Coded Modulation and Shaping for Multivalued Physical Unclonable Functions

In this paper, a coded modulation scheme employing signal shaping is proposed and designed for use in multi-valued physical unclonable functions (PUFs). In the literature, usually binary PUFs are considered, where less than one bit of entropy is extracted from each fundamental building block (PUF node). This randomness in the hardware may then be used for the derivation of cryptographic keys. Meanwhile, PUFs over higher-order alphabets, so-called multi-valued PUFs (MVPUFs) have been presented. Typically, symbols from a higher-order alphabet are extracted by suited quantization. In contrast, in this paper we propose a coded modulation scheme which directly works on the analog values provided by the PUF nodes. We establish an interpretation as digital transmission with randomness at the transmitter, and thereon calculate the respective capacities of bit levels for the Gaussian distributed reference PUF readout in additive Gaussian noise. In addition, the metric for optimum soft-decision decoding is derived. Thereby, the coded modulation scheme can be designed for the present situation. A helper data scheme adapted to the given situation is proposed and analyzed. Moreover, on top of the multilevel coding scheme, we employ signal shaping for the first time in the context of PUFs. In particular, trellis shaping is applied. By this, the coded modulation scheme can be perfectly matched to the PUF statistics. This is reflected by the results of conducted numerical simulations. High coding rates can be used, i.e., a large entropy per PUF node can be extracted, with very high reliabilities.

keys. It is impossible to produce a PUF that generates a 23 pre-determined readout. We address so-called ''weak'' PUFs, 24 where a unique fingerprint is delivered based on the prop-25 erties of the hardware. In contrast, in ''strong'' PUFs the 26 response is dependent on a challenge. 27 Since the exploited randomness is static over the PUFs 28 lifetime, a PUF can be interpreted as an implicit key stor-29 age. However, extracted PUF readouts slightly vary due to 30 external conditions like, e.g., changes of temperature. Thus, 31 The associate editor coordinating the review of this manuscript and approving it for publication was Zesong Fei . error-correcting codes are mandatory to guarantee the sta-32 bility of the final keys. Helper data schemes are used to 33 map a readout to a codeword to enable error correction. The 34 most prominent scheme for this approach is the code-offset 35 algorithm [1], [2], [3]. 36 Most often, PUFs that produce binary readouts are consid-37 ered in the literature, even when based on an analog source. 38 Traditionally, a PUF node 1 is modeled as a binary symmetric 39 channel (BSC) with a fixed bit error probability, see, e.g., 40 [8], [9], [10]. Various studies revealed that for some PUF 41 constructions this assumption is too pessimistic, and more 42 In contrast to the schemes discussed above, our approach 102 is to directly utilize the analog, non-quantized output of a 103 PUF node. The term ''multi-valued'' is then used synony-104 mously for extracting more than one bit of entropy per PUF 105 node. This is done implicitly by the (soft-decision) decoding 106 procedure and not by quantization. To that end, we interpret 107 the readout process in PUFs as digital transmission schemes 108 (cf. [5, Fig. 6]) and, based on that interpretation, coded mod-109 ulation/signal shaping are applied. 110 The contribution of the present paper is as follows: 111 i) We establish an interpretation as digital transmission 112 with randomness at the transmitter. Based on this, the capac-113 ities of the bit levels for the Gaussian distributed reference 114 PUF readout in additive Gaussian noise are calculated and the 115 sum capacity, which is the ultimate limit for the information 116 rate which can be extracted, are derived. Thereby, the differ-117 ences to conventional digital transmission (as used in [5]) are 118 enlightened and the design of the coded modulation scheme 119 can be matched to the present situation. This also includes the 120 derivation of the metric for optimum soft-decision decoding. 121 ii) A new helper data scheme, which operates with the 122 shaping scheme, is proposed and its security is analyzed. 123 iii) A coded modulation scheme with signal shaping [31] 124 is presented; specifically, as an initial example, multilevel 125 codes [32], [33] in combination with trellis shaping [34] are 126 employed. For the first time, signal shaping 2 is applied in 127 the context of PUFs. By this, the (envisaged) useful signal 128 is Gaussian distributed and, thus, reflects the statistics of 129 the actual PUF readout. As an alternative to signal shaping, 130 uniform signaling with a non-uniformly spaced constellation 131 is employed. Please note that the paper focuses on the theo-132 retical interpretation and capacity limits, and the proposal of 133 a particular well-suited coded modulation/shaping scheme. 134 A comprehensive comparision with other coded modula-135 tion/shaping schemes is part of future research. Moreover, 136 attacks and hardware/implementation aspects such as long-137 term stability/reliabilty of the PUF cells are beyond the scope 138 of the paper. 139 The paper is structured as follows: Sec. II reviews 140 MVPUFs based on ring oscillators and the statistics of the 141 analog readout. A new helper data scheme for coded mod-142 ulation is proposed and its security is proven. In Sec. III, 143 a new interpretation as digital transmission scheme is given; 144 signal and channel model are established and coded modula-145 tion/shaping schemes are designed. To that end, the capacities 146 of the coding levels are studied. Sec. IV presents results from 147 numerical simulations. The statements derived in Sec. III 148 based on capacity arguments are covered by word-error-rate 149 2 The approach of using a prefix-free variable-lenghth code proposed in [19] can be interpreted ( 154 We consider PUF architectures, where access to an analog, 155 i.e., real-valued, physical quantity is possible. A particular 156 example are ring oscillator PUFs (ROPUFs), introduced zero-mean Gaussian with variance σ 2 r = 1.

186
Given a particular PUF node, repeated readouts will not 187 give exactly the same real number of the nominal frequency. 188 Instead, over a wide range of physical conditions (e.g., the 189 environmental temperature), the readout is given as its nom- Combining the readouts r i , i = 1, . . . , n, of n 201 PUF nodes into a vector, we have the readout word 4 202 r = [r 1 , . . . , r n ] T ∈ R n , which is given by (1) 204 Thereby, we assume that the elements of the vectors are i.i.d., 205 i.e., all PUF nodes are independent of each other and have 206 the same statistics. 5 All processing and coding is done on this 207 PUF readout. 208 We remark, that the subsequent discussion is based on this 209 generic model. It might not be restricted to ROPUFs [3] or the syndrome construction [2], [3], 225 are applied. Also pointer-based schemes [39], [40], [41], 226 which store pointers to reliable PUF nodes, hence, improving 227 the overall channel, have been proposed. Schemes, based on 228 the code-offset algorithm, which are suited for M -ary signal-229 ing are given in [5].

230
In view of the coded modulation/shaping scheme to be 231 discussed in Sec. III, a different approach is required. To that 232 end, Fig. 1 visualizes the processing in the two phases initial-233 ization and reproduction.  We distinguish quantities from the set of real numbers R (conventional font) and variables over the binary field F 2 (fraktur font, e.g., m i = 0). Vectors over the finite field, e.g., m, are, as usual in channel coding, row vectors. 7 The operation of P can also be seen as steering the multiplexer which addresses the ring oscillators in the readout circuit, cf. [5, Fig. 1]. However, all predetermined PUF nodess are used; no selection based on some reliability criterion is employed. deterministic function of a. Within the groups of equal mag-283 nitude (dashed lines), a further (random, unsigned) permuta-284 tion is done; the respective permutation matrix P b has block 285 diagonal structure.

286
On the other hand, the elements of the reference readout are 287 sorted ascending according to their magnitude (signed per-288 mutation matrix P r ). Both sorted versions, P b P a a and P r r ref , 289 respectively, provide the best match. Since the processed PUF 290 readout y in the reproduction phase should mimic a (noisy) 291 codeword in signal space, the best choice for the requested 292 signed permutaion matrix P is going the cascade from bottom 293 to top. As the inverse of a (signed) permutation matrix is its 294 transpose, the cascade 295 P = P T a P T b P r (2) 296 permutes and possibly inverts the elements in the requested 297 way and establishes the entire permutation matrix.  We now analyze the security of the proposed HDS. 311 As described above, the k-bit message m is chosen uniformly 312 at random. Encoding (and mapping) is a one-to-one function 313 and gives a = ENC(m). The matrix P a is chosen deter-314 ministically based on a, the matrix P b is chosen randomly, 315 VOLUME 10, 2022 only depending on the frequencies of the magnitudes, and the 316 matrix P r is chosen deterministically based on r ref . 317 1) DECODABILITY 318 We first show that knowing the PUF readout r ref (ideal, noise-319 free case) and the helper data H = P the message is known.

320
To that end, we study the mutual information I(·; ·) [38] and 343 where ( * ) holds since P a is a determinisitc function of a. 344 Hence, we finally have

362
In classical PUFs, the analog readout would be quantized; 363 all x ≥ 0 are said to represent a binary 1 and all x < 0 a 364 binary 0. A hard-decision decoder for the employed binary 365 channel code is run to produce the estimated messagem.

366
Using soft-decision, i.e., directly the analog readout, the 367 situation changes. The straightforward approach, also taken 368 in [5], is to consider the PUF readout as a noisy version 369 of a binary phase-shift keying (BPSK) signal, calculating 370 log-likelihood ratios (LLRs) as for BPSK over the AWGN 371 channel, and using these as the input to a soft-input decoder. 372 Even though the performance is very good, this is not the 373 optimum procedure (see [5, Footnote 6]). Going to higher-374 order constellations and, consequently, to coded modulation, 375 the mismatch between the PUF statistics and that of employed 376 code becomes even more severe.

377
In order to derive the optimum decoding metric and a suited 378 design of the coded modulation/shaping scheme, a close look 379 at the signal model has to be taken. To that end, in Fig. 3, 380 the situation in PUFs (Gaussian readout, left) and conven-381 tional M -ary ASK signaling with a sclaed (factor s) version 382 of A = {±1, ±3, . . . , ±(M − 1)} (right) are compared. 383 In BPSK (2-ary ASK) signaling, the binary 1 may be rep-384 resented by the real number +1; the binary 0 by −1. The 385 probability density function (pdf) is discrete; visualized with 386 Dirac deltas. Considering the Gaussian PUF readout, a binary 387 1 is represented by any real number larger or equal to zero, 388 i.e., any number from the region R 1 = {x | x ≥ 0}, 389 and a binary 0 is represented by any real number smaller 390 than zero, i.e., from the region R 0 = {x | x < 0}. 391 The binary information is thus not represented by a single 392 real number, but can be seen as being randomly (following 393 the Gaussian distribution within the region) drawn from the 394 region, which corresponds to the binary information which 395 should be communicated. Hence, similar as in schemes for 396 physical-layer security [42], randomness at the transmitter is 397 present.

398
This principle generalizes to higher-order (M -ary) modu-399 lation schemes. In 4-ary ASK signaling, bit pairs are repre-400 sented by 4 amplitude levels, i.e., the constellation {±s, ±3s} 401 is used. Thereby, s is chosen to adjust the transmit power. 402 Considering the PUF readout, the bit pairs are represented 403 by the regions respectively. Given the bit pair to be communicated, the actual 406 number which is used for transmission is drawn according to 407 the Gaussian pdf within the respective region.

408
Employing 8-ary signaling, eight regions (R 000 up to 409 R 111 ) are defined in the same way (cf. Fig. 3). In con-410 trast, 8-ary ASK with signal shaping, i.e., with an imposed 411 non-uniform probability distribution (visualized by the 412 heights of the Dirac pulses), has eight discrete amplitude 413 levels.

414
Note that in each case we employ natural labeling where 415 the signal points/regions are numbered in order. For the 416 present setting of one-dimensional constellations this is iden-417 tical to labeling according to set partitioning [43]. e.g., [50], and for signal shaping [31].

430
Using signal constellations of large size, the combina-431 tion of coded modulation and shaping is straightforward as 432 they operate on different bits labeling the signal points [33], 433 [34]. This leads to a great flexibility; any kind of (compo- codelength n is identical to the number of PUF nodes which 452 are treated jointly, the index equivalently enumerates the PUF 453 nodes.

454
The message word m ∈ {0, 1} k of k information symbols 455 is partitioned into 3 = log 2 (8) words u 0 , u 1 , and u 2 of length 456 k 0 , k 1 , and n/2, respectively. To that end k 0 +k 1 +n/2 = k has 457 to hold; the rate of the coded modulation scheme is R = k/n. 458 The words u 0 and u 1 are encoded individually (into the words 459 c 0 and c 1 ) using binary error-correcting codes with code-460 length n and rates R 0 = k 0 /n and R 1 = k 1 /n, respectively.

461
Trellis shaping, here in the form of sign-bit shaping [34], is 462 preferably based on two-dimensional (QAM) constellations. 463 Consequently, for the operation of shaping two consecutive 464 time steps are combined. Coding works on words of length 465 n and one-dimensional symbols, shaping on words of length 466 n/2 and two-dimensional symbols; a QAM constellation is 467 generated by combining two ASK constellations.

468
In trellis shaping, the words u 2 and w are together scram-469 bled in the scrambler 8 S(D), which is a linear dispersive 470 system over the finite field F 2 with two in-and outputs. 471 The two generated binary symbols s 1 and s 2 establish the 472 most significant address bits. Using the 8-ary ASK mapping 473 a = sM(c 2 c 1 c 0 ) which maps the bit triples to a signal point 474 (as indicated in the right bottom part of Fig. 3) twice, four 475 coded bits and the two shaping bits are mapped to two ASK 476 signal points. This procedure is visualized in Fig. 5.

477
The task of a shaping encoder (not shown in Fig. 4) 478 is, knowing u 0 , u 1 , and u 2 , to select the n/2-bit word w 479 Using the above proposed shaping scheme, the probabilities 525 of the signal points a reflect the probabilities within the asso-526 ciated region. By this, a good match between the statistics of 527 the PUF readout and that of the transmit symbols in the coded 528 modulation scheme is achieved.

529
However, a similar match can be attained if the regions 530 are defined such that they are used with equal probabilities, 531 cf., e.g., [4], [20]. Fig. 6 compares the regions with uniform 532 width (except the outer ones) but non-uniform probabilities 533 used up to now (top, shaping) with regions with non-uniform 534 width but uniform probabilities (bottom). The corresponding 535 ASK constellation is non-equidistantly spaced which can be 536 achieved by non-linear distortion, so-called warping, of a 537 regular ASK constellation [31]. For details see the appendix. 538 FIGURE 6. Regions of the pdf of the PUF readout of equal width but non-uniform probabilities and corresponding non-uniform ASK constellation (top, situation when employing shaping) and regions with non-uniform width but uniform probabilities and corresponding warped ASK constellation (bottom, uniform signaling). 8-ary schemes.
The regions of an M -ary scheme, i.e., the limits l i , are 539 chosen such that Hence, no degree of freedom for optimization is present.

542
The block diagram of the transmitter is depicted in Fig. 7 543 for an 8-ary scheme. M w denotes the mapping of the binary 544 triples to the warped 8-ary ASK constellation. The binary 545 codes on the coding levels are encoded individually, result-546 ing in signal points that are used with uniform probabilities. 547 Decoding is done with multistage decoding (cf. bottom of 548 Fig. 4) with three component decoders.
where C(R c l ...c 0 ) denotes the capacity of the AWGN chan-

597
Given the scaling factor s, for 4, 8, and 16-ary signaling the 598 signal-to-noise ratio (in dB) 10 log 10 (1/σ 2 e ) which is required 599 to achieve a desired capacity is calculated (in the best case the 600 rate R of the coding scheme can be equal to the capacity). 601 In view of the shaping scheme depicted in Fig. 5, where 602 (for the 8 and 16-ary scheme) the highest level is uncoded, 603 uses hard decisions, and carries 1/2 bit/symbol, the sum 604 capacity C = C (0) + C (1) + 1/2 is studied in the 8-ary 605 case; similarly C = C (0) + C (1) + C (2) + 1/2 in the 16-ary 606 case.

607
Shaping may also be implemented for a 4-ary scheme, 608 however, shaping gains are more pronounced for larger con-609 stellations [31]. Hence, in practice, 4-ary ASK with uniform 610 probabilities is of interest. The scaling parameter s may be 611 chosen such that all regions are used with the same probability 612 1/4, which, considering (9), is achieved for s = 0.337. In the 613 4-ary case we consider C = C (0) + C (1) . For 4-ary signaling, over a wide range of s, best perfor-618 mance can be achieved. The respective minima are close to 619 s = 0.337 where uniform probabilities occur. Hence, in the 620 following, we fix the scaling factor s 4 to this value and do 621 not consider shaping in the 4-ary case. For the 8 and 16-ary 622 schemes only the range where the highest level has a capacity 623 larger then 1/2 is shown (this region is limited by the shown 624 dotted curves). Outside this range, the desired rate cannot be 625 supported. It is visible, that the minima occur at the boundary 626 of the region. For 8-ary signaling, s 8 = 0.35 is chosen in the 627 following. Finally, the scaling in case of the 16-ary scheme is 628 almost halved compared to the 8-ary scheme (s 16 = 0.175). 629 This means that the regions of the 8-ary scheme are divided 630 into two regions of the 16-ary scheme; since the coding levels 631 in case of ASK signaling and natural labeling address points 632 whose minimum distance double with each level, compared 633 to the 8-ary case an additional level below the lowest 8-ary 634 level is added. However, this new lowest level will carry only 635 VOLUME 10, 2022 a very low rate; the gains of 16-ary signaling compared to 636 8-ary signaling are not tremendous.   The capacity in case of Gaussian readout more resembles 670 that of coded modulation over a Rayleigh fading channel. 671 There, symbol expansion diversity [53] can be gained, i.e., 672 it is rewarding to more than double the size of the used signal 673 constellation compared to the smallest possible one.

674
Hence, even for a desired capacity of C = 0.5 bit/node 675 (see the circles in the zoom shown in the left bottom part of 676 Fig. 9), higher-order modulation is beneficial. Soft-decision 677 decoding of binary codes already provides a gain of approx-678 imately 4 dB over conventional hard-decision decoding. 679 Going to a 4-ary scheme, further almost 4 dB can be gained. 680 For such low rates, the practical shaped schemes (with hard 681 decision and R 2 = 0.5 in the highest level) do not provide 682 further gains (see the dahed lines). We now compare the capacities for an 8-ary scheme with 685 shaping and uniform signaling, respectively. Fig. 10 shows 686 the sum capacities over the signal-to-noise ratio. The solid 687 lines correspond to the situation of shaping (uniform regions, 688 non-uniform probabilities), the dashed lines to uniform sig-689 naling (non-uniform regions, uniform probabilities). For 690 shaping, two situations are shown: the curve from Fig. 9 is 691 repeated, where the scaling is fixed and the rate in the high-692 est level (due to the shaping scheme) is fixed to 1/2 (blue) 693 and the case when for all signal-to-noise ratios the scaling is 694 optimized individually and the actual capacity of the highest 695 level is taken into account (light blue). The optimized shaping scheme has a slightly larger 697 capacity then the uniform scheme; when fixing the scaling 698 and restricting the MSB rate, above approximately C = 699 1.3 bit/node the capacity of the shaping scheme is inferior. 700 However, up to C = 1.5 bit/node no significant differences 701 in the capacities are present. Hence, from this point of view, 702 both approaches can be judged to have a similar performance. 703 For comparison, the curves for conventional ASK sig-704 naling over the AWGN channel are given (gray). Here, the 705 shaping scheme has a slightly more pronounced advantage

725
In this section, we study the coded modulation/shaping 726 schemes designed above by means of numerical simulations. 727 We are mainly interested in the word error ratio (WER), i.e.,  Note that the coded modulation scheme given in Fig. 4 uses 751 (the Cartesian product of) two ASK constellations with nat-752 ural labeling but shaping is preferably based on a QAM con-753 stellation where (at least) the two most significant bits are 754 labeled according to the principles of set partitioning. The 755 matrix on the right-hand side performs the transformation 756 from 2D set-partitioning labeling to 2 × 1D natural labeling 757 (cf. [59]).

758
In each case, we synthetically generate PUF readouts. 10 To 759 that end, the elements of the nominal (error-free) readout r ref 760 are drawn obeying a zero-mean unit-variance Gaussian dis-761 tribution and the message word m is drawn uniformly from 762 the set of length-k binary words. Encoding by the multilevel 763 structure is performed and the shaping algorithm (Viterbi 764 algorithm selecting the shaping redundancy w) is run (for 765 details see [31]). Given the codeword a in signal space, the 766 helper data is generated and directly applied to produce the 767 processed reference readout x. For each such PUF instance, 768 at least 100 error vectors e are generated, modeling this num-769 ber of readouts. As detailed in Sec. II, the components of the 770 error word e are drawn according to a zero-mean Gaussian 771 distribution with variance σ 2 e . For non-binary schemes, MSD 772 is performed to recover the message. The word error ratio is 773 averaged over 10 6 PUF instances.

774
The designs collected in Tab. 1 are considered. We first consider the designs for R = 0.5 bit/node. In Fig. 12, 777 the word error ratio is plotted over the signal-to-noise ratio for 778 different settings.

779
Starting point is a single binary code with hard-and soft-780 decision decoding, respectively. As it is well-known, employ-781 ing soft decisions, a significant gain can be achieved. The 782 finite-length performance of the codes even show a larger 783 gain as anticipated by the capacity results. The optimum 784 decoding metric (42) (solid line) performs slightly better than 785 the conventional for BPSK over the AWGN channel, cf. (43) 786 (dashed line).

787
Even for this low code rate, going to 4-ary signaling is 788 rewarding. A further gain of 4 . . . 5 dB can be realized, which 789 is consistent with the capacity arguments (see Fig. 9). 790 9 In contrast to [31], here the MSB is the right-most bit in the bit label, hence the row and column flip of the scrambler matrices compared to the referred table.
10 Note that the numerical results given here cannot be directly compared with that shown in [5] as there a uniform distribution of the PUF readout that matches the used modulo reduction has been considered.   The results (word error ratio over the signal-to-noise ratio) 803 are displayed in Fig. 13. The designs of Tab. 1 are used.

804
The capacity curves for the 4-ary and 8-ary schemes dif- For a rate of R = 1.25 bit/node (dashed) still a gain of 816 almost 4 dB is achieved if the 8-ary shaping scheme is used; 817 the 8-ary uniform scheme gains only little over the 4-ary 818 uniform scheme.

819
For the low rate of R = 1.00 bit/node (dashed-dotted) 820 the 8-ary scheme with shaping performs almost equal to the 821 scheme with R = 1.25 bit/node. This is justified by the 822 black dotted curve which gives the WER of Level 2, where 823 WER (2) ≈ 1 − (1 − BER) n and the bit error ratio BER is 824 approximated as given in (29). Thus, the highest level limits 825 performance. However, still 1 dB can be gained over the 4-ary 826 uniform scheme. For this low rate, the 8-ary uniform scheme 827 does not perform well; even worse than the 4-ary uniform 828 scheme. This is due the lowest coding level. For the equal-829 probable partition, the inner regions are very narrow and 830 hence higher error rates occur when using these regions. The 831 code at level 0 has a very low rate but it cannot compensate 832 for the loss caused by the inner regions. Note that a binary 833 scheme cannot achieve the studied rates.

834
Again, for comparison, the capacity limits of the respective 835 approaches (for R = 1.50 bit/node only) are indicated with 836 vertical markers.

837
In summary, it can be stated that the 8-ary scheme with 838 shaping has a very good performance for all rates of interest. 839  In the above description of the scheme with shaping, the 855 highest level was assumed to be uncoded. In practice, some 856 high-rate code with hard-decision decoding may be in place. 857 We assume that such a code is capable to correct up to 3 bit In this paper we have considered multi-valued PUFs, where 883 we potentially extract more than one bit of entropy from 884 each PUF node (or PUF cell, PUF unit). This is achieved by 885 directly accessing the analog readout and resorting to meth-886 ods from coded modulation. In addition, in order to match the 887 (approximately) Gaussian distribution of the readout, signal 888 shaping has been employed. The coded modulation/shaping 889 scheme has been designed based on capacity arguments. 890 To that end, the respective capacities have been derived. 891 It has been shown via numerical simulations that rates up 892 to 1.50 bit/node are possible using an 8-ary scheme; these 893 results have been complemented by applying the scheme to 894 measurement data which has been provided by the Institute of 895 Microelectronics at Ulm University. In addition, the capacity 896 arguments cover that even for low rates (e.g., 0.50 bit/node) 897 a 4-ary scheme is rewarding.

898
In the derivations, we have approximated the readout to be 899 Gaussian distributed. As the frequencies of the ROs are mea-900 sured by counting the oscillations per a given measurement 901 period, the frequencies and, thus, the frequency differences 902 are quantized. For a measurement period of 10 µs [36], the 903 resolution of the frequency difference is 1 10 µs = 100 kHz. 904 As the variance of the unnormalized readout is in the range 905 of 12 MHz 2 , after normalization to unit variance, the res-906 olution is 100 kHz/ 12 MHz 2 ≈ 0.029. Since the width 907 of the regions, in which the (normalized) PUF readout is 908 categorized, is in the range of 2s ≈ 0.7, each region com-909 prises ≈ 25 possible discrete frequency differences. Hence, 910 an approximation by a continuous pdf is reasonable. How-911 ever, the (densely) discrete nature of the PUF readout can eas-912 ily be taken into account in the calculations of the capacities. 913 Replacing the pdf (14) suitably, any (known) distribution can 914 be taken into account in the analysis and the design of the 915 coded modulation/shaping scheme. Thus, the approach is not 916 only applicable to Gaussian signals and noise but to a broad 917 field.

920
In this appendix, we derive the capacities of the coding levels 921 of the multilevel coding scheme and the appropriate decoding 922 metrics. The cases of conventional ASK signaling and that of 923 a Gaussian readout in PUFs are compared. We consider the situation visualized in Fig. 14, which for the 927 example of an 8-ary scheme is repeated from Fig. 3. variance Gaussian pdf restricted to this region, i.e., Note that the region is used with probability  Note that due to the one-to-one correspondence of sig-965 nal point and region, ASK signaling can also be char-966 acterized by the regions-both scenarios can be handled 967 uniformly. The respective pdf over the region is either 968 a weighted Dirac pulse (13) or a continuous Gaussian 969 one (15).

971
It is convenient to define (''∀[c µ−1 . . . c 1 ]'' indicates that the 972 union is done over all binary tuples of the indicated variables) 973 i.e., the union of regions which represent the least significant 975 bit (LSB) c 0 = b. In the same way the regions R b 1 b 0 are 976 defined. In addition, the probabilities p b (and p b 1 b 0 , etc.) are 977 given for the Gaussian readout by For the ASK case, due to the sifting property of the Dirac 980 delta this is synonymous to Finally, we use the denomination ''· | c 0 '' to indicate that 983 the transmit signal is drawn from the region R c 0 , i.e., the set 984 which represents the LSB with the given value c 0 . Specifi-985 cally, In the same ways the condition to c 1 c 0 has to be 989 understood. Shaping/signaling with non-uniform probabilities is used to 993 approximate the continuous Gaussian transmit pdf which is 994 capacity-achieving on the AWGN channel. However, even 995 with equiprobable signaling, the capacity can be approached. 996 To that end, the uniform spacing of the signal points has 997 to be replaced by a non-uniform one. In [60] it is shown 998 that the optimum procedure is to choose M regions, such 999 that the integral over a Gaussian pdf within the regions is 1000 always 1/M . The signal points are then given as the centroids 1001 of the regions. where h(·) denotes differential entropy. This expression can 1033 be rewritten as 1034 where C(R c 0 ) denotes the capacity of the AWGN channel 1037 when the channel input is Gaussian with variance 1 but 1038 restricted to the region R c 0 . R = R is the union of all regions, 1039 i.e., the entire real axis. In the same way we obtain the capacity of coding Level 1 1042 (p c 1 |c 0 is the conditional probability of c 1 given c 0 ) Please note that in contrast to ASK signaling where the 1050 capacity of a constellation using a single signal point is zero, 1051 in the case of Gaussian readout C(R c 2 c 1 c 0 ) > 0. 1052 Usually, for the highest level, hard decisions are utilized. 1053 Here, a threshold device decides between i) R 000 and R 100 , 1054 or between ii) R 001 and R 101 , or between iii) R 010 and 1055 R 110 , or between iv) R 011 or R 111 . As for the Gaussian 1056 readout the minimum distance of the useful signal to the 1057 threshold is 3s, the bit error ratio is upper bounded by The end-to-end model including mapping and receiver-side 1060 quantization is given by the BSC; however, the input does 1061 not have uniform probabilities. Assuming that the regions 1062 R 0c 1 c 0 and R 1c 1 c 0 are used with probabilities p 0c 1 c 0 and 1063 p 1c 1 c 0 , respectively, the quantized channel output takes on the 1064 value ''0'' (approximately) with probability

1065
(1 − BER) · p 0c 1 c 0 + BER · p 1c 1 c 0 .  When c 0 and c 1 are known, the binary symbol c 2 is decoded. 1105 Here, hard decision can be used without significant loss and 1106 a decision boundary half way between the regions is almost 1107 optimum.

1108
To justify this, assume that two signal points, denoted as 1109 a 0 and a 1 (with a 0 < a 1 ), are present; they are used with 1110 probabilities p 0 and p 1 , respectively. A decision is taken in 1111 favor for a 0 if 1112 Pr{a 0 | y} ≥ Pr{a 1 | y}, In the present application, p 000 and p 100 exhibit the largest 1116 difference; for σ 2 e = 0.01 (cf. Sec. II), the shift compared to a 1117 decision boundary half way between the signal points is given 1118 by where C Gauss = 1 2 log 2 1 + 1/σ 2 e denotes the capacity of 1131 the AWGN channel with Gaussian input and C half Gauss the 1132 respective capacity when the input is half-normal distributed. 1133

1134
The decoding metric for soft-decision in the binary scheme is 1135 given by (cf. (17) and (18)