we
survey the (frequent) cases where it is known to be trivial (§3), and we
discuss briefly its Krull dimension (§4).

Notations: We work over the complex numbers. If $X$ is a variety endowed with
an action of $\mathbb{C}^{*}$, we denote by $\mathcal{O}(X)$ the
$\mathbb{C}$-algebra of regular functions on $X$, with the grading defined by
the $\mathbb{C}^{*}$-action. By a vector space we mean a complex, finite-
dimensional vector space.

##  2\. Some examples

###  2.1. Abelian varieties

We start with a trivial case: if $X$ is an abelian variety of dimension $n$,
we have $T_{X}\cong\mathcal{O}_{X}^{n}$, hence $S(X)$ is a polynomial algebra
in $n$ variables.

###  2.2. Projective space

Let $V$ be a vector space. We let $I\in V\otimes V^{*}$ be the image of the
identity by the isomorphism $\operatorname{End}(V)\vbox{\hbox
to22.76228pt{\hfill{$\scriptstyle\sim$}\hfill} \nointerlineskip\hbox
to22.76228pt{{\hfill$\longrightarrow$\hfill}} }V\otimes V^{*}$.

######  Proposition 1.

The graded algebra $S(\mathbb{P}(V))$ is isomorphic to the quotient of
$\displaystyle\bigoplus_{d\geq
0}\bigl{(}\mathsf{S}^{d}V\otimes\mathsf{S}^{d}V^{*}\bigr{)}$ by the ideal
generated by $I$.

Proof : The projective cotangent bundle $\mathbb{P}T^{*}_{\mathbb{P}(V)}$ can
be identified with the incidence hypersurface
$Z\subset\mathbb{P}(V)\times\mathbb{P}(V^{*})$ consisting of pairs $(x,H)$
with $x\in H$; the tautological line bundle $\mathcal{O}_{Z}(1)$ is induced by
$\mathcal{O}_{\mathbb{P}(V)}(1)\boxtimes\mathcal{O}_{\mathbb{P}(V^{*})}(1)$.
The Proposition follows from the exact sequence

$0\rightarrow\mathcal{O}_{\mathbb{P}(V)}(d-1)\boxtimes\mathcal{O}_{\mathbb{P}(V^{*})}(d-1)\xrightarrow{\
\times I\
}\mathcal{O}_{\mathbb{P}(V)}(d)\boxtimes\mathcal{O}_{\mathbb{P}(V^{*})}(d)\rightarrow\mathcal{O}_{Z}(d)\rightarrow
0\,.\qed$

###  2.3. Rational homogeneous manifolds

In this section we will use some general facts about nilpotent orbits, which
can be found for example in [Fu].

Let $X=G/P$, where $G$ is a reductive algebraic group and $P$ a parabolic
subgroup. We denote by $\mathfrak{g}$ and $\mathfrak{p}$ their Lie algebras,
and by $\mathfrak{n}$ the nilradical of $\mathfrak{p}$. The Killing form of
$\mathfrak{g}$ provides an isomorphism of $G$-modules $\mathfrak{n}\vbox{\hbox
to22.76228pt{\hfill{$\scriptstyle\sim$}\hfill} \nointerlineskip\hbox
to22.76228pt{{\hfill$\longrightarrow$\hfill}}
}(\mathfrak{g}/\mathfrak{p})^{*}$; using this we identify the cotangent bundle
$T^{*}(G/P)$ to the homogeneous bundle $G\times^{P}\mathfrak{n}$. Associating
to a pair $(g,N)$ in $G\times\mathfrak{n}$ the element
$\operatorname{Ad}(g)\cdot N$ of $\mathfrak{g}$ defines a generically finite,
$\mathbb{C}^{*}$-equivariant map $\pi:T^{*}(G/P)\rightarrow\mathfrak{g}$,
whose image $\mathscr{N}$ is the closure of a nilpotent orbit.

We will consider the case where the induced map
$\bar{\pi}:T^{*}(G/P)\rightarrow\mathscr{N}$ is birational. In this case
$\bar{\pi}$ is a resolution of the normalization $\tilde{\mathscr{N}}$ of
$\mathscr{N}$, and we have $S(X)=\mathcal{O}(\tilde{\mathscr{N}})$. For
$G=\operatorname{GL}(n)$ all parabolic subgroups have this property, and
$\mathscr{N}$ is normal, so $S(X)=\mathcal{O}(\mathscr{N})$. In the other
classical cases there is a precise description of the parabolic subgroups for
which $\bar{\pi}$ is birational [Fu, 3.3]; we will content ourselves with the
example of quadrics.

###  2.4. Flag varieties, Grassmannians

Let $V$ be a vector space, and let $(0)=V_{0}\subset
V_{1}\subset\allowbreak\ldots\subset V_{s+1}=V$ be a (partial) flag in $V$.
The stabilizer $P$ of this flag is a parabolic subgroup of
$\operatorname{GL}(V)$, and all parabolics are obtained in this way. The
variety $G/P$ is the variety of flags $(0)=F_{0}\subset
F_{1}\subset\ldots\subset F_{s+1}=V$ with $\dim F_{i}=\dim V_{i}$.

The Lie algebra $\mathfrak{p}$ is the stabilizer of $(V_{i})$ in
$\operatorname{End}(V)$, and its nilradical $\mathfrak{n}$ is the subspace of
$u\in\operatorname{End}(V)$ satisfying $u(V_{i+1})\subset V_{i}$ for $0\leq
i\leq s$. Therefore $\mathscr{N}$ is the subvariety of endomorphisms
$u\in\operatorname{End}(V)$ for which there exists a flag $(F_{i})$ in $G/P$
with $u(F_{i+1})\subset F_{i}$ for $0\leq i\leq s$.

Let us spell out this in the case of the Grassmannian
$\mathbb{G}:=\mathbb{G}(r,V)$ of $r$-dimensional subspaces of $V$. We put
$n:=\dim V$.

######  Proposition 2.

$S(\mathbb{G}(r,V))=\mathcal{O}(\mathscr{N})$, where
$\mathscr{N}\subset\operatorname{End}(V)$ is the subvariety of endomorphisms
$u$ satisfying $u^{2}=0$ and $\operatorname{rk}u\leq\min\\{r,n-r\\}$.

Proof : Since $\mathbb{G}(r,V)\cong\mathbb{G}(n-r,V)$, we can assume $r\leq
n/2$. By the previous discussion, $\mathscr{N}$ consists of endomorphisms $u$
for which there exists a $r$-dimensional subspace $W\subset V$ with
$u(V)\subset W$ and $u(W)=0$, that is, $\operatorname{Im}u\subset
W\subset\operatorname{Ker}u$. This implies $u^{2}=0$ and
$\operatorname{rk}u\leq r$; conversely, if this is satisfied, we have
$\operatorname{Im}u\subset\operatorname{Ker}u$ and
$\dim\operatorname{Ker}u=n-\operatorname{rk}u\geq n-r\geq r$, so any
$r$-dimensional subspace $W$ with $\operatorname{Im}u\subset
W\subset\operatorname{Ker}u$ does the job.∎

_Remarks_ $.-$ 1) Taking $r=1$ we recover Proposition 1.

2) If $r=\lfloor\frac{n}{2}\rfloor$ the condition $u^{2}=0$ implies
$\operatorname{rk}u\leq r$, so $\mathscr{N}$ is simply the variety of square
zero endomorphisms of $V$.

###  2.5. Quadrics

Let $V$ be a vector space, and let $q$ be a non-degenerate quadratic form on
$V$, defining a quadric $Q:=V(q)$ in $\mathbb{P}(V)$.

######  Proposition 3.

$S(Q)$ is isomorphic to the quotient of the homogeneous coordinate ring of
$\mathbb{G}(2,V)\subset\mathbb{P}(\bigwedge^{2}V)$ by the ideal generated by
$\wedge^{2}q$.

Proof : Let $\ell$ be an isotropic line in $V$ and let $P$ be the stabilizer
of $\ell$, so that $Q=\operatorname{O}(V)/P$. The Lie algebra
$\mathfrak{o}(V)$ consists of endomorphisms of $V$ which are skew-symmetric
(with respect to $q$), and $\mathfrak{p}$ is the stabilizer of $\ell$ in
$\mathfrak{o}(V)$.

The nilradical $\mathfrak{n}$ of $\mathfrak{p}$ consists of skew-symmetric
endomorphisms $u$ such that $u(\ell^{\perp})\subset\ell$ and $u(\ell)=0$. Such
a map is of the form

(1) $x\,\mapsto\,q(w,x)v-q(v,x)w,\mbox{ where }v\in\ell\mbox{ and
}w\in\ell^{\perp}\,.$

Varying $\ell$, we see that $\mathscr{N}$ consists of the maps of the form (1)
such that the restriction of $q$ to $\langle{v,w}\rangle$ has rank $\leq 1$.
Such maps correspond bijectively to decomposable bivectors $v\wedge
w\in\bigwedge^{2}V$, and the condition on $q$ can be written
$\wedge^{2}q(v\wedge w)=0$. This implies the Proposition.∎

###  2.6. Intersection of two quadrics

The following result is proved in [BEHLV]:

######  Proposition 4.

Let $X\subset\mathbb{P}^{n+2}$ be a smooth complete intersection of two
quadrics. Then $S(X)$ is a polynomial algebra in $n$ variables of degree $2$.

It is somewhat surprising that the answer is much simpler in this case that
for a single quadric.

###  2.7. Completely integrable systems

Let $V$ be a graded vector space, endowed with the associated
$\mathbb{C}^{*}$-action. Suppose that we have a $\mathbb{C}^{*}$-equivariant
morphism $\Phi:T^{*}X\rightarrow V$ whose general fiber is of the form
$Y\smallsetminus Z$, where $Y$ is a complete variety and $Z$ a closed
subvariety of codimension $\geq 2$. Then the functions on $T^{*}X$ are
constant on the fibers of $\Phi$, hence the homomorphism
$\Phi^{*}:\mathcal{O}(V)=\mathsf{S}^{\scriptscriptstyle\bullet}V^{*}\rightarrow\mathcal{O}(T^{*}X)=S(X)$
is an isomorphism of graded algebras.

A famous example of this situation is given by the _Hitchin fibration_ [Hi].
Let $C$ be a curve of genus $g\geq 2$. We fix coprime integers $r,d\geq 1$,
and consider the moduli space $\mathscr{M}$ of stable vector bundles on $C$ of
rank $r$ and degree $d$. It is a smooth projective variety. By deformation
theory the tangent space $T_{E}(\mathscr{M})$ at a point $E$ of $\mathscr{M}$
identifies with $H^{1}(C,\mathscr{E}nd(E))$; by Serre duality, its dual
$T^{*}_{E}\mathscr{M}$ identifies with $\operatorname{Hom}(E,E\otimes K_{C})$.
Let $V$ be the graded vector space $\bigoplus_{i=1}^{r}H^{0}(C,K_{C}^{i})$
(with $\deg H^{0}(C,K_{C}^{i})=i$). For $u\in\operatorname{Hom}(E,E\otimes
K_{C})$, we have $\operatorname{Tr}\wedge^{i}u\in H^{0}(C,K^{i}_{C})$.
Associating to $u$ the vector
$\operatorname{Tr}u+\ldots+\operatorname{Tr}\wedge^{r}$ gives a
$\mathbb{C}^{*}$-equivariant map $\Phi:T^{*}\mathscr{M}\rightarrow V$.

######  Proposition 5.

The homomorphism
$\Phi^{*}:\mathcal{O}(V)=\mathsf{S}^{\scriptscriptstyle\bullet}V^{*}\rightarrow\mathcal{O}(T^{*}\mathscr{M})=S(\mathscr{M})$
is an isomorphism.

Proof : $T^{*}\mathscr{M}$ admits an open embedding into the moduli space
$\mathscr{H}$ of stable Higgs bundles (of rank $r$ and degree $d$), and $\Phi$
extends to a proper map $\bar{\Phi}:\mathscr{H}\rightarrow V$ [Hi]. The
codimension of $\mathscr{H}\smallsetminus T^{*}X$ is $\geq 2$ [Fa, Theorem
II.6], hence
$\operatorname{codim}(\bar{\Phi}^{-1}(v)\smallsetminus\Phi^{-1}(v))\geq 2$ for
$v$ general in $V$. By the previous remarks this implies the result.∎

There are a number of variations on this theme. First of all, one can fix a
line bundle $L$ of degree $d$ on $X$ and consider the subspace
$\mathscr{M}_{L}$ of $\mathscr{M}$ parameterizing the vector bundles $E$ with
$\det E=L$; then $\Phi$ maps $\mathscr{M}_{L}$ onto the graded subspace
$V_{0}:=\bigoplus_{i=2}^{r}H^{0}(C,K_{C}^{i})$ of $V$, and we get as before an
isomorphism of $S(\mathscr{M}_{L})$ with
$\mathsf{S}^{\scriptscriptstyle\bullet}V_{0}^{*}$. Note that in the case
$g=r=2$ $\mathscr{M}_{L}$ is a complete intersection of two quadrics in
$\mathbb{P}^{5}$, so we recover the case $n=3$ of Proposition 4.

We can also consider the moduli space $\mathscr{M}_{\operatorname{par}}$ of
stable parabolic vector bundles on $C$ of rank $r$, degree $d$ and weights
$\alpha$, with a parabolic structure along a divisor $D=p_{1}+\ldots+p_{s}$ —
we refer for instance to [BGL] for the precise definitions. For generic
weights $\mathscr{M}_{\operatorname{par}}$ is smooth and projective; the
Hitchin map $\Phi:T^{*}\mathscr{M}_{\operatorname{par}}\rightarrow
V_{\operatorname{par}}$ takes its values in the vector space
$V_{\operatorname{par}}:=\bigoplus_{i=1}^{r}H^{0}(C,K_{C}((i-1)D))$. It
extends to a proper map from the moduli space
$\mathscr{H}_{\operatorname{par}}$ of parabolic Higgs bundle to
$V_{\operatorname{par}}$, and $\mathscr{M}_{\operatorname{par}}\smallsetminus
T^{*}\mathscr{M}_{\operatorname{par}}$ has codimension $\geq 2$ provided
$g\geq 4$, or $g=3$ and $r\geq 3$, or $g=2$ and $r\geq 5$ [BGL, Proposition
5.10]. If this holds, we get as before an isomorphism
$\mathsf{S}^{\scriptscriptstyle\bullet}V_{\operatorname{par}}^{*}\vbox{\hbox
to22.76228pt{\hfill{$\scriptstyle\sim$}\hfill} \nointerlineskip\hbox
to22.76228pt{{\hfill$\longrightarrow$\hfill}}
}S(\mathscr{M}_{\operatorname{par}})$.

###  2.8. An example: ruled surfaces

Contrary to what the previous examples might suggest, $S(X)$ is _not_
invariant under deformation of $X$; a typical example is provided by ruled
surfaces. Let $C$ be a curve of genus $\geq 2$, and $E$ a stable rank 2 vector
bundle on $C$ with trivial determinant111Such a bundle is isomorphic to its
dual, so we will not bother to distinguish them.. We put
$X=\mathbb{P}_{C}(E)$.

######  Proposition 6.

For general $E$ we have $S(X)=\mathbb{C}$.

Proof : Denote by $p:X\rightarrow C$ the structure map and by
$\mathcal{O}_{X}(1)$ the tautological line bundle. The exact sequence

$0\rightarrow\mathcal{O}_{X}(2)\rightarrow T_{X}\rightarrow
p^{*}T_{C}\rightarrow 0\,.$

gives rise to exact sequences

(2)
$0\rightarrow\mathcal{O}_{X}(2p)\rightarrow\mathsf{S}^{p}T_{X}\rightarrow\mathsf{S}^{p-1}T_{X}\otimes
p^{*}T_{C}\rightarrow 0\,.$

We claim that $H^{0}(X,\mathsf{S}^{p-1}T_{X}\otimes p^{*}T_{C})=0$. Indeed we
get from (2) exact sequences

$0\rightarrow\mathcal{O}_{X}(2q)\otimes
p^{*}T_{C}^{r}\rightarrow\mathsf{S}^{q}T_{X}\otimes
p^{*}T_{C}^{r}\rightarrow\mathsf{S}^{q-1}T_{X}\otimes
p^{*}T_{C}^{r+1}\rightarrow 0\,.$

We have $H^{0}(X,\mathcal{O}_{X}(2q)\otimes
p^{*}T_{C}^{r})=H^{0}(C,\mathsf{S}^{2q}E\otimes T_{C}^{r}))=0$ for $r\geq 1$,
because $\mathsf{S}^{2q}E$ is semi-stable [Ha, ch. I, Theorem 10.5] and $\deg
T_{C}<0$. Since $H^{0}(C,T_{C}^{r+1}))=0$, we get by induction
$H^{0}(X,\mathsf{S}^{q}T_{X}\otimes p^{*}T_{C})=0$, hence (2) gives
isomorphisms

(3) $H^{0}(X,\mathsf{S}^{p}T_{X})\cong H^{0}(X,\mathcal{O}_{X}(2p))\cong
H^{0}(C,\mathsf{S}^{2p}E)\,.$

Now for general $E$ the bundles $\mathsf{S}^{q}E$ are stable [Ha, _loc.
cit._], so $H^{0}(X,\mathsf{S}^{p}T_{X})=0$ for $p>0$.∎

For special bundles $E$ the algebra $S(X)$ can be quite nontrivial. If $E$ is
_unstable_ the tangent bundle $T_{X}$ is big [Ki], hence $S(X)$ has Krull
dimension $3$. This does not hold if $E$ is stable, but one can get
interesting algebras of dimension 2. Let $V$ be a 2-dimensional Hermitian
space, and let $G$ be a finite subgroup of $\operatorname{SU}(V)$, acting
irreducibly on $V$. Recall that $G$ is the pull-back by the covering map
$\operatorname{SU}(2)\rightarrow\operatorname{SO}(3)$ of a group $\bar{G}$
isomorphic to the dihedral group $D_{n}$ or to
$\mathfrak{A}_{4},\mathfrak{S}_{4}$ or $\mathfrak{A}_{5}$.

Given a Galois covering $\pi:\tilde{C}\rightarrow C$ with group $G$, the
vector bundle $E_{\pi}:=\tilde{C}\times^{G}V$ on $C$ is stable, of rank 2,
with trivial determinant. The space $H^{0}(C,\mathsf{S}^{p}E_{\pi})$ is
canonically isomorphic to the $G$-invariant subspace of $\mathsf{S}^{p}V$.
Note that this is zero if $p$ is odd, since $G$ contains the element $-1_{V}$.
Therefore it follows from (3) that $S(X)$ _is isomorphic to the graded algebra
of invariants_ $(\mathsf{S}^{\scriptscriptstyle\bullet}V)^{G}$, the algebra of
regular functions on the quotient variety $V/G$.

The determination of $(\mathsf{S}^{\scriptscriptstyle\bullet}V)^{G}$ goes back
to Klein [Kl, Ch. II]. It is generated by 3 homogeneous elements $x,y,z$,
subject to one weighted homogeneous relation $F(x,y,z)=0$. Putting
$\mathbf{d}=(\deg x,\deg y,\allowbreak\deg z)$, we have:

$\bullet$ For $\bar{G}=D_{n}$, $\mathbf{d}=(2n+2,2n,4)$,
$F=x^{2}+y^{2}z+z^{n+1}$.

$\bullet$ For $\bar{G}=\mathfrak{A}_{4}$, $\mathbf{d}=(4,4,6)$,
$F=x^{2}+y^{3}+z^{3}$.

$\bullet$ For $\bar{G}=\mathfrak{S}_{4}$, $\mathbf{d}=(12,8,6)$,
$F=x^{2}+y^{3}+z^{4}$.

$\bullet$ For $\bar{G}=\mathfrak{A}_{5}$, $\mathbf{d}=(30,20,12)$,
$F=x^{2}+y^{3}+z^{5}$.

##  3\. Cases with $S(X)=\mathbb{C}$

###  3.1. Varieties with $c_{1}(X)=0$

The following result, proved in [Ko], is a direct consequence of Yau’s
theorem:

######  Proposition 7.

Let $X$ be a compact Kähler variety with $c_{1}(X)=0$ in
$H^{2}(X,\mathbb{Q})$, and $\pi_{1}(X)$ finite. Then $S(X)=\mathbb{C}$.

With no assumption on $\pi_{1}(X)$, we know that $X$ is the quotient of a
product $A\times Y$, where $A$ is a complex torus and $Y$ is simply connected,
by a finite group $G$ acting freely [B]. It follows that $S(X)$ _is isomorphic
to the invariant subring_
$(\mathsf{S}^{\scriptscriptstyle\bullet}T_{0}(A))^{G}$.

###  3.2. Varieties of general type

######  Proposition 8.

Let $X$ be a variety of general type. Then $S(X)=\mathbb{C}$.

This is a consequence of the stronger result that $T_{X}$ is not pseudo-
effective [HP, Proposition 4.11].

###  3.3. Hypersurfaces

The following result is proved in [HLS]:

######  Proposition 9.

Let $X$ be a smooth hypersurface of degree $d\geq 3$ and dimension $\geq 2$.
Then $S(X)=0$.

In fact the authors prove the stronger result
$H^{0}(X,\mathsf{S}^{p}T_{X}(d-3))=0$, and also that $T_{X}$ is not
pseudoeffective.

##  4\. The Krull dimension of S(X)

A complete description of the ring $S(X)$ is in general intractable, but we
can still ask for some of its properties: for instance its Krull dimension. It
is equal to $1+\kappa(\mathcal{O}_{\mathbb{P}T^{*}X}(1))$, where $\kappa$
denotes the _Iitaka dimension_ (see for instance [La, Ch. 2]). We have
$0\leq\dim S(X)\allowbreak\leq 2\dim X$, and all cases can occur. In
particular,

$\dim S(X)=2\dim X\ \Longleftrightarrow\
\mathcal{O}_{\mathbb{P}T^{*}X}(1)\mbox{ big }\Longleftrightarrow\ T_{X}\mbox{
big}\,.$

This property holds for toric varieties [Hs] and for all rational homogeneous
varieties [GW, Corollary 4.4]. The paper [Li1] contains a number of other
examples of varieties with a group action whose tangent bundle is big.

Though the most interesting cases occur when the Kodaira dimension $\kappa(X)$
is $-\infty$, one may ask what can be said when $\kappa(X)\geq 0$. The
condition $S(X)\neq\mathbb{C}$, or the weaker condition that $T_{X}$ is
pseudo-effective, imposes strong restrictions on $X$ — see [HP, Proposition
4.11]. In fact, the following result, which I had proposed as a conjecture in
the first version of this note, has been proved by J. Liu [Li2]:

######  Proposition 10.

$\dim S(X)\leq\dim X-\kappa(X)$. If equality holds, a finite étale covering of
$X$ is isomorphic to $A\times Y$, where $A$ is an abelian variety and $Y$ a
variety of general type.

It follows in particular that $\dim S(X)>\dim X$ implies $\kappa(X)=-\infty$.

## References

  * [B] A. Beauville : Some remarks on Kähler manifolds with $c_{1}=0$. Classification of algebraic and analytic manifolds, 1-26, Progr. Math. 39, Birkhäuser Boston, 1983.
  * [BEHLV] A. Beauville, A. Etesse, A. Höring, J. Liu, C. Voisin : Symmetric tensors on the intersection of two quadrics and Lagrangian fibration. Preprint arxiv:2304.10929.
  * [BGL] I. Biswas, T. Gómez, M. Logares : Integrable systems and Torelli theorems for the moduli spaces of parabolic bundles and parabolic Higgs bundles. Canad. J. Math. 68 (2016), no. 3, 504-520.
  * [Fa] G. Faltings : Stable $G$-bundles and projective connections. J. Algebraic Geom. 2 (1993), no. 3, 507-568.
  * [Fu] B. Fu : Symplectic resolutions for nilpotent orbits. Invent. Math. 151 (2003), no. 1, 167-186.
  * [GW] D. Greb, M. Wong : Canonical complex extensions of Kähler manifolds. J. Lond. Math. Soc. (2) 101 (2020), no. 2, 786-827.
  * [Ha] R. Hartshorne : Ample subvarieties of algebraic varieties. Lecture Notes in Math. 156. Springer-Verlag, Berlin-New York, 1970.
  * [Hi] N. Hitchin : Stable bundles and integrable systems. Duke Math. J. 54 (1987), no. 1, 91-114.
  * [Hs] J-C. Hsiao : A remark on bigness of the tangent bundle of a smooth projective variety and D-simplicity of its section rings. J. Algebra Appl. 14 (2015), no. 7, 1550098.
  * [HLS] A. Höring, J. Liu, F. Shao : Examples of Fano manifolds with non-pseudoeffective tangent bundle. J. Lond. Math. Soc. (2) 106 (2022), no. 1, 27-59.
  * [HP] A. Höring, T. Peternell : Stein complements in compact Kähler manifolds. Preprint arxiv:2111.03303.
  * [Ki] J-S. Kim : Bigness of the tangent bundles of projective bundles over curves. Preprint arxiv:2206.15413.
  * [Kl] F. Klein : Lectures on the icosahedron and the solution of equations of the fifth degree. Dover Publications, Inc., New York, 1956.
  * [Ko] S. Kobayashi : Chern class and holomorphic tensor fields. Nagoya Math. J. 77 (1980), 5-11.
  * [La] R. Lazarsfeld : Positivity in algebraic geometry I. Ergebnisse der Math. 48. Springer-Verlag, Berlin, 2004.
  * [Li1] J. Liu : On moment map and bigness of tangent bundles of $G$-varieties. Alg. Number Th. 17 (2023) 1501-1532.
  * [Li2] J. Liu : Krull dimension of symmetric algebras and Beauville’s conjecture. Preprint.


# An Asynchronous and Low-Power True Random Number Generator using STT-MTJ

Ben Perach and Shahar Kvatinsky The authors are with the Andrew and Erna Finci
Viterbi Faculty of Electrical Engineering, Technion - Israel Institute of
Technology, Haifa, Israel 3200003. e-mail<EMAIL_ADDRESS><EMAIL_ADDRESS>This research is partially supported by the ERC
under the European Union’s Horizon 2020 Research and Innovation Programme
(grant agreement no. 757259), by the Technion Hiroshi Fujiwara Cyber Security
Research Center, and by the Israel Cyber Bureau.

###### Abstract

The emerging Spin Transfer Torque Magnetic Tunnel Junction (STT-MTJ)
technology exhibits interesting stochastic behavior combined with small area
and low operation energy. It is, therefore, a promising technology for
security applications, specifically the generation of random numbers. In this
paper, STT-MTJ is used to construct an asynchronous true random number
generator (TRNG) with low power and a high entropy rate. The asynchronous
design enables decoupling of the random number generation from the system
clock, allowing it to be embedded in low-power devices. The proposed TRNG is
evaluated by a numerical simulation, using the Landau–Lifshitz–Gilbert (LLG)
equation as the model of the STT-MTJ devices. Design considerations, attack
analysis, and process variation are discussed and evaluated. We show that our
design is robust to process variation, achieving an entropy generating rate
between 99.7Mbps and 127.8Mbps with 6-7.7 pJ per bit for $90\%$ of the
instances.

###### Index Terms:

TRNG, hardware security, memristors, Magnetic Tunnel Junction, random number
generation

##  I Introduction

Security is a major concern in modern digital systems. One of the main tools
used in security is cryptography, used to encode information that only
authorized entities can access. However, security applications need to be
implemented with caution. Changing the cryptographic algorithm or its
assumptions, even to a limited extent, can compromise the entire system. One
such crucial part of cryptographic algorithms is the generation of the
cryptographic keys [1, 2, 3, 4, 5].

The key of a cryptographic algorithm is the secret of the encryption scheme.
The algorithm itself is assumed to be publicly known, and the key is the only
missing information needed to reveal the encrypted data [2]. Hence, an
adversary will try to obtain the key. Since the key is of a finite size, the
number of possible values for the key is finite as well, and if this number is
too small, an adversary can try them all. Additionally, if the adversary has
partial knowledge of the key, such as some mathematical conditions between the
key bits, this information can be used to reduce the number of options [3, 5,
4]. Hence, it is desirable to generate a random key with a uniform
distribution on all of its possibilities, so an adversary will have to try all
of the options without a defined order. Processes that can generate a random
number as the key are called Random Number Generators (RNGs). Note that the
design of the RNG itself, as part of the encryption scheme, is also assumed to
be publicly known.

One type of RNG is a TRNG, a true random number generator [6, 7]. A TRNG is
based on a physically random process (e.g., thermal noise), and the TRNG
extracts that randomness to a usable form, such as digital numbers. The TRNG
approach for generating random numbers is attractive since the generated
number cannot be inferred from the state of the system but can only be
predicted from the distribution of the physical random process [1, 2].

Current TNRGs use CMOS logic, such as ring oscillators [8] or metastable
latches [9], as their source for randomness. However, emerging technologies
[10, 11, 12, 13, 14] offer new and interesting alternatives, due to their
smaller area and lower power consumption when compared to transistors. A small
area and low power TRNG, based on a random process in emerging technologies,
will reduce power consumption or enable secure communication for small or low-
power electronic devices (e.g., Internet-of-Things devices and mobile
devices). One such technology is the Spin Transfer Torque Magnetic Tunnel
Junction (STT-MTJ) [10, 13, 14]. As an emerging memory technology, STT-MTJ (or
STT-MRAM) has relatively low operating energy and small area, and its
switching time stochasticity has been thoroughly studied [15].

While previously proposed STT-MTJ based TRNGs [16, 17, 18, 19, 20] require a
strict time measurement to achieve high randomness, we propose an asynchronous
TRNG. The proposed design relies on discharging a capacitor simultaneously
through several STT-MTJ devices. The process ends when the capacitor is
sufficiently discharged; the generated random number is extracted from the
final state of the STT-MTJ devices. Since the capacitor is discharged
asynchronously, the random number generation is independent of a clock signal.
The only time measurement required in the TRNG design is the duration to
discharge the capacitor, which can be approximated by defining a minimum time.
Waiting for more than the minimum time does not influence the randomness of
the output. Therefore, this design can be embedded in low-frequency (i.e.,
low-power) devices without loss of randomness. Furthermore, the use of several
STT-MTJ devices increases the extracted randomness in each operation and
improves the robustness to process variation.

To evaluate the proposed design, numerical simulations of the stochastic
physical model of the STT-MTJ were performed. The randomness of the proposed
design and the effect of internal and external influences were measured,
including the robustness of the design to process variation. Possible attack
venues are discussed and mitigation options are presented. To the best of our
knowledge, this is the first study of an STT-MTJ based TRNG that includes
analysis of attacks, essential for every security-related work111Attack
analysis was previously conducted only on other STT-MTJ based security
devices, such as physically unclonable functions [21]..

##  II Background

###  II-A True Random Number Generators

RNGs are divided into two main groups, Pseudo-Random Number Generators (PRNGs)
and True Random Number Generators (TRNGs). PRNGs are deterministic algorithms
that only appear to generate a random sequence of numbers. A cryptographic key
generated by a PRNG might compromise the encryption since the PRNG outputs are
inherently connected [3, 5, 4], although some PRNGs are considered to be
sufficiently secure for cryptographic use [22, 23]. TRNGs are designed to
extract a random behavior of some physically random process [8, 9, 6, 7],
resulting in true randomness that can be explained according to some physical
laws. The output of a TRNG can only be predicted according to the physical
process probability distribution, even if all the information about the system
(register values, voltage levels, etc.) is known prior to the TRNG operation.

CMOS TRNGs often use ring oscillators [8, 24] or metastable latches[9] to
generate random numbers. A ring oscillator (RO) is a chain with an odd number
of NOT gates, where the output of the last NOT gate is the input of the first
NOT gate, resulting in a ring of gates. Since the number of NOT gates is odd,
all the outputs of the NOT gates oscillate between logic high and logic low.
However, due to noise in the transistors, the rise and fall times of the gates
are randomly changed, resulting in frequency variation of the oscillation. RO
based TRNGs use this frequency variation as the source of randomness: for
example, they might compare several ROs [24] or measure the time until the
occurrence of an RO-related event [8]. TRNGs based on metastable latches force
a latch into an unstable equilibrium state and then release it. The stable
state the latch will end in depends on random noise and therefore a random
number is generated.

The quality of the randomness of a TRNG can be measured by its output
properties, which are ideally independent and uniformly distributed. In
practice, this need not be the case for cryptographic use, since the
dependencies and nonuniform distribution can be compensated for by post-
processing the output. Such post-processing methods are referred to as
randomness extractors [25, 26]. However, the closer to independent and
uniformly distributed the TRNG output is, the simpler the extractor can be.
Even if the output is uniform under regular operation, randomness extractors
are still commonly used to compensate for real-world effects (e.g., process
variations, wear-out, and interference) that might reduce the randomness of
the TRNG output [26, 7].

Other important properties of a TRNG include robustness to process and
environmental variations and a high generating rate. An adversary might change
environmental parameters (e.g., electromagnetic field, temperature) to
interfere with the operation of the TRNG and reduce its randomness. To
guarantee that a TRNG is secure, it is critical to identify the underlying
random physical process and the factors affecting it and test the TRNG under
these factors. Additionally, to ensure correct operation, statistical tests,
referred to as online tests, are often performed on the TRNG output during
run-time, which means that they need to be lightly implemented, making them
less thorough than the statistical tests performed at design time.

New emerging technologies, such as the STT-MTJ [10, 13, 14], show small area
and low operation energy compared to transistors. Additionally, they exhibit
ample stochasticity in their operation [15], making them interesting
candidates as the randomness source for new TRNG designs.

###  II-B STT-MTJ Devices

Figure 1: In-plane STT-MTJ device and its operation. (a) An STT-MTJ device
structure with the free layer (upper), the tunnel barrier layer (middle), and
the fixed layer (bottom). (b) The P and (c) AP states and the associated
currents to switch toward the state.

A spin transfer torque (STT) magnetic tunnel junction (MTJ) is a device
composed of two ferromagnetic layers with a tunnel barrier layer between them
[15, 27]. One ferromagnetic layer, the fixed layer, has a fixed magnetization
direction. The other ferromagnetic layer, the free layer, can switch its
magnetization direction. In this paper, in-plane MTJs are used, where the
magnetization direction of the ferromagnetic layers is in the plane of the
layers. Figure 1(a) illustrates the MTJ structure. The direction of the free
layer magnetization can be changed by a current through the device, and it has
two stable states, parallel (P, Figure 1(b)) or anti-parallel (AP, Figure
1(c)) to the direction of the fixed layer. The direction of the current
determines the change in the magnetization direction. Other states (i.e.,
other directions of the free layer magnetization) are unstable.

The spin-transfer torque mechanism enables the switching of orientation of the
free layer magnetization. The electrons passing through a ferromagnetic layer
tend to align their magnetic moment in the direction of the magnetization of
the layer. Thus, electrons that pass through the fixed layer first are aligned
with its magnetization direction. When these electrons reach the free layer,
its magnetization direction shifts towards the P state due to magnetic moment
conservation (Figure 1(b)). In the other current direction, electrons are
reflected with magnetic moment direction opposite to that of the fixed layer
and change the free layer to the AP state (Figure 1(c)). However, a damping
process pulls the free layer magnetization to the closest stable state,
requiring a sufficiently strong current for adequate time to enable a switch
between the stable states.

The switching process between the P and AP states is random [15] due to the
thermal fluctuations in the ferromagnetic layers. Although the current through
the MTJ pushes the magnetization of the free layer to a certain stable state
(through unstable intermediate states), thermal fluctuations will make the
path to that state random, resulting in a random switching time. Even if no
current is applied, the state of the STT-MTJ fluctuates constantly since the
thermal fluctuations occur regardless of the existence of the current.

The state of the MTJ also determines its resistance, where the P state
resistance is marked as $R_{on}$, the AP state is marked as $R_{off}$, and
$R_{on}<R_{off}$. The resistance of the MTJ, when it is in a state other than
P or AP, is between $R_{on}$ and $R_{off}$ and its exact value depends on the
state [28]. To determine the state of the MTJ, a low voltage can be applied
across it (sufficiently low not to incur a switch), the current can be
measured, the resistance of the MTJ can be extracted (by Ohm’s law), and the
state of the MTJ can be inferred.

To model the operation of the entire STT-MTJ, the magnetization of the free
layer is usually approximated to a single domain. The phenomenological Landau-
Lifshitz-Gilbert (LLG) equation [29], with the addition of a stochastic term
for the thermal fluctuations [30] and Slonczewski’s STT term [31], can
accurately describe the dynamics of the magnetization of the free layer. For
current pulses with low or high current magnitudes, approximations and models
for the distribution of the switching time exist [32, 33, 34]. For current
pulses with intermediate current magnitudes, approximations for the switching
time distribution and other models are also available [27, 35]. However, there
is no model for the switching distribution in the intermediate current region
for non-pulse waveforms. In the last case, the LLG equation has to be solved
numerically.

###  II-C Previously Proposed STT-MTJ Based TRNGs

Emerging technologies, such as memristors, have been proposed for TRNGs that
operate by applying a current pulse through the devices to randomly switch
them with approximately 50% probability [36, 37, 38]. The generated random
number in these TRNGs is the state of the memristors at the end of operation.
Similarly, TRNGs based on STT-MTJ [16, 17, 18, 19, 20] have been proposed. In
these designs, the current pulse is controlled by a feedback circuit in order
to be robust to process variation and environmental changes. However, only Qu
et al. [19] have analyzed the effects of process variation, and proposed to
use several MTJ devices in parallel to mitigate those effects.

In [39], Qu et al. proposed a differential approach, where two STT-MTJs are
connected in series and in reverse orientation. A current pulse is driven
through both of the MTJs simultaneously and a dedicated mechanism terminates
the pulse when one of the MTJs is switched. The output bit is determined
according to the end state of both MTJs. This design was shown to be robust to
process variation, operating voltage, and temperature, due to the symmetry of
the MTJs.

All of the aforementioned TRNGs use controlled current pulses to switch the
MTJs. To measure the duration of the current pulses, a clock with a period
smaller than or equal to the pulse duration is needed. Additionally, the
quality of the randomness will be influenced by the ability of the clock
signal to accurately measure the pulse duration, further binding and
complicating the system. Therefore, these TRNGs are incompatible with systems
that have insufficient clock frequency or accuracy, such as low power systems
with low frequency clock.

Lee et al. [40] proposed to reduce the energy barrier between the P and AP of
the MTJ to enable faster switching with reduced energy. This was achieved by
using specially designed MTJ devices. Their proposed TRNG design uses multiple
MTJs (to reduce the effect of process variation) with low energy barriers,
which were set to an unstable state and released, letting the MTJs settle
randomly to one of the stable states. Vodenicarevic et al. [41] proposed a
TRNG based on a similar approach, where the STT-MTJ’s energy barrier between
the P and AP states is sufficiently low to enable spontaneous switching in a
reasonable time, without the aid of external stimuli and solely by thermal
fluctuations. These two approaches require the use of specially designed MTJs
due to the reduced energy barrier [40], and, despite the advantages of reduced
latency and energy, this approach makes the design more vulnerable to external
magnetic fields, and thus to attacks.

Ghosh [21] comprehensively analyzed spintronics in security applications and
showed that MTJ-based security circuits are sensitive to the effects of an
external magnetic field. Hence, it is essential to consider this effect when
designing an MTJ based TRNG, to determine the security of such a design and
the effects of nearby circuits. However, none of the aforementioned STT-MTJ
based TRNGs that rely on a current pulse [16, 17, 18, 19, 20, 39] were
designed to account for the effects of an external magnetic field and the
associated attacks. The authors of [40, 41] only briefly consider the effects
of an external magnetic field and their design relies on a special MTJ device
that is more vulnerable to attacks. In this paper, we choose to use standard
MTJ devices that are easier to fabricate in a standard process and have better
robustness against attacks. We provide a comprehensive evaluation of the
effects of an external magnetic field on the proposed TRNG design.

##  III Proposed TRNG Structure and Operation

The proposed TRNG generates $N$-bit numbers and is composed of a capacitor,
$N$ STT-MTJ devices, $N$ sense amplifiers, and transistors that serve as
switches, as shown in Figure 2.

The TRNG operation consists of three steps, each taking a fixed amount of
time. The first step, the Reset step, charges the capacitor $C$ to the
$V_{init}$ voltage (using transistors $N1$ and $P1$) and applies a current
through the MTJ devices (using transistors $N4$ and $P4$), switching them all
to the AP state. The second step, the Enable step, connects $C$ in parallel to
all the MTJ devices (using transistors $N2,N3,$ and $P2$). This discharges $C$
through the MTJ devices, enabling them to switch to the P state with some
probability. During the Enable step, the resistance of an MTJ drops if it is
switched, making the capacitor discharge faster. This lowers but does not
eliminate the switching probability of the other MTJs. The third step, the
Read step, applies a small current through the MTJ devices (using transistor
$P3$), and the sense amplifiers determine the state of each. The AP/P states
are interpreted as ’0’/’1’ respectively. Overall, the TRNG outputs an $N$-bit
word.

The proposed TRNG relies on the stochastic switching time of the MTJ as its
randomness source. Unlike previously proposed TRNGs, the randomness extraction
operation in the Enable step is asynchronous and does not depend on a strict
time measurement. The capacitor is sufficiently discharged during the Enable
step to ensure a low probability for further switching until the end of the
Read step. Hence, the randomness of the output does not change if the duration
of the Enable step is longer than a certain lower bound. Thus, accurate
measurement of the Enable step duration is not required. Note that although
the Enable step is done asynchronously, the TRNG still uses a clock signal
since a time measurement is still needed to transition between the operation
steps.

(a)

(b)

Figure 2: The proposed TRNG consists of (a) $N$ parallel connected MTJ-modules
and a capacitor. (b) Schematic of the MTJ module.

##  IV Evaluation

###  IV-A Measure for Randomness

Determining whether a sequence of numbers is random is considered difficult
[42]. To try and overcome this problem, standard statistical test suites, such
as the NIST SP 800-22 [42], are usually used to inspect for random properties.
However, the proposed TRNG is evaluated using a simulation, which generates
the TRNG outputs (N-bit words) in an i.i.d. (independent and identically
distributed) manner. Each output is generated independently by numerically
solving the stochastic differential equation system of the TRNG, which uses a
different sequence of computer-generated random thermal noise for each TRNG
output word. (For more information about and justifications for the
simulation, see Section IV-B.) Hence, the simulation is designed such that
there are no dependencies between bits from different TRNG outputs, but only
the dependencies between bits in the same output word, reducing the dependency
checks to within an output word.

To measure the dependencies between bits in the same output word, we use two
measures: the Shannon entropy and the min-entropy of the output words. Entropy
quantifies the amount of surprise in the outcome of the experiment. The higher
the entropy, the more surprise in the experiment, i.e. the experiment is more
random. For an i.i.d. source with values from a finite set $\mathcal{X}$ with
probability distribution function $p:\mathcal{X}\rightarrow[0,1]$, the Shannon
entropy per word is $-\sum_{x\in\mathcal{X}}{p(x)\log_{2}p(x)}$ (with the
definition that $0\cdot\log_{2}0=0$) and the min-entropy per word is
$\min_{x\in\mathcal{X}}(-\log_{2}p(x))$. Both entropies are measured in bits.
If the number of elements in the finite set $\mathcal{X}$ is $m$, then both
the Shannon and min entropies get a value in the range $[0,log_{2}m$], where
$0$ entropy is achieved on the deterministic distribution and the $log_{2}m$
entropy is achieved on the uniform distribution. Taking $\mathcal{X}$ to be
the set of N-bit words results in $log_{2}m=N$. Hence, the maximum entropy for
an i.i.d. N-bit TRNG is $N$.

When there are dependencies between bits in the TRNG output, some output words
will be more likely than others and the distribution of a single TRNG output
word will deviate from the uniform distribution, resulting in a lower entropy
than the maximum. Stronger dependency increases the deviation from the uniform
distribution and the lowers the entropy. Hence, entropy is a measure for the
dependencies in a single TRNG output word and an entropy close to maximum
means low dependencies.

The min-entropy is a lower bound to the Shannon entropy (with equality
achieved on the uniform and deterministic distributions) and it is the lowest
amount of randomness a single sample of a random variable can give. Randomness
extractors are sometimes designed to extract an output for every input, so the
correct measure here is the min-entropy of their source [25]. The Shannon
entropy is the expected randomness from a random variable. For an i.i.d.
source, the Shannon entropy plays an important role in bounding the number of
uniformly distributed bits that can be extracted from $n$ samples [43, 44].
Hence, the Shannon entropy gives us a notion of how many samples are required
to extract a certain degree of randomness, while the min-entropy gives us the
worst-case randomness of a single sample.

###  IV-B Simulation Methodology

TABLE I: Simulated Circuit Parameters. $R_{N2,N3,P2}$ is the modeled total effective resistance of transistors $N2,N3,P2$. Feature | Value |  Feature | Value
---|---|---|---
NFET operation gate voltage | $1.5V$ |  $R_{on}$ | $1000\Omega$
PFET operation gate voltage | $0V$ |  $R_{off}$ | $2500\Omega$
$R_{N2,N3,P2}$, 2-bit TRNG | $4450\Omega$ |  $V_{init}$ | $0.8V$
$R_{N2,N3,P2}$, 4-bit TRNG | $3440\Omega$ |  $T_{enable}$ | $10ns$
$R_{N2,N3,P2}$, 6-bit TRNG | $2640\Omega$ |  $C$ | $10pF$
$R_{N2,N3,P2}$, 8-bit TRNG | $1960\Omega$ |  Temp. | $300K$

We evaluated our TRNG with Monte-Carlo simulations for the Enable step for
different topologies, each with a different number of MTJ devices (different
N). The simulation numerically solves the differential equation system of the
MTJs (stochastic LLG equations) and the capacitor. The LLG equations are used
since a non-pulse current waveform is passed through the MTJ devices. The
transistors $N2,N3,$ and $P2$ were modeled by a constant resistance. The
equations were solved using a standard midpoint scheme [45] assuming no
external magnetic field (unless otherwise stated) and the stochastic term was
interpreted in the sense of Stratonovich. We could not obtain an analytic
expression for the TRNG output distribution.

Each iteration of the Monte-Carlo simulation produces the TRNG output binary
word. For each measurement of entropy, 2000 iterations were conducted. The
probability of each TRNG output was evaluated as its frequency of appearance.
However, when the parameters of the simulated MTJs were identical (i.e., with
no device-to-device variations), the probability was evaluated as the
frequency of the corresponding Hamming weight divided by the number of outputs
with the same Hamming weight222From symmetry, outputs with the same Hamming
weight have the same probability., thus increasing the accuracy. Note that
each iteration of the Monte-Carlo simulation produces a single $N$-bit output
of the TRNG, meaning that the simulation produces the probability of a single
output of the TRNG.

When this simulation model is used to extract the entropy of the TRNG, the
TRNG is assumed to be an i.i.d. source, since the model does not include the
correlation between consecutive runs of the TRNG. This assumption is justified
since the MTJs are always in the AP state prior to the Enable step, regardless
of the output of the last run. Furthermore, thermal fluctuations occur
constantly; hence, the exact position of the magnetization (around the AP
state) at the beginning of the Enable step is itself random. This results in a
fresh start in every run.

Nevertheless, consecutive runs will be correlated in a real-world TRNG. Some
correlation will be caused by changes in the operation parameters but not by
true causality between samples. If, for example, during the sampling of the
TRNG, a nearby circuit will periodically work with cycle time $T$, the
magnetic field on the MTJs will change with the same period. As a result,
samples with time $T$ between them will show correlation just because they
have the same distribution, not because they have true causality. Similar
effects can come in the form of temperature, voltage, etc.

The STT-MTJ devices are modeled as device C from [27], a standard in-plane
STT-MTJ that can be used for memory design and has the lowest switching
current in [27]. The circuit parameters are listed in Table I. Different
values for the modeled effective resistance of transistors $N2,N3,$ and $P2$
were simulated for each topology, and were chosen to maximize the entropy;
results are shown in Table I. To find the size of the transistors and verify
the accuracy of the constant resistance model, we performed circuit
simulations (with resistors instead of MTJs) in Cadence Virtuoso using a 28nm
GlobalFoundries process. The Virtuoso simulations showed that the transistors
transition quickly at the beginning of the Enable step. Since this transition
time is faster than the switching time of the MTJs, it can be ignored. During
the rest of the Enable step the total resistance of the transistors is
approximately constant, verifying that our constant resistance model of the
transistors is acceptable for the evaluation of our design.

Since the resistance of the interconnect is a few ohms per $\mu m$ while the
resistances of the transistors and MTJs are in the order of $k\Omega$, we
neglect the wire resistance. The difference in resistance due to difference in
wire lengths between the MTJ modules is also in the order of a few ohms and is
well within the process variation considerations in Section IV-D3. Hence, it
is neglected as well. Additionally, we measured the parasitic capacitance and
leakage currents in our design. The simulation shows that the parasitic values
are several orders of magnitude lower than the non-parasitic values, and hence
they are ignored.

Figure 3: An example for a single iteration of the simulation for $N=4$. (a)
The current through the MTJs during the Enable step. (b) The magnetization
direction of the free layer in the dimension of the fixed layer magnetization
during the Enable step. In this example MTJ0 and MTJ3 are flipped to the P
state, and the TRNG output word will be $1001$.

The number of MTJ devices in the design, i.e. $N$, was restricted to 2, 4, 6,
and 8 because the larger $N$ is, the shorter the discharge time of the
capacitor. Hence, a stronger current should flow through the MTJ devices to
maintain the same switching probability, requiring a lower transistor
resistance. The lower resistance will shorten the discharge time further, but
the resulting switching probability of the MTJs will increase. However, a
lower transistor resistance means a larger transistor size. A larger $N$ can
improve the performance of the TRNG (see Section IV-D). However, the
simulation was restricted to $N\leq 8$ since the transistor sizes required for
the $N=8$ topology are considered large (width of a few hundred nano-meters ).
A larger $N$ can be achieved by considering different system parameters (e.g.,
higher $V_{init}$, larger capacitor).

An example for a single iteration of the simulation with $N=4$ is shown in
Figure 3 ($N=4$ was chosen for clarity). The currents through the MTJs during
the simulated Enable step are shown in parallel to the magnetization of the
free layer (in a single dimension, the dimension of the fixed layer
magnetization). When an MTJ switches to the P state, its resistance drops and
the current through it increases. When the current reaches the P state, the
current through the MTJ and the magnetization of the free layer remain steady,
since the current through the MTJ continues to direct the state to the P
state.

We compare our results to CMOS-based TRNGs. Since previously proposed STT-MTJ
based TRNGs require a high frequency clock or a modified STT-MTJ device and do
not include process variation or external magnetic field influence in their
evaluation, we have not compared our results to those designs.

###  IV-C NIST Statistical Test Suite

The National Institute of Standards and Technology (NIST) SP 800-22 rev.1a
[42] test suite is commonly used to evaluate random number generators. The
suite is composed of several statistical tests, each operating on a string of
bits. The test indicates whether this string of bits is likely to come from a
uniform i.i.d. source. To conduct the test suite, a number of bit sequences
are retrieved from the generator to be tested (sequences do not share bits
between them). Each test is run on all sequences, resulting in a P-value for
each sequence on each test. The P-value quantifies the distance between the
test result for that sequence and the expected result for a uniform i.i.d.
sequence. A sequence is said to pass a test if the P-value for that sequence
and test is above a threshold. Then two scores are given for each test, a
success rate and a P-value. The success rate is the proportion of sequences
that pass that test, while the P-value is a number between 0 and 1. This
number quantifies the distance of the sequences’ P-value distribution from the
expected P-value distribution of a uniform i.i.d. source for that test. Note
that even a perfect source will not produce a perfect success rate and P-value
(i.e. 1) for a test, due to statistical deviations. A generator is said to
pass a test if the test’s success rate and P-value are both above a threshold.

The proposed TRNG does not have a uniform distribution since output words with
different Hamming weight have different probabilities, while output words with
the same Hamming weight have the same probability (due to symmetry). Since the
design was calibrated for maximum entropy, the words with minimum (all zeros)
and maximum (all ones) Hamming weights have the lowest probabilities, while
the words with the half zeros and half ones have the highest probability. This
results in a bias towards certain bit patterns when a sequence of output words
is considered as a sequence of bits. Hence, the NIST test suite is expected to
fail on the proposed TRNG without post-processing. Failing the NIST test suite
does not mean that the TRNG is not random; it means only that the TRNG
distribution does not appear to be uniformly distributed. Furthermore, non-
uniformity does not mean that the TRNG cannot be used for cryptography. It
means only that post-processing might be a prerequisite for this use. (Post-
processing might be used regardless, to compensate for process variation and
interference effects [26, 7].)

To show that the proposed TRNG is sufficiently random, the TRNG output words
are post-processed by a simple and reversible function before evaluation by
the test suite. The reversibility of the processing indicates that the new bit
sequence has the same information as the original sequence. To define the
post-processing, the TRNG output word sequence is denoted by
$\\{w_{1},w_{2},w_{3},\ldots\\}$ and the processed word sequence is denoted by
$\\{z_{1},z_{2},z_{3},\ldots\\}$, each of which are $N$-bit words. Then, the
post-processing is defined as $z_{1}=w_{1}$ and $z_{i}=w_{i}\oplus z_{i-1}$
for $i>1$ ($\oplus$ is the bit-wise XOR operation). The bit sequence is taken
as the bits of $\\{z_{i}\\}_{i\geq 1}$, starting from $z_{1}$, in a big-endian
fashion. This operation is reversible (since $w_{1}=z_{1}$ and
$w_{i}=z_{i}\oplus z_{i-1}$ for $i>1$) and simple to implement (requiring an
$N$-bit register and $N$ XOR gates). Note that this post-processing is not a
qualified cryptographic hash function or randomness extractor. It is used
solely to demonstrate that the TRNG has sufficient randomness to pass the test
in the NIST test suite.

For each topology of the TRNG, $1024$ sequences of $1024$ bits each (a total
of $2^{20}$ bits) were generated for the NIST test suite. The results of the
P-value and success rates for the tests with their thresholds are listed in
Table II. To perform all of the tests in the suite, a substantially larger
number of bits is needed, which will require an unfeasible amount of time to
produce with the TRNG simulation. Therefore, the tests listed in Table II are
those that can be run with the produced number of bits. All topologies passed
all executed tests.

TABLE II: Results of the NIST test suite [42] for the proposed TRNG for different numbers of bits (N). P-value threshold is .0001 and success rate threshold is $1004/1024\approx$ .980 for testing 1024 sequences. The proposed TRNG passed all the tests. | $N=2$ | $N=4$ | $N=6$ | $N=8$
---|---|---|---|---
Test Name |  P value |  Succ. Rate |  P value |  Succ. Rate |  P value |  Succ. Rate |  P value |  Succ. Rate
Frequency | .28 | .993 | .0079 | .992 | .69 | .992 | .54 | .985
Block Frequency | .73 | .995 | .43 | .990 | .53 | .985 | .20 | .988
Runs | .038 | .990 | .22 | .988 | .068 | .983 | .25 | .992
Longest Run | .87 | .990 | .34 | .993 | .073 | .990 | .28 | .990
Serial (1) | .17 | .988 | .029 | .982 | .081 | .989 | .14 | .985
Serial (2) | .52 | .994 | .17 | .987 | .44 | .989 | .58 | .987
Approximate Entropy333This is not the same entropy as computed in the rest of the paper; see [42] for details. | .28 | .982 | .00078 | .984 | .75 | .984 | .065 | .986
Cusum (1) | .026 | .990 | .0011 | .990 | .016 | .988 | .00067 | .983
Cusum (2) | .16 | .992 | .0082 | .992 | .0014 | .989 | .055 | .985

###  IV-D Entropy per Output

We evaluated the entropy of the TRNG for different design, environmental, and
process parameters.

Figure 4: Entropy of the TRNG for different (a) enable step time duration, (b)
$V_{init}$, (c) $C$, and (d) offset in the total effective resistance of
transistors $N2,N3,P2$.

####  IV-D1 Design Parameters

Include the Enable step duration time, $V_{init}$, $C$, and the effective
modeled resistance of $N2,N3,$ and $P2$. Simulation results of the entropy for
different design parameters are shown in Figure 4. The design parameters
trade-off between the different performance measures of the TRNG (entropy,
operation time, area and power) while using the same MTJ devices. An important
observation is that our design can, in the ideal case, reach nearly the
maximum possible entropy (1-bit entropy per MTJ device).

Figure 4(a) shows the effect of the Enable step duration, as mentioned in
Section III. When the duration is sufficiently long, the randomness of the
TRNG is maximal. This allows the TRNG to be used in low-frequency devices,
where the time measurement has a low resolution.

It is evident that a small change in $V_{init}$, from its designed value of
$0.8V$, can change the entropy. The value of the initial capacitor voltage
affects the duration of the Reset step and the entropy throughput of the TRNG
(see Section IV-E). However, reasonable variations in the capacitance of the
capacitor (less than $0.5pF$, or approximately 5%) have little effect on the
entropy, since the capacitance is relatively large.

Additionally, we can conclude that modeling the open transistors by a constant
resistance is tolerable. Deviations in the range of $250\Omega$ from the
designed value do not reduce the entropy much. From the Cadence Virtuoso
simulation (see Section IV-B) we verified that the actual effective resistance
of $N2,N3,$ and $P2$ fluctuates well within the range of $\pm 250\Omega$
around the designed value.

####  IV-D2 Environmental Parameters

Figure 5: (a)-(b) Effect of temperature: (a) a non-changing MTJ resistance,
(b) including a change in MTJ resistance, where $R_{on}$ is constant and
$TMR=\frac{R_{off}-R_{on}}{R_{on}}$ changes at a linear rate of
$-0.4\frac{\%}{{}^{\circ}K}$. (c)-(e) Effect of a constant external magnetic
field (fixed direction and varying magnitude): (c) parallel to the fixed layer
magnetization, (d) in-plane and perpendicular to the fixed layer
magnetization, (e) perpendicular to the layer’s plane.

These parameters are external to the TRNG and can be altered by an adversary.
(see Section V). The effect of temperature and the external magnetic field on
the MTJ devices are considered here, and their influence on the entropy is
shown in Figure 5.

In the LLG equation, the temperature affects only the thermal fluctuations of
the MTJ. However, the resistance of the MTJ is temperature dependent [46, 47].
While the resistance of the MTJ in the P state is roughly constant, the
resistance of the AP state changes more considerably with the temperature
[46]. The $TMR=\frac{R_{off}-R_{on}}{R_{on}}$ changes in an approximately
linear manner around $300^{\circ}K$, with a rate of
$-0.2\frac{\%}{{}^{\circ}K}$ to $-0.4\frac{\%}{{}^{\circ}K}$ according to
[46]. To investigate the temperature dependent behavior of the proposed TRNG
design, we simulated different temperatures while maintaining $R_{on}$
constant, and changing $R_{off}$ to produce a $TMR$ change with a linear rate
$0\frac{\%}{{}^{\circ}K}$ (i.e., constant $TMR$) (Figure 5(a)) and
$-0.4\frac{\%}{{}^{\circ}K}$ (Figure 5(b)).

If the $TMR$ rate is $0\frac{\%}{{}^{\circ}K}$, only the thermal fluctuations
are affected by the temperature change. In this case, a degradation in the
TRNG entropy is evident when the temperature deviates from $300^{\circ}K$. The
switching probability of the MTJs changes with the temperature (as can be seen
by the min-entropy in Figure 5(a) and as reported in other works [47, 48,
49]), but the Shannon-entropy of the TRNG output word remains high in the
examined temperature range.

If the $TMR$ rate is $-0.4\frac{\%}{{}^{\circ}K}$, the entropy of the TRNG is
better than in the $0\frac{\%}{{}^{\circ}K}$ case. When the temperature is
lower (higher) than $300^{\circ}K$, the resistance of $R_{off}$ increases
(decreases), resulting in a lower (higher) initial current through the MTJs
but with a longer (shorter) discharge time for the capacitor. The longer
(shorter) discharge time results in a longer (shorter) time for a non-
negligible switching probability current, which might negate the reduced
(increased) switching probability produced by the thermal fluctuations. These
two effects, the thermal fluctuations and the current waveform through the
MTJ, interact in a non-trivial way with the entropy due to their different
non-linear characteristics.

This analysis shows that the Shannon entropy of the proposed TRNG design
behaves well under temperature changes.

(a) min-entropy

(b) Shannon entropy

Figure 6: Effect of a constant external field in different angles and fixed
magnitude of 10 $k\frac{A}{m}$ on the entropy of a 6-bit TRNG. $\phi$ is the
angle of the field from the axis perpendicular to the MTJ plane, $\theta$ is
the in-plane angle from the magnetization of the fixed layer.

When considering the external magnetic field, a sufficiently high field can
reduce the entropy to $0$, as shown in Figure 5(b)-(c). Every device using
MTJs will be susceptible to a strong enough magnetic field, which can be
exploited by an adversary (see Section V for further discussion). When the
external magnetic field is perpendicular to the fixed layer magnetization (the
fixed layer magnetization of all MTJs are parallel), from the symmetry of the
MTJ the entropy is expected to be symmetrical around zero magnetic field, as
confirmed in Figures 5(c) and 5(d). Additionally, since an in-plane MTJ is
used, the external field perpendicular to the MTJ layers has little influence
on the entropy. Therefore, when designing the TRNG circuit, we would like to
position nearby wires in the same plane as the TRNG, and use vias as short as
possible and positioned as far from the TRNG as possible.

To further consider an external magnetic field, we simulated the effect for
other directions of the field relative to the fixed layer magnetization of the
MTJs. Figure 6 shows the effect of the direction of an external field with a
magnitude of $10k\frac{A}{m}$ on a 6-bit TRNG. The worst effect is for
approximately $\theta=45^{\circ}\backslash 315^{\circ}$, rather than in the
direction of the fixed-layer magnetization ($\theta=0^{\circ}\backslash
180^{\circ}$) or perpendicular to it ($\theta=90^{\circ}\backslash
270^{\circ}$). Figure 7 shows how an alternating external field applied from
multiple directions, with a fixed magnitude of $10k\frac{A}{m}$ and different
frequencies, affects a 6-bit TRNG. Since a field perpendicular to the MTJ
affects the entropy much less than other directions, the alternating field
simulation was limited only to the in-plane directions. Note that the Enable
step duration is $10ns$ (Table I), which corresponds to a $100MHz$ frequency.

An interesting result is that the performance under an alternating external
field in the range of $50MHz$ to $1GHz$ is actually better than the
performance under a constant external field. This implies that nearby circuits
at frequencies up to $1GHz$ will induce minimal performance loss. Another
observation is that an alternating external field above a certain frequency is
very effective. Countermeasures against external fields are discussed in
Section V.

####  IV-D3 Process Variation

Process variation in the TRNG will result in different switching probabilities
for the different MTJs, biasing some to switch with higher probabilities and
some with lower probabilities, resulting in bias for certain output words.
However, the i.i.d. property of the TRNG is not affected by process variation
(see Sections IV-B): it affects only the distribution of an output word but
not the dependencies between different output words. Hence, the methodology
presented in Section IV-A is used in this section as well.

(a) min-entropy

(b) Shannon entropy

Figure 7: Effect of an alternating external field on multiple in-plane
directions and fixed magnitude of 10 $k\frac{A}{m}$ on a 6-bit TRNG.

Variations in the MTJs and in the transistors operating in the Enable step
have been considered. Section IV-D1 shows that reasonable variation in
capacitor $C$ does not change the entropy; hence, $C$ is not considered for
process variation. For the transistors, we modeled variations in their fixed
resistance. For the MTJ, we modeled variations in the physical size of the
devices: major and minor axis length (the MTJ shape is an ellipse cylinder
[27]), the thickness of the free layer, and the thickness of the oxide layer
(tunnel barrier layer). We generated 1000 different instances for each TRNG
topology and their entropy was evaluated. The parameters were drawn
independently from a Gaussian distribution with mean as the designed value
(listed in Table I and in [27]) and a standard deviation of $5\%$ [50].

The geometry of the MTJ affects its demagnetization factors [27] and
resistance. The method presented in [51] was used to compute the new
demagnetization factors. The MTJ resistance is proportional to the exponent of
the oxide layer thickness ($t_{ox}$) and inversely proportional to its area
($A$) [50], i.e., $R_{on},R_{off}\propto\frac{e^{\rho\cdot t_{ox}}}{A}$
($\rho$ is a constant that depends on the device technology). The thickness of
the oxide layer appears in the simulation only as part of the MTJ resistance.
Since the oxide layer thickness and the coefficient $\rho$ are unavailable for
the simulated device, the process variation of the oxide layer was evaluated
as an additional variation in the MTJ resistance by a Gaussian distribution
with a standard deviation of $5\%$. The simulation results are listed in Table
III. The results show that the entropy per bit increases with the number of
MTJs, resulting in a twofold increase in the TRNG total entropy.

Even though most TRNG instances will have sufficiently high entropy under
process variation, some TRNG instances might still produce low entropy and be
unusable. To protect the TRNG from such an event, several TRNG instances
should be fabricated together. Fortunately, the largest area is consumed by
the capacitor $C$ and the sense amplifier (see Section IV-F), which can be
shared among the different fabricated MTJ modules (the implications of this
suggestion are not discussed in this paper). Thus, the process variation
robustness can be increased with a low area overhead.

###  IV-E Entropy Generating Rate

In many systems, a large number of entropy bits are required. In this case,
the entropy generating rate (entropy bits per second) is the desired
performance metric. Nevertheless, the TRNG is not required for the entire
operation of the system, since there is no need for random words most of the
time. The generating rate gives a notion of the delay time between starting
the TRNG and having the desired number of entropy bits, enabling the system to
react faster. Since many TRNG generated numbers are involved, the generating
rate refers to the Shannon entropy. The entropy generating rate is measured in
units of entropy bits per second, which is the amount of entropy produced by
the TRNG in a second.

TABLE III: Entropy results with process variation showing the average, standard deviation, median, and the 10th percentile | Shannon Entropy per Bit | Min-Entropy per Bit
---|---|---
$N$ | Avg. | sd | Med. | $P_{10}$ | Avg. | sd | Med. | $P_{10}$
2 | 0.74 | 0.19 | 0.76 | 0.46 | 0.46 | 0.21 | 0.47 | 0.17
4 | 0.79 | 0.12 | 0.80 | 0.64 | 0.51 | 0.14 | 0.51 | 0.33
6 | 0.82 | 0.08 | 0.83 | 0.72 | 0.54 | 0.10 | 0.55 | 0.41
8444For the 8-bit TRNG we simulated 6000 iterations. | 0.86 | 0.06 | 0.86 | 0.78 | 0.58 | 0.08 | 0.59 | 0.47

To determine the entropy generation rate, all three operation steps should be
considered. The Reset step duration is dominated by the capacitor charging
time. If we model the passgate $P1-N1$ connecting the capacitor to $V_{init}$
(Figure 2) as a resistor of $1.5K\Omega$, the capacitor charging time from
$0V$ to $0.79V$ (98.8%) is $66ns$. The duration of the Enable step is $10ns$
(Table I). In the Read step, the states of the MTJs are read using sense
amplifiers. If we take the read latency of $2.8ns$ reported by [52], an output
is produced every $78.8ns$.

For an 8-bit TRNG with process variation, $90\%$ of instances have an entropy
generation rate between $79.2Mbps$ and $101.5Mbps$. This rate can be improved
by terminating the Enable step earlier (as seen in Figure 5(a)) and by
reducing the charging time (since the capacitor is not fully discharged
immediately after an operation). For an 8-bit TRNG, the entropy generation
rate can be improved to $99.7-127.8Mbps$ for $90\%$ of the instances. However,
the actual generation rate of our proposed design depends on the system clock
used to measure the duration of the steps; the computed times represent the
best case.

###  IV-F Area and Energy

To estimate the area of the TRNG, we evaluate the area for each component in
the proposed circuit. The area of a single STT-MTJ device is $0.003\mu m^{2}$
[27]. To find the capacitor $C$ area, we modeled it as a MOS capacitor with
GlobalFoundries 28nm technology and obtained an area of $400\mu m^{2}$ using
Cadence Virtuoso. We evaluated the sense amplifier area from [52] as the
summed area of its transistors. All transistors were evaluated with a width of
$500nm$ and minimum length (transistor sizes are not specified in [52]). (This
size upper bounds the area of the transistors shown in Figure 2.) The
resulting area of an MTJ module is $0.395\mu m^{2}$. The sense amplifier in
[52] uses an additional capacitor, but its area is relatively small since the
read duration is $2.8ns$. Hence, each MTJ module area was approximated as
$0.6\mu m^{2}$. Table IV lists the TRNG area for different $N$.

Figure 8: The capacitor capacitance as a function of a generated assistance
magnetic field while preserving the entropy. The field is in the direction of
the fixed layer magnetization.

To reduce the area, the number of sense amplifiers can be lowered by reading
the MTJs sequentially or by sharing sense amplifiers with a nearby MTJ memory
array. However, the major area contributor is the capacitor $C$. Using a
capacitor other than a MOS capacitor to reduce the area is left as future
work. Alternatively, it is possible to lower the capacitance (and hence the
size of the capacitor) while maintaining the same switching distribution, but
this requires reducing the number of MTJs and\or using larger transistors
(reducing their resistance) to preserve the same current through the MTJs.
Another option is to use MTJ devices with a higher switching probability for
the same current (as done in [40, 41]), which will require a smaller capacitor
but will increase the sensitivity of the design to external magnetic fields. A
different option is to use a generated magnetic field by a dedicated wire,
similarly to the solution suggested in [53] for STT-MRAM memory. The magnetic
field will raise the switching probability; hence, a smaller current will be
needed to produce the same entropy, also resulting in a smaller capacitor.
Figure 8 shows the relationship between the generated magnetic field (in the
direction of the fixed layer magnetization) and the capacitor required to
achieve high entropy per bit (close to 1). Additionally, the generated
magnetic field might be dynamically adjusted to compensate for the effects of
process variation and parameter drift of the circuit. However, such a solution
might incur an area overhead and design complications. Precise analysis of
such a solution is left for future research.

The energy of the TRNG in the Reset and Read steps is for capacitor charging,
switching from P to AP of the MTJs (at the Reset step), and for the read
operation. The Enable step only uses the energy stored in the capacitor. The
energy required to charge the capacitor is the energy the capacitor holds,
$3.2pJ$, plus another $3.2pJ$ consumed on the passgate connected to it
(transistors $N1$ and $P1$ in Figure 2), for a passgate effective resistance
of $1.5K\Omega$ and Reset step time of $66ns$. The MTJs have a write energy of
$4.5pJ$ and a read energy of $0.7pJ$ [52]. Table IV lists the energy per bit
and power for different $N$.

###  IV-G Comparison to Other TRNGs

Table IV compares our proposed design with two different state-of-the-art CMOS
based TRNGs. The proposed TRNG has a high entropy generation rate and low
energy per bit as compared to CMOS TRNGs with a similar area and power.

The proposed TRNG is not compared with previously proposed STT-MTJ based TRNGs
since they used specially designed STT-MTJ devices or did not consider process
variation effects or external magnetic field effects (as discussed in Section
II-C).

Yang et al.’s [8] TRNG is based on ring oscillators with a 28nm CMOS process
node. The design of the TRNG includes several ROs, each controlling a 14-bit
counter to measure an event (private for each RO). The resulting counter is
random due to the noise in the RO and serves as the output. Only a subset of
the counter’s bits is used to produce a uniform distribution. This TRNG has
similar area and power as our proposed TRNG. The proposed 8-bit TRNG has
$4\times$ to $5\times$ higher entropy rate, and $3\times$ to $4\times$ better
energy per bit than the TRNG of Yang et al. [8].

Srinivasan et al.’s [9] TRNG is based on a metastable latch with a 45nm CMOS
process node. It has $10\times$ larger area and consumes $10\times$ more
power. The metastable latch TRNG is $20\times-24\times$ faster and consumes
$2\times-2.6\times$ less energy per bit than our 8-bit proposed design.
Nevertheless, the design proposed by Srinivasan et al. [9] generates a single
random bit every clock cycle, requiring the use of a $2.4GHz$ clock to achieve
the high entropy rate. The use of a high rate clock and the relatively large
area make this design impractical for low-power and low-frequency devices.

##  V Dealing with an Adversary

Consider an attack model where the attacker can change the environmental
conditions of the TRNG. For example, the attacker can place a fixed magnet in
proximity to the TRNG to control the external magnetic field, or use an
antenna, or remotely control a circuit close to the TRNG (such as a
processor). However, we assume that the adversary does not have physically
invasive access.

TABLE IV: Comparison of entropy generation rate, area, energy, and power of the proposed TRNG666The numbers for the proposed TRNG are presented for 90% of instances and for the highest generating rate. with CMOS TRNGs |  Entropy Generation Rate $[Mb/s]$ |  Area $[\mu m^{2}]$ |  Energy per bit $[\frac{pJ}{entropy\shortminus bit}]$ |  Power $[mW]$
---|---|---|---|---
2-bit TRNG | 15.4-33.4 | 401.2 | 6.16-13.4 | 0.2
4-bit TRNG | 40.9-63.8 | 402.4 | 5.9-9.2 | 0.38
6-bit TRNG | 66.7-92.7 | 403.6 | 5.8-8.0 | 0.54
8-bit TRNG | 94.0-120.6 | 404.8 | 5.7-7.3 | 0.7
Yang et al. [8] | 23.16 | 375 | 23 | 0.54
Srinivasan et al. [9] | 2400 | 4004 | 2.9 | 7

Temperature has little effect on the TRNG (Section IV-D2) and therefore is not
an interesting attack venue. On the other hand, the external magnetic field on
the TRNG can decrease the entropy substantially. Passive shielding can
mitigate the effect of an external field. Prior work [54, 55, 56] on passive
shielding demonstrated this for MTJ-based memories.

A different approach to interference is detection. This can be done using
online tests that check for a certain amount of randomness. Once the
randomness is below a specific threshold, an error should be sent to the
operating entity, informing it of nearby interference or an ongoing attack.
This solution will not prevent the attack, but it might convert it to a
denial-of-service attack.

##  VI Conclusions

In this paper, we presented an asynchronous TRNG that utilizes the random
switching time of STT-MTJ devices. The TRNG was comprehensively evaluated in
simulations using the physical equations describing the STT-MTJs. The
evaluation showed that by increasing the number of STT-MTJs in the design, the
TRNG can have greater entropy per output and better resilience to process
variation. Furthermore, the design achieves better throughput than current
CMOS TRNGs, with lower energy per bit and similar die area and power
dissipation. However, MTJ devices are susceptible to attacks controlling the
external magnetic field, requiring the use of additional countermeasures.

## References

  * [1] D. Eastlake, J. Schiller, and S. Crocker, “RFC4086: Randomness Requirements for Security,” June 2005, accessed: January 2018. [Online]. Available: https://tools.ietf.org/html/rfc4086
  * [2] A. J. Menezes, P. C. V. Oorschot, and S. A. Vanstone, _”Handbook of Applied Cryptography”_. CRC Press, 1996\.
  * [3] I. Goldberg and D. Wagner, “Randomness and the Netscape Browser,” January 1996, accessed: January 2018. [Online]. Available: https://people.eecs.berkeley.edu/~daw/papers/ddj-netscape.html
  * [4] Z. Gutterman, B. Pinkas, and T. Reinman, “Open to Attack: Vulnerabilities of the Linux Random Number Generator.” Black Hat, July 2006. [Online]. Available: https://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Gutterman.pdf
  * [5] J. Kelsey, B. Schneier, D. Wagner, and C. Hall, “Cryptanalytic Attacks on Pseudorandom Number Generators,” in _Proceedings of the 5th International Workshop on Fast Software Encryption_ , 1998, pp. 168–188.
  * [6] C. K. Koc, _Cryptographic Engineering_. Springer Publishing Company, Incorporated, 2008.
  * [7] S. Bhunia and M. Tehranipoor, “Chapter 12 - hardware security primitives,” in _Hardware Security_ , S. Bhunia and M. Tehranipoor, Eds. Morgan Kaufmann, 2019, pp. 311 – 345. [Online]. Available: http://www.sciencedirect.com/science/article/pii/B9780128124772000174
  * [8] K. Yang, D. Fick, M. B. Henry, Y. Lee, D. Blaauw, and D. Sylvester, “16.3 A 23Mb/s 23pJ/b Fully Synthesized True-Random-Number Generator in 28nm and 65nm CMOS,” in _2014 IEEE International Solid-State Circuits Conference Digest of Technical Papers (ISSCC)_ , February 2014, pp. 280–281.
  * [9] S. Srinivasan, S. Mathew, R. Ramanarayanan, F. Sheikh, M. Anders, H. Kaul, V. Erraguntla, R. Krishnamurthy, and G. Taylor, “2.4GHz 7mW All-Digital PVT-Variation Tolerant True Random Number Generator in 45nm CMOS,” in _2010 Symposium on VLSI Circuits_ , June 2010, pp. 203–204.
  * [10] H. Akinaga and H. Shima, “Resistive Random Access Memory (ReRAM) Based on Metal Oxides,” _Proceedings of the IEEE_ , vol. 98, no. 12, pp. 2237–2251, December 2010.
  * [11] H.-S. P. Wong, S. Raoux, S. Kim, J. Liang, J. P. Reifenberg, B. Rajendran, M. Asheghi, and K. E. Goodson, “Phase Change Memory,” _Proceedings of the IEEE_ , vol. 98, no. 12, pp. 2201–2227, December 2010.
  * [12] H. . P. Wong, H. Lee, S. Yu, Y. Chen, Y. Wu, P. Chen, B. Lee, F. T. Chen, and M. Tsai, “Metal-Oxide RRAM,” _Proceedings of the IEEE_ , vol. 100, no. 6, pp. 1951–1970, June 2012.
  * [13] M. Wang, W. Cai, K. Cao, J. Zhou, J. Wrona, S. Peng, H. Yang, J. Wei, W. Kang, Y. Zhang, J. Langer, B. Ocker, A. Fert, and W. Zhao, “Current-Induced Magnetization Switching in Atom-Thick Tungsten Engineered Perpendicular Magnetic Tunnel Junctions With Large Tunnel Magnetoresistance,” _Nature Communications_ , vol. 9, no. 671, February 2018.
  * [14] G. Hu, J. H. Lee, J. J. Nowak, J. Z. Sun, J. Harms, A. Annunziata, S. Brown, W. Chen, Y. H. Kim, G. Lauer, L. Liu, N. Marchack, S. Murthy, E. J. O’Sullivan, J. H. Park, M. Reuter, R. P. Robertazzi, P. L. Trouilloud, Y. Zhu, and D. C. Worledge, “Stt-mram with double magnetic tunnel junctions,” in _2015 IEEE International Electron Devices Meeting (IEDM)_ , Dec 2015, pp. 26.3.1–26.3.4.
  * [15] T. Devolder, J. Hayakawa, K. Ito, H. Takahashi, S. Ikeda, P. Crozat, N. Zerounian, J.-V. Kim, C. Chappert, and H. Ohno, “Single-Shot Time-Resolved Measurements of Nanosecond-Scale Spin-Transfer Induced Switching: Stochastic Versus Deterministic Aspects,” _Physical Review Letters_ , vol. 100, p. 057206, February 2008.
  * [16] E. I. Vatajelu, G. D. Natale, and P. Prinetto, “STT-MTJ-Based TRNG with On-The-Fly Temperature/Current Variation Compensation,” in _2016 IEEE 22nd International Symposium on On-Line Testing and Robust System Design (IOLTS)_ , July 2016, pp. 179–184.
  * [17] A. Fukushima, T. Seki, K. Yakushiji, H. Kubota, H. Imamura, S. Yuasa, and K. Ando, “Spin Dice: A Scalable Truly Random Number Generator Based on Spintronics,” _Applied Physics Express_ , vol. 7, no. 8, p. 083001, 2014\.
  * [18] S. Oosawa, T. Konishi, N. Onizawa, and T. Hanyu, “Design of an STT-MTJ Based True Random Number Generator Using Digitally Controlled Probability-Locked Loop,” in _2015 IEEE 13th International New Circuits and Systems Conference (NEWCAS)_ , June 2015, pp. 1–4.
  * [19] Y. Qu, J. Han, B. F. Cockburn, W. Pedrycz, Y. Zhang, and W. Zhao, “A True Random Number Generator Based on Parallel STT-MTJs,” in _Design, Automation Test in Europe Conference Exhibition (DATE), 2017_ , March 2017, pp. 606–609.
  * [20] Y. Wang, H. Cai, L. A. B. Naviner, J. Klein, J. Yang, and W. Zhao, “A Novel Circuit Design of True Random Number Generator Using Magnetic Tunnel Junction,” in _2016 IEEE/ACM International Symposium on Nanoscale Architectures (NANOARCH)_ , July 2016, pp. 123–128.
  * [21] S. Ghosh, “Spintronics and Security: Prospects, Vulnerabilities, Attack Models, and Preventions,” _Proceedings of the IEEE_ , vol. 104, no. 10, pp. 1864–1893, October 2016.
  * [22] E. Barker and J. Kelsey, “Recommendation for Random Number Generation Using Deterministic Random Bit Generator,” NIST, Tech. Rep. SP 800-90A Revision 1, June 2015.
  * [23] W. Kan, “Analysis of Underlying Assumptions in NIST DRBGs,” _IACR Cryptology ePrint Archive_ , vol. 2007, p. 345, 2007.
  * [24] Y. Lao, Q. Tang, C. H. Kim, and K. K. Parhi, “Beat Frequency Detector–Based High-Speed True Random Number Generators: Statistical Modeling and Analysis,” _Journal on Emerging Technologies in Computing Systems_ , vol. 13, no. 1, pp. 9:1–9:25, April 2016.
  * [25] S. P. Vadhan, “Pseudorandomness,” _Foundations and Trends® in Theoretical Computer Science_ , vol. 7, no. 1–3, pp. 1–336, 2012.
  * [26] S.-H. Kwok, Y.-L. Ee, G. Chew, K. Zheng, K. Khoo, and C.-H. Tan, “A Comparison of Post-Processing Techniques for Biased Random Number Generators,” in _Information Security Theory and Practice. Security and Privacy of Mobile Devices in Wireless Communication_ , C. A. Ardagna and J. Zhou, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2011, pp. 175–190.
  * [27] A. F. Vincent, N. Locatelli, J. O. Klein, W. S. Zhao, S. Galdin-Retailleau, and D. Querlioz, “Analytical Macrospin Modeling of the Stochastic Switching Time of Spin-Transfer Torque Devices,” _IEEE Transactions on Electron Devices_ , vol. 62, no. 1, pp. 164–170, January 2015.
  * [28] J. C. Slonczewski, “Conductance and Exchange Coupling of two Ferromagnets Separated by a Tunneling Barrier,” _Physical Review B_ , vol. 39, pp. 6995–7002, April 1989.
  * [29] T. L. Gilbert, “A Phenomenological Theory of Damping in Ferromagnetic Materials,” _IEEE Transactions on Magnetics_ , vol. 40, no. 6, pp. 3443–3449, November 2004.
  * [30] J. L. García-Palacios and F. J. Lázaro, “Langevin-dynamics Study of the Dynamical Properties of Small Magnetic Particles,” _Physical Review B_ , vol. 58, pp. 14 937–14 958, December 1998.
  * [31] J. Slonczewski, “Current-Driven Excitation of Magnetic Multilayers,” _Journal of Magnetism and Magnetic Materials_ , vol. 159, no. 1, pp. L1 – L7, 1996.
  * [32] D. M. Apalkov and P. B. Visscher, “Spin-Torque Switching: Fokker-Planck Rate Calculation,” _Physical Review B_ , vol. 72, p. 180405, November 2005\.
  * [33] Z. Li and S. Zhang, “Thermally Assisted Magnetization Reversal in the Presence of a Spin-Transfer Torque,” _Physical Review B_ , vol. 69, p. 134416, April 2004.
  * [34] J. Z. Sun, “Spin-Current Interaction With a Monodomain Magnetic Body: A Model Study,” _Physical Review B_ , vol. 62, pp. 570–578, July 2000.
  * [35] Y. Zhang, W. Zhao, Y. Lakys, J. O. Klein, J. V. Kim, D. Ravelosona, and C. Chappert, “Compact Modeling of Perpendicular-Anisotropy CoFeB/MgO Magnetic Tunnel Junctions,” _IEEE Transactions on Electron Devices_ , vol. 59, no. 3, pp. 819–826, March 2012.
  * [36] H. Jiang, D. Belkin, S. E. Savel’ev, S. Lin, Z. Wang, Y. Li, S. Joshi, R. Midya, C. Li, M. Rao, M. Barnell, Q. Wu, J. J. Yang, and Q. Xia, “A Novel True Random Number Generator Based on a Stochastic Diffusive Memristor,” _Nature Communications_ , vol. 8, no. 882, October 2017.
  * [37] T. Zhang, M. Yin, C. Xu, X. Lu, X. Sun, Y. Yang, and R. Huang, “High-Speed True Random Number Generation Based on Paired Memristors for Security Electronics,” _Nanotechnology_ , vol. 28, no. 45, p. 455202, 2017.
  * [38] Y. Wang, W. Wen, H. Li, and M. Hu, “A Novel True Random Number Generator Design Leveraging Emerging Memristor Technology,” in _Proceedings of the 25th Edition on Great Lakes Symposium on VLSI_. ACM, 2015, pp. 271–276.
  * [39] Y. Qu, B. F. Cockburn, Z. Huang, H. Cai, Y. Zhang, W. Zhao, and J. Han, “Variation-Resilient True Random Number Generators Based on Multiple STT-MTJs,” _IEEE Transactions on Nanotechnology_ , vol. 17, no. 6, pp. 1270–1281, November 2018.
  * [40] H. Lee, F. Ebrahimi, P. K. Amiri, and K. L. Wang, “Design of High-Throughput and Low-Power True Random Number Generator Utilizing Perpendicularly Magnetized Voltage-Controlled Magnetic Tunnel Junction,” _AIP Advances_ , vol. 7, no. 5, p. 055934, 2017.
  * [41] D. Vodenicarevic, N. Locatelli, A. Mizrahi, J. S. Friedman, A. F. Vincent, M. Romera, A. Fukushima, K. Yakushiji, H. Kubota, S. Yuasa, S. Tiwari, J. Grollier, and D. Querlioz, “Low-Energy Truly Random Number Generation with Superparamagnetic Tunnel Junctions for Unconventional Computing,” _Physical Review Applied_ , vol. 8, p. 054045, November 2017.
  * [42] A. Rukhin, J. Soto, J. Nechvatal, M. Smid, E. Barker, S. Leigh, M. Levenson, M. Vangel, D. Banks, A. Heckert, J. Dray, and S. Vo, “A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications,” NIST, Tech. Rep. SP 800-22 rev. 1a, April 2010.
  * [43] R. Renner and S. Wolf, “Simple and Tight Bounds for Information Reconciliation and Privacy Amplification,” in _Proceedings of the 11th International Conference on Theory and Application of Cryptology and Information Security_ , ser. ASIACRYPT’05. Berlin, Heidelberg: Springer-Verlag, 2005, pp. 199–216.
  * [44] T. Holenstein and R. Renner, “On the Randomness of Independent Experiments,” _IEEE Transactions on Information Theory_ , vol. 57, no. 4, pp. 1865–1871, April 2011.
  * [45] M. d’Aquino, C. Serpico, G. Coppola, I. D. Mayergoyz, and G. Bertotti, “Midpoint Numerical Technique for Stochastic Landau-Lifshitz-Gilbert Dynamics,” _Journal of Applied Physics_ , vol. 99, no. 8, p. 08B905, 2006\.
  * [46] V. Drewello, J. Schmalhorst, A. Thomas, and G. Reiss, “Evidence for strong magnon contribution to the TMR temperature dependence in MgO based tunnel junctions,” _Phys. Rev. B_ , vol. 77, p. 014440, Jan 2008.
  * [47] Y. Wang, H. Cai, L. Naviner, Y. Zhang, J. Klein, and W. Zhao, “Compact thermal modeling of spin transfer torque magnetic tunnel junction,” _Microelectronics Reliability_ , vol. 55, no. 9, pp. 1649 – 1653, 2015, proceedings of the 26th European Symposium on Reliability of Electron Devices, Failure Physics and Analysis.
  * [48] E. I. Vatajelu, G. Di Natale, and P. Prinetto, “Security primitives (PUF and TRNG) with STT-MRAM,” in _2016 IEEE 34th VLSI Test Symposium (VTS)_ , April 2016, pp. 1–4.
  * [49] M. N. I. Khan, A. S. Iyengar, and S. Ghosh, “Novel Magnetic Burn-In for Retention and Magnetic Tolerance Testing of STTRAM,” _IEEE Transactions on Very Large Scale Integration (VLSI) Systems_ , vol. 26, no. 8, pp. 1508–1517, Aug 2018.
  * [50] J. Li, C. Augustine, S. Salahuddin, and K. Roy, “Modeling of Failure Probability and Statistical Design of Spin-torque Transfer Magnetic Random Access Memory (STT MRAM) Array for Yield Enhancement,” in _Proceedings of the 45th Annual Design Automation Conference_ , ser. DAC ’08. ACM, 2008, pp. 278–283.
  * [51] D. Goode and G. Rowlands, “The Demagnetizing Energies of a Uniformly Magnetized Cylinder with an Elliptic Cross-Section,” _Journal of Magnetism and Magnetic Materials_ , vol. 267, no. 3, pp. 373 – 385, 2003.
  * [52] Q. Dong, Z. Wang, J. Lim, Y. Zhang, Y. C. Shih, Y. D. Chih, J. Chang, D. Blaauw, and D. Sylvester, “A 1Mb 28nm STT-MRAM with 2.8ns Read Access Time at 1.2V VDD Using Single-Cap Offset-Cancelled Sense Amplifier and in-situ Self-Write-Termination,” in _2018 IEEE International Solid-State Circuits Conference - (ISSCC)_ , February 2018, pp. 480–482.
  * [53] R. Patel, X. Guo, Q. Guo, E. Ipek, and E. G. Friedman, “Reducing Switching Latency and Energy in STT-MRAM Caches With Field-Assisted Writing,” _IEEE Transactions on Very Large Scale Integration (VLSI) Systems_ , vol. 24, no. 1, pp. 129–138, January 2016.
  * [54] K. Yamada, “Anisotropic Magnetic Shielding Effectiveness of Magnetic Shielded Package,” _IEEE Transactions on Magnetics_ , vol. 53, no. 11, pp. 1–4, November 2017.
  * [55] W. Wang and Z. Jiang, “Magnetic Shielding Design for Magneto-Electronic Devices Protection,” _IEEE Transactions on Magnetics_ , vol. 44, no. 11, pp. 4175–4178, November 2008.
  * [56] E. Paperno, H. Koide, and I. Sasada, “Charts for Estimating the Axial Shielding Factors for Triple-Shell Open-Ended Cylindrical Shields,” _IEEE Transactions on Magnetics_ , vol. 37, no. 4, pp. 2881–2883, July 2001\.

|  Ben Perach received the B.Sc. degree in mathematics from The Hebrew
University of Jerusalem in 2010 and the M.Sc. degree in electrical engineering
from Tel Aviv University in 2017. He is currently working toward his Ph.D.
degree in electrical engineering at the Technion – Israel Institute of
Technology, Haifa, Israel. His current research interests include computer
architecture with a focus on processor design, and also field-programmable
gate arrays, security, and data networks.
---|---
|  Shahar Kvatinsky is an assistant professor at the Andrew and Erna Viterbi
Faculty of Electrical Engineering, Technion – Israel Institute of Technology.
He received the B.Sc. degree in computer engineering and applied physics and
an MBA degree in 2009 and 2010, respectively, both from the Hebrew University
of Jerusalem, and the Ph.D. degree in electrical engineering from the Technion
– Israel Institute of Technology in 2014. From 2006 to 2009 he was with Intel
as a circuit designer and was a post-doctoral research fellow at Stanford
University from 2014 to 2015. Kvatinsky is an editor of Microelectronics
Journal and has been the recipient of the 2015 IEEE Guillemin-Cauer Best Paper
Award, 2015 Best Paper of Computer Architecture Letters, Viterbi Fellowship,
Jacobs Fellowship, ERC starting grant, the 2017 Pazy Memorial Award, the 2014
and 2017 Hershel Rich Technion Innovation Awards, 2013 Sanford Kaplan Prize
for Creative Management in High Tech, 2010 Benin prize, and seven Technion
excellence teaching awards. His current research is focused on circuits and
architectures with emerging memory technologies and design of energy efficient
architectures.
---|---