Low Cost and Precise Jitter Measurement Method for TRNG Entropy Assessment

. Random number generators and speciﬁcally true random number generators (TRNGs) are essential in cryptography. TRNGs implemented in logic devices usually exploit the time instability of clock signals generated in freely running oscillators as source of randomness. To assess the performance and quality of oscillator-based TRNGs, accurate measurement of clock jitter originating from thermal noise is of paramount importance. We propose a novel jitter measurement method, in which the required jitter accumulation time can be reduced to around 100 reference clock periods. Reduction of the jitter accumulation time reduces the impact of the ﬂicker noise on the measured jitter and increases the precision of the estimated contribution of thermal noise. In addition, the method can be easily embedded in logic devices. The fact that the jitter measurement can be placed in the same device as the TRNG is important since it can be used as a basis for eﬃcient embedded statistical tests. In contrast to other methods, we propose a thorough theoretical analysis of the measurement error. This makes it possible to tune the parameters of the method to guarantee a relative error smaller than 12% even in the worst cases.


Introduction
Random number generators (RNGs) are essential in cryptography -they provide the random numbers used as encryption keys, nonces, and padding values in cryptographic protocols or as random masks in countermeasures against side channel attacks.RNGs can be implemented as pseudo-random number generators (PRNGs), that are easy to implement in logic systems, reach higher output bitrates and produce random numbers with excellent statistical properties.However, if the algorithm and internal state of the PRNG is known, it is potentially predictable and hence vulnerable.Physical true random number generators (TRNGs), which rely on some physical random phenomena, are by nature unpredictable, but they usually offer a lower output bitrate and generate numbers of lower statistical quality.The main difficulty with the TRNG design is finding a robust and quantifiable physical source or sources of randomness and an efficient method of converting random physical quantities into a stream of generated numbers (for example, a bitstream).
Traditionally, the quality of generated numbers has been evaluated using a suite of general-purpose statistical tests.However, black box statistical tests can not detect dependencies and pseudo-randomness, which weaken the robustness of the generator.Therefore, according to modern security standards [KS11,ISO19], the quality of generated numbers and their unpredictability should be assessed using an output entropy rate that is estimated by a stochastic model.The aim of the stochastic model is to describe the distribution of output random numbers depending on the entropy extraction method used (usually some kind of analog-to-digital conversion) and on the set and size of physical quantities, that are used as the input parameters of the model.
One of the most frequently used source of randomness in logic devices is time instability (i.e. the jitter) of the clock signals generated in freely running oscillators, e.g.ring oscillators (RO).This kind of jitter depends on non-manipulable random physical sources like thermal noise, but also on global sources, that can be manipulated by an attacker.To eliminate the possibility of jitter manipulations, a differential principle based on a couple of ROs is used in the so-called elementary RO-based TRNG (ERO-TRNG) [BLMT11].According to the proposed stochastic model of the ERO-TRNG, the entropy (and hence the unpredictability) of the generated numbers depends on three model input parameters [BLMT11, Appendix C]: 1) the duty cycle of the sampled clock signal; 2) the drift of the Wiener process; and 3) the volatility of the Wiener process, which is linked to the variance of the resulting clock signal.While the duty cycle and the drift (mean frequency) are easy to measure inside or outside the device, the volatility of the Wiener process should only reflect the contribution of thermal noise to jitter and thus to entropy, since the sources of thermal noise are mutually independent, uncorrelated in time and not manipulable.Consequently, accurate measurement of the jitter component originating from the thermal noise is indispensable to assess the performance and the quality of oscillator-based TRNGs and of the ERO-TRNG.The main danger is overestimating jitter that can lead to overestimating entropy and thus to reducing security.
Several jitter measurement methods have been published.In [SMS07], Sunar et al. measure the jitter outside the device using standard probes and an oscilloscope.In [VFAB10], the authors use a differential data interface and differential oscilloscope probes to increase measurement precision.Their results show that Sunar et al. overestimated the jitter more than five fold, which, in practice, would lead to catastrophic overestimation of entropy.However, a differential data interface is not always available.Moreover, the use of external measurement equipment would exclude online measurement of jitter to detect attacks and could add error caused by the acquisition chain.
Clearly, embedded jitter measurement methods are preferable.In these methods, like in random number generation itself, it is widely accepted that jitter is measured using a differential method exploiting two oscillators, which helps reduce the impact of global perturbations.In [HTBF14], the authors use a counter method to quantify jitter.However, to be able to measure jitter, long jitter accumulation times are necessary (thousands of the reference clock periods in [HTBF14]).But the long accumulation times mean the contribution of flicker noise to jitter will dwarf that of thermal noise.It is important to note that flicker noise is known to be auto-correlated [HLL99] and can lead to non-stationarity of random variables.Therefore, reducing the measurement time to reduce the impact of the flicker noise on the measured jitter is of the utmost importance.
In [FL14], the authors propose a jitter measurement method that requires jitter accumulation times of about 300 reference clock periods.The method presented in [YRG + 17] reduces the jitter accumulation time required but at the cost of huge hardware resources.In [GBF + 23], the authors point out that the precision of a measurement method should be thoroughly evaluated and demonstrated before the method is used.
In this paper, we propose a novel jitter measurement method, that can be embedded in logic devices and does not require any external measurement or any prior characterization to work properly.The proposed method requires only short (shorter than in [FL14]) jitter accumulation times meaning the contribution of flicker noise to jitter is smaller or even Our methodology is different from other published methods: we analyse and explain in detail how different parameters determine the accuracy of the method.We also offer precise formulas to compute the upper bound of the measurement error to avoid overestimating jitter in the measurement process.The resulting measurements can consequently be used to confidently estimate the entropy rate.
The paper is organized as follows: in Section 2, we present the theoretical background and definitions.In Section 3, we explain the principle of the novel method.In Subsection 3.2, we present a way to calculate the upper bound of the measurement error and in Subsection 3.3, we verify our analysis of measurement errors using simulations and in Subsection 3.4, we illustrate how the method works.In Section 4, we describe hardware implementation of the method and its implementation constraints.We then verify the validity of assumptions made in Section 3 and present results of the jitter measurements performed in three different FPGA families.In Section 5, we compare our method with other published jitter measurement methods.The objectivity of the comparison is guaranteed by performing the jitter measurements on the same couple of ROs and using the same environmental conditions in all the methods evaluated.Finally, in Section 6, we conclude the article and present our plans for the future.

Theoretical background and definitions
Our objective is to evaluate the source of randomness in an ERO-TRNG (Elementary Ring Oscillator-based TRNG), that is, the clock jitter accumulated in a couple of ring oscillators.The jitter measurement circuitry should be based on the ERO-TRNG architecture with only minor modifications.The proposed architecture is shown in Fig. 1.The ring oscillator (RO) is composed of a chain of an odd number of inverters connected in a ring using an AND gate as shown in the upper part of Fig. 1.The AND gate added to the ring can be used to restart the oscillations.The output signal s i of the ring oscillator RO i is a square wave whose average frequency depends on the sum of delays added by the individual inverters.The frequency divider determines the jitter accumulation time by dividing the reference clock frequency by k.The sampler (D flip-flop) is the standard part of the ERO-TRNG that generates random bits at its output.The counter Cnt is the only additional component needed to measure the jitter.The counter output c k gives the number of rising edges of s 1 that appear during the jitter accumulation time d k .
Let us consider the timings in the jitter measurement circuitry as presented in Fig. 2. Time periods T 0 and T 1 represent the average periods of signals s 0 and s 1 , respectively.Similarly, E 0 (n) and E 1 (n) are the arrival times of the (n + 1)-th rising edge of these signals, while their initial edges arrive at time E 0 (0) and E 1 (0), respectively.Finally, we denote ϕ 0 the initial phase shift between the generated clocks, i.e.In a real oscillator, the arrival time of clock edges fluctuates.It will be recalled, that thanks to the differential measurement principle [VABF08], which is based on the use of two identical oscillators, the contribution of the global and deterministic noises to the clock jitter is negligible.Therefore, we can consider that the fluctuation of the edges is mainly due to local noises such as thermal noise and flicker noise.What is more, with short accumulation times, the influence of flicker noise is reduced and thermal noise dominates [HTBF14].In this case, Baudet et al. [BLMT11] suggest to model the evolution of the phase of the oscillators by a Wiener process of drift nT i and volatility √ nσ i where σ i is the period jitter caused by thermal noise of RO i .
If we consider the output signal of a couple of ring oscillators as shown in Fig. 2, we can further simplify our analysis.Like [BLMT11], we can assume that RO 0 is an ideal oscillator and that the measured jitter, which includes the contribution of both RO 0 and RO 1 , is only present in the output of RO 1 , i.e.: ( where q n follows a normal distribution N (0, σ 2 n ) with σ 2 n = na 2 th .Where a th is the equivalent jitter representing the thermal noise contribution of both RO 0 and RO 1 , i.e. (2) 3 The new jitter measurement method

Principle
We recall that our objective is to propose a precise measurement method of the jitter coming from thermal noise, that can be embedded in logic devices as a basis for future embedded online tests.
As described in the previous section, we use the circuit shown in Fig. 1, which includes two ring oscillators that can be restarted by means of the ena signal.Ring oscillator RO 0 feeds a frequency divider.Its output, denoted d k , determines the jitter accumulation time kT 0 .Since RO 0 is considered as an ideal oscillator, according to Eq. (1) the accumulation interval stops at t = E 0 (k).The output of RO 1 is used as the clock signal of a counter.Since RO 1 produces jittered rising edges, for a given frequency division factor k, the counter produces random values denoted c k corresponding to the number of rising edges of RO 1 during kT 0 .The Depending on the initial phase ϕ 0 , the jitter accumulation factor k and clock periods T 0 and T 1 , four cases can occur at the end of the counting interval, as shown in Fig. 3: 1.The measurement interval ends up in the vicinity of the rising edge area of signal s 1 , slightly after the mean position of the edge.
2. The measurement interval ends up close to the rising edge area of signal s 1 , slightly before the mean position of the edge.
3. The measurement interval closes at exactly the mean position of the rising edge of s 1 .
4. The measurement interval ends up far from the rising edges of signal s 1 .
In Case d), the counter values c k are constant so the jitter could not be measured.In Case c), when the measurement interval stops at exactly the mean position of the rising edge of signal s 1 , two counter values appear at its output, each with the same probability.In Cases a) and b), two counter values appear just like in Case c), but one of the two values would have higher probability than the other.In Case a), a higher counter value would be more probable than a lower one (the next rising edge would be counted more often).In Case b), the probability of the two counter values would be inverted (the next rising edge would be missed more often).
To confirm our analysis, we implemented the circuit in Fig. 1 in hardware.In our experiments, we observed behavior of counter values c k for different values of k.Namely, we varied k from 1 to 255 and acquired a set C k in N = 4 096 measurements for each k.Choosing a k value above 300 was not useful (and probably dangerous due to the influence of flicker noise), because for these values of k, the method presented in [FL14] was shown to produce satisfactory results.Figure 4 depicts the variance V ar(c k ) resulting from these sets of measurements.Note that the variance of a random variable X that only has two outcomes with probability p 0 and p 1 respectively, is given by V ar(X) = p 0 p 1 = p 0 (1 − p 0 ).Its maximum value is 0.25 for p 0 = p 1 = 0.5.
The experiments confirmed our expectations.Most often, and especially with short accumulation times, the counter values were constant.This corresponds to Case d) shown in Fig. 3, in which the variance of N counter values V ar (c k ) = 0 and no information regarding the jitter can be obtained from the counter output.
Nonzero variances of counter values in Fig. 4 correspond to Cases a) to c) in Fig. 3.However, in Case c), the probabilities of the two possible counter values are identical and consequently, for any value of the jitter, the variance V ar (c k ) is equal to 0.25.This case does not provide any information about the jitter and cannot be used for jitter measurement.Fortunately, this balanced case is very rare and easy to detect.Consequently, we focus on Cases a) and b), where the two counter values do not have the same probability.Because of the jitter, the measurement interval most often ends after (Case a)) or before (Case b)) the last rising edge of s 1 .This edge has a small but non-negligible probability of sometimes ending before (in Case a)) or after (in Case b)) the last rising edge of s 1 .The main idea of the proposed method is to exploit the imbalance in the distribution of this last edge to retrieve information about the jitter.These cases occur when there are only two different and consecutive values in the set C k and when their probability of appearance is imbalanced.In such cases the following conditions hold: We denote the most likely outcome of the counter by We denote M (k,N ) the number of samples in C k equal to the maximum c k in the set, In the left panel of Fig. 5, the event corresponding to the end of the measurement interval kT 0 most probably occurs just after the rising edge of RO 1 .Nevertheless, because of the jitter, the probability that this event occurs just before the edge of RO 1 is not negligible.It corresponds to Case a) and, in this case, we denote the value of k as k = k A .
Recalling that F k A corresponds to the number of rising edges (so F k A − 1 is the number of complete periods T 1 counted in this measurement interval), from the left panel in Fig. 5, the following equation can be deduced: We then observe that: where q F k A is the clock jitter accumulated during F k A clock periods, as described in Eq. (1).Consequently, where Φ(•) is the normal cumulative distribution function.The P r (c k = F k A ) can be estimated using the proportion of a large number of counter values c k equal to F k A .This proportion converges to P r (c k = F k A ) while the number of observed counter values tends to infinity.It corresponds to the shadowed area in the left panel of Fig. 5 and is denoted A k A .Note that in this case, A k A > 0.5.Considering Eq. ( 5), we get: and then by combining Eq. ( 9) and (10), we obtain: where Φ −1 (•) is the inverse normal cumulative distribution function.Finally, Eq. ( 11) can be applied in Eq. ( 6) to obtain: Let us now consider Case b) shown in the right panel of Fig. 5.We can proceed in the same way as in Case a).In Case b), the end of the measurement interval most probably occurs before the rising edge of RO 1 .Again, because of the jitter, the probability that the end of the measurement interval arrives just after the rising edge of RO 1 is not negligible and corresponds to Case b).In this case, we denote k = k B .From the right panel of Fig. 5, we can deduce the following equation: Further, we observe that: where q F k B +1 is the clock jitter accumulated during As before, the P r (c k = F k B + 1) can be estimated using the proportion of a large number of counter values c k equal to F k B + 1.It corresponds to the shadowed area in the right panel of Fig. 5 and is denoted A k B .Note that in this case, A k B < 0.5.By taking into account Eq. ( 5), we can write: By combining Eq. ( 16) and ( 17) we obtain Equation ( 18) can be applied in Eq. ( 13) to obtain: The initial phase shift (ϕ 0 ) is an unknown variable.We can use Eq. ( 12) and ( 19) to form a system of equations where the only independent unknown is the equivalent thermal contribution to the jitter.Recalling that σ F k = a th √ F k (see Eq. ( 1)), we can write As it will be explained in Subsection 4.2, we can assume that ϕ 0 and the ratio T0 /T1 are constant throughout the measurement.Thus, by combining equations from Eq. (20), we obtain The ratio T0 /T1 cannot be measured directly.However, it can be approximated by the ratio c L /L, where c L is the counter value obtained using the circuit in Fig. 1 with a big frequency divider factor L. Another factor that determines the precision of the method is the number of measurements N .Indeed, A k is approximated by when N is sufficiently big.The value a th /T1 is thus approximated by a th/T1 , which depends only on measurable parameters:

Analysis of the measurement error
As pointed out in [GBF + 23], the parameters that affect the precision of the method, need to be clearly identified and their impact on the precision thoroughly evaluated.In this sense, we identified the parameters, that determine the precision of the proposed measurement method.In contrast to the state-of-the-art methods, we evaluated theoretical bounds of the relative error and determined the values of parameters (L, N , k A and k B ) that minimize the measurement error.
According to the previous analysis, the relative measurement error of a th /T1 is given by: By replacing a th /T1 from Eq. ( 21) and a th T1 from Eq. ( 22) in Eq. ( 23) we obtain a cumbersome expression that can be upper bounded according to the following inequality: This inequality represents the upper bound of error of our method.It is governed by two main factors: α AB , which is related to the error made when approximating A k to , equal to and α 0,1 , which is related to the measurement error of the ratio T0 T1 , equal to We analyze the possible origins of these two errors in the two following subsections.

Error due to area approximation
The error due to approximation of the area under the Gaussian curve in Fig. 5 is represented by α AB .It is related to a general problem of area approximation using a Monte-Carlo method.Following this principle, we obtain an absolute upper bound of |α AB | depending on N , but not on other parameters of the method.We recall that However, we approximate N can be > 0.5.Hence, the denominator of Eq. ( 25) can be close to 0, making α AB , and consequently the error, diverge.Moreover, due to the divergence of the function Φ −1 (•) in 0 and 1, a minor error in the approximation of A k with will be strongly amplified by Φ −1 (•) when For this reason, to find an upper bound of To obtain these bounds, we simulated the counting process for representing the normalized difference between the position of the last rising edge of s 1 in Case a) (resp. in Case b)) and the end of the measurement window.They both varied independently from r min = 0 to r max = 5 in steps of 0.01.We computed the theoretical values, Φ −1 (A k A ) and Φ −1 (A k B ), and the experimental ones, for N repetitions, , to compute α AB for each case.The maximum evaluated value r max = 5 was chosen because the probability that the last edge of s 1 falls outside this normalized interval is negligible, i.e. for r k σ F k ≥ 5 we obtain 1 − Φ(5) = 2.87 × 10 −7 .(<0) and on r kA σ Fk A (>0) for N=2048 (<0) and on r kA σ Fk A (>0) for N=4096 (<0) and on r kA σ Fk A (>0) for N=2048 (<0) and on r kA σ Fk A (>0) for N=4096 on N , r min and r max ) can be computed: The variance V ar(c k ) = is an increasing function of in the interval [0; 1 2 ] and a decreasing one in [ 1 2 ; 1].Therefore, the thresholds in Eq. ( 28) can be used to get bounds of V ar(c k ).Recalling that Φ(−x) = 1 − Φ(x), we get Note that we do not need to compute the variance.Using Eq. ( 28), for a given N , we can obtain suitable thresholds for For example, for N = 4 096, r min = 1 and r max = 2, the following inequalities ensure that |α AB | ≤ 0.05: which is useful when the goal is to embed the method in logic devices, since only a comparator is needed.
If not enough values of k satisfy these criteria, it is possible to decrease r min and increase r max to find more.Although the error of the method would be increased, its value could still be evaluated precisely.

Error due to approximation of the average periods ratio
Next we examine the origins of α 0,1 .We perform the counting experiments from Fig. 1 for one large L. We denote the obtained value c L .The waveform of this experiment is given in Fig. 7 and these parameters are related such that By choosing a large L, we can get as close as needed to the ratio T0 T1 , from only one, but sufficiently long counting process.
Furthermore, using Eq.(20), we get From the study of α AB , we conclude that suitable cases (Case a) and Case b)) should be such that Φ −1 (A k A ) and −Φ −1 (A k B ) are greater than r min .Therefore, Finally, by combining Eq. ( 31) and (33), we get In contrast with the absolute upper bound of |α AB | found, which depended only on N , the upper bound of |α 0,1 | depends on several parameters.For a given (intrinsic) jitter a th /T1 we need to choose: a large L; a distance |k A − k B | as small as possible; and, because k A (resp.k B ) and F k A (resp.F k B + 1) have the same order of magnitude, a relatively big k A and k B .
To give an example, for an intrinsic jitter a th /T1 greater than 0.5‰, by choosing L = 65 535, and

The upper bound of the measurement error
Given the analysis of |α 0,1 | and |α AB |, the relative error computed with Eq. ( 24) is We can therefore conclude that the theoretical maximum error (denoted by δ W ) of the jitter measurement achievable with our method is 12.3%.It will be recalled that these parameters are determined to measure a jitter a th /T1 >0.5‰.They have to satisfy the following criteria: According to Eq. (34), the order of magnitude of the jitter will impact the upper bound δ W -it will decrease with an increase in a th /T1.It will then be possible to compute the maximum measurement error for a given order of magnitude of the jitter, which depend on the technology used.
In our error analysis we assumed the worst-case scenarios.Therefore, the boundary value δ W = 12.3% would be very difficult to reach.Nevertheless, a conservative approach can use this δ W to get a lower bound of the measured jitter, i.e.
Using this lower bound of the jitter value as an input for a stochastic model, like the one from [BLMT11], the designer can reduce the risk of overestimation of the entropy rate.For this reason, the analysis of the measurement error is of utmost importance and is one of the main contributions of this article.
Algorithm 1 Algorithm of the new jitter measurement method.Get a counter value from the circuit in Fig. 1 with a frequency division factor k. .

26:
List of the measured a th/T1 calculated with every found (k A , k B ) couple end for 30: end procedure

Discussion
If we take the conditions established in Subsection 3.2 into account, the novel jitter measurement method can be described by Algorithm 1.Note that the only operation that needs to be performed in hardware is the acquisition of the counter values for different jitter accumulation times k • T 0 .
To further confirm the precision of the method, we simulated the measurement process in software.We generated examples following the pseudo-random normal law to simulate the behavior of oscillators affected by thermal noise, like in [GBF + 23].Namely, for given values of ϕ 0 , T 0 , T 1 and k, we generated pseudo-random counter values c k .In our simulations, we randomly selected the ring oscillator average periods (T 1 = 7 940 ps, T 0 = 7 462 ps).We then set a th /T1 to 1.39‰ to be consistent with jitter sizes published in the state-of-the-art jitter measurement methods [FL14, YRG + 17] and greater than 0.5‰ used to compute the error bounds.Algorithm 1 was simulated 100 times, each time, a list of simulated jitter measurements was obtained.Figure 8 shows the results of the simulations, i.e. the distribution of the simulated jitter measurements.The average measured value is represented by the vertical black dashed line and is equal to 1.387‰.The simulated a th /T1 is represented by the vertical red dashed line.The average error is   The results clearly highlight the accuracy and precision of our method.Indeed, the maximum measurement error is much smaller than the upper bound of 12.3% found in Subsection 3.2.As confirmed by our simulations, this theoretical error bound is very conservative and is difficult to reach.

Illustration of the method
Here we demonstrate how the proposed method works and illustrate its high precision with the following example.We simulated the method based on Algorithm 1.In our simulations, line 24 of the algorithm was executed independently of the previous condition (line 23).The frequency division factor k varied from 1 to 255 in steps of 1.For each k, we acquired N = 4 096 samples of c k to form a set C k .Like in Subsection 3.3, we set ϕ 0 = 6 335 ps, T 0 = 7 462 ps, T 1 = 7 940 ps, L = 65 535 and a th /T1 =1.39‰.
For certain values of k, two different c k appeared in the C k set.Table 1 shows the simulated data for these cases.If we consider the conditions presented in Subsection 3.2, only the six bold entries highlighted in Table 1 can form couples (k A , k B ) with a small upper bound of the error.Table 1 shows: the frequency division factor k, the variance of the set C k , the different c k encountered in C k and the number of times they appeared in the set, (c k,1 , # {c k,1 ∈ C k }) and (c k,2 , # {c k,2 ∈ C k }) where c k,1 is the most often encountered c k and c k,2 is the second most often encountered c k , and the case identified (according to Fig. 5), where A indicates that c k,1 > c k,2 and B indicates that c k,2 > c k,1 .
Since in simulations, the phase of the oscillators is accurately and permanently known,  1. we can apply Eq. ( 24) to calculate a more stringent error bound for any couple (k A , k B ).
Table 2 shows how to use the equations presented in Subsection 3.2 to estimate the maximum error of each measurement.For the three couples (k A , k B ) listed in Table 1, the upper part of Table 2 shows the resulting values ( a th/T1).The lower part of Table 2 shows the exact evaluation of the different factors of Eq. ( 24).It then shows the value of a stringent upper error bound using Eq. ( 35) starting with the second column.The last column shows the relative measurement error 1 − a th a th that can be computed correctly because as it is a simulation the injected jitter is known.To illustrate the importance of the condition |k A − k B | ≤ 16, we added two unsuitable couples (k A , k B ) (in grey) that do not satisfy this requirement and whose error upper bound is above 12.3%.
For the three well selected couples (k A , k B ) we can confirm, Eq. ( 35) is always verified and its stringent upper bound is far below the worst-case very conservative upper bound of 12.3%.Because this upper error bound comes from the exact evaluation of Eq. (24) it can be very small compared to the absolute bound of 12.3% while still being very conservative.
Our aim is to reduce accumulation time as much as possible while simultaneously minimizing the error.The first row in Table 2 is in bold because we consider it is the optimal jitter measurement.Its relative error is bounded by 2.25% which is not the smallest but allows jitter measurements in the shortest possible accumulation time (86 reference clock periods) which is crucial to limit the influence of flicker noise in real experiments.
In hardware implementations, we cannot compute α 0,1 as precisely as in simulations.In these cases, we use the obtained k A , k B , F k A and F k B and suppose a th /T1 ≥0.5‰, to compute |α 0,1 | using Eq.(34).We illustrate this approach in Subsection 4.3.

Hardware implementation
Figure 9 illustrates acquisition of a set C k for k = 3 and N = 2.The ring oscillator RO 0 is permanently enabled and its output is used as a reference clock for the whole system.The frequency divider determines the length of the measurement interval (d k = 1), during which the number of periods of signal s 1 is counted.The measurement interval is thus synchronous with RO 0 .The counter value reached at the end of the measurement interval is sent to the PC and processed using Algorithm 1.The bottom panel in Fig. 9 defines the exact definition of the measurement interval and important timing requirements.

Implementation constraints
Although the circuit shown in Fig. 1 is easy to implement in hardware, two hardware constraints have to be respected to guarantee the precision of the method: routing of the control signal d k and precision of the counter with respect to possible violation of its setup-and-hold time.
To avoid the possibility that some rising edge of signal s 1 appears after the measurement interval (once the signal d k goes down), the routing delay between the output of the frequency divider and the counter has to be shorter than the delay between the divider and the control input of RO 1 .This is easily achieved by careful placement and routing of the divider, RO 1 , and counter.
Another phenomenon that can alter the counting result is violation of the setup-and-hold time of the counter.Considering the principle of the method, the counter stops counting very close to the arrival of the last edge os s 1 , hence, violation of the setup-and-hold time of counter flip-flops occurs very frequently.
When a synchronous counter is used, all the flip-flops of the counter are concerned.Therefore, we observed that for a given k, the counter values differed in more than one, unlike what was expected based on Eq. (3).
To demonstrate this phenomenon, we first used the synchronous counter in our measurement hardware.We analyzed a total of 680 000 sets of counter values C k with a non-zero variance, i.e.V ar(C k ) > 0. We then calculated the maximum differences between the counter values C k we obtained using Eq.(3).The observed maximum differences are shown in Fig. 10.The differences were higher than one, meaning that one or more bits within the counter were affected by the time violation.Fortunately, this problem can be solved by using an asynchronous counter as can be seen in Fig. 11 -the difference in counter values was always equal to one for the same set of experiments.

Assumptions regarding the stability of the measurement conditions
When obtaining Eq. ( 21) from (20), we assumed that ϕ 0 and the ratio T0 /T1 remained constant during acquisition of all the sets C k ∀k ∈ [1, 255].In our hardware implementation the measurement process included: acquisition of the sets C k with N = 4 096 and ∀k ∈ [1, 255]; the time to send the counter values to a PC; the time to reset the counter, and the time to measure the ratio T0 /T1 with L = 65 535.The process lasted at most 2.3 s because it took 3.2 × 10 5 periods of RO 0 with a mean clock frequency of 136 MHz.Hence, our assumption concerning the stability of ϕ 0 and that of the ratio T0 /T1 should be  valid for at least 2.3 s.We measured ϕ 0 , T 0 and T 1 using a LeCroy WaveRunner 9254M oscilloscope at a 40 GS/s sampling rate for a period of 10 s.In order to stabilize the temperature of the board and hence the frequency of oscillators, we let the oscillators run freely for 10 minutes before the measurements.RO 0 and RO 1 were composed of a series of 19 and 20 buffers implemented using LCELL structures ( [Int20]) respectively, looped back by a NAND gate.Both rings were manually placed and routed.We observed: a mean of 7.32 ns and standard deviation of 4.4 ps for T 0 ; a mean of 7.9 ns and standard deviation of 4.8 ps for T 1 and a mean of 0.6 ns and standard deviation of 1.9 ps for ϕ 0 .The values of the standard deviations are very small, indicating that ϕ 0 , T 0 and T 1 are very stable over the 10 s, which largely covers the duration of the measurement.We deduced that the mean of T0 /T1 was stable, too.Our assumptions about stability were thus validated.
The duration of our jitter measurement can be parameterized for a particular implementation of the method.Let us denote k max the largest value of k that we use to look for a suitable couple (k A , k B ).If k ranges from 1 to k max , the total measurement duration (t m ) can be calculated in terms of N and k max , I c is the number of cycles of RO 0 that must pass between each acquisition of a counter value.Our stability assumption must hold during t m .The time interval t m can be reduced at the cost of reducing N and thus also reducing the precision of the measurement.

Measurement results
We implemented the circuit in Fig. 1 in three FPGA from different manufacturers : Intel, Xilinx and Microsemi.Subsequent counter values were acquired for k going from 1 to 255 in steps of 1 and processed using Algorithm 1.We set N = 4 096, L = 65 535.The implementation results for the three FPGA are shown in Table 3.We only show the results for the smallest couple found (k A , k B ) for each family.The implementation results show that the method only needs very short jitter accumulation times, indeed, around 100 reference clock edges were needed.
We also used the results of the analysis performed in Subsection 3.2 to find the upper bound of the error caused by approximation of a th /T1 by a th/T1.As we set N = 4 096, we can consider that |α AB | ≤ 0.05.The upper bound of |α 0,1 | presented in the first column of Table 3 was then found by applying Eq. (34), based on the assumption that a th /T1 ≥0.5‰.The second column shows δ W , i.e. the worst case value of the relative measurement error, computed from Eq. ( 24).Note that because the conditions determined in Subsection 3.2 are respected, δ W ≤ 12.3%.The last column shows corrected measurement results that  36).Thanks to our error analysis we can be sure that the corrected measurement does not overestimate a th /T1.

Comparison with state-of-the-art methods
To be sure our comparison of the proposed method with other published jitter measurement methods ([VABF08], [VFA09], [YRG + 17], [FL14]) is fair, we implemented all of them in a Cyclone V FPGA.We measured the jitter of the same couple of ring oscillators using different methods.Both ring oscillators were composed of 20 buffers implemented in logic cells (LCELL) looped back by a NAND gate.The rings were placed and routed manually and they generated clocks with mean frequencies of about 112 MHz.The jitter measurement methods were implemented one after the other in a few hours.During each measurement, we let the oscillators run freely for 10 minutes before beginning the acquisitions so that the clock periods were stable.We acquired the amount of data we needed to make at least 75 jitter measurements using each method.We processed the acquired data in a PC and obtained the boxplots presented in Fig. 12.Although the sources of the jittered clocks (the two rings) were always the same, certain aspects of their implementation were specific to each method: • [VABF08]: the jitter accumulation time was set to 200 000 cycles of RO 0 .We acquired and processed 4 096 counter values per jitter measurement using a PC.
• [VFA09]: we measured an average period difference of 109 ps between the two oscillator clocks using the oscilloscope.We acquired 4 096 counter values per jitter measurement and sent them to a PC for processing.
• [YRG + 17]: the accumulation time was set to 344 ns using a precise external quartz oscillator.This time was chosen so that the falling edges of both oscillator clocks always arrived in about the middle of two delay lines implemented using CARRY ([Int20]) chains.The length of the delay lines was set up empirically.To be sufficiently long, each chain had to be composed of 1 000 elements.We acquired and processed 100 000 couples of snapshots per jitter measurement, taken at the same time.As pointed out by the authors, we had to clean the glitches appearing in the snapshots by reordering their bits during data processing.
• [FL14]: we let M vary from 150 to 300 with a 5-unit step and assumed N = 100 as recommended by the authors.We acquired and processed 4 096 counter values per M .As pointed out by the authors, some sets of counter values whose mean values were close to N or 0 had to be filtered out during data processing.
• Our method: we varied k from 20 to 175.Because we obtained on average 1.5 jitter measurements per k sweep, we varied k 52 times to obtain 77 jitter measurements, each time, N = 4 096.Every set of counter values was sent to a PC for processing.In order to evaluate the performance of the method regarding k, we filtered the obtained (k A , k B ) couples so that (k A , k B ) ≤ 70.This time, we obtained on average Table 4 shows different aspects of the hardware implementations of the five jitter measurement methods.The first column presents the average jitter value obtained using different methods.On one hand, it is clear that the methods in [VABF08] and [VFA09] greatly overestimate the jitter, probably because of much longer jitter accumulation times, which increases the impact of the flicker noise.On the other hand, the methods in [YRG + 17] and [FL14] yield results comparable with our novel method.Our method and the method in [YRG + 17] produce the lowest mean jitter values.However, in our method, we did not decimate measurements using δ W , this would yield even smaller and more conservative measurements.Using the proposed error analysis method, we verified that the error of our measurements was less than 6.08%.We noticed that the method in [FL14] yields a slightly higher average jitter measurement than ours or that of [YRG + 17] but also uses accumulation times of 300 clock cycles.This may originate from the fact that flicker noise becomes non negligible even with accumulation times as short as 300 clock cycles on the Cyclone V FPGA.This hypothesis is in agreement with the comparison between the last two boxplots in Fig. 12.When the jitter measurements come from accumulation times shorter than 70 cycles the obtained mean measurement is smaller.In other words, the longer we accumulate jitter the more we overestimate the thermal component of jitter, probably because of the influence of flicker noise.
We evaluated the precision of the methods through the standard deviation of their measurements.The results are listed in the second column of Table 4.The method in [FL14] is the most precise with a standard deviation of 2 × 10 −4 .However, our method can greatly reduce the standard deviation at the cost of acquiring more data per measurement.For example, if we impose the condition k A , k B ≤ 70, the measurements have a standard deviation of 1.24 × 10 −4 .Hence, our method is more precise at the cost of obtaining less measurements per k sweep.
Although none of the methods we evaluated was fully embedded in hardware, we can compare the area of the measurement block of the method expressed by a number of ALMs.The results are presented in the third column of Table 4.Note the method in [YRG + 17] is the most expensive, requiring at least six times the area of our method or that of [FL14].
The measurement rate of the methods can also be expressed as the number of reference clock periods, needed to obtain a single jitter measurement.Based on this criterion, the method [FL14] requires the smallest number of periods, followed by the method [YRG + 17], with 4.1 × 10 5 and 4.3 × 10 6 cycles respectively.The fifth column in Table 4 indicates whether the method needs a prior calculation (P.C.) before the jitter can be measured.
From this point of view, in method [VFA09], the difference between the average periods must be sufficiently small as detailed in [GBF + 23].The method [YRG + 17] requires the delay chains to be characterized, which takes more than 2.58 × 10 7 RO 0 cycles.Finally the method [FL14] requires verifying that the couple of ring oscillators used is suitable for the measurement.This should be done by decomposing their average periods using continuous fractions.Finally, our new method requires 6.15 × 10 7 RO 0 cycles to measure the jitter because many k values have to be skipped, as shown in Fig. 4.However, our new method does not require any prior calculations nor does it impose any particular constraints.
In the sixth column of Table 4 we compare the power consumption of the FPGA when instantiating different evaluated methods.The method in [YRG + 17] consumes the most power, and is prone to consume exponentially more if the oscillator frequency is increased because the oscillating signals must pass across very long delay chains.

Conclusion and future work
In this paper, we presented a new method for measuring clock jitter that can be easily embedded in logic devices.The method allows very accurate measurements and jitter accumulation times as short as 100 reference clock periods.We conducted a thorough study including analyzing timing constraints and the precision of the method.We identified and quantified possible sources of errors and their effects on jitter measurement.All the parameters that determine measurement error were optimized theoretically and demonstrated practically.We also show how to set up the parameters of the method to achieve the desired error level and to determine the precise upper bound of the error.We stand by the principle that the jitter measurement results do not overestimate the jitter.Consequently, they can be safely used to compute the entropy rate, for example using the stochastic model from [BLMT11], to guarantee the security of the ERO-TRNG.
According to the simulations made in [GBF + 23], other methods ([FL14],[YRG + 17]) can attain a mean error of about 10%.Our simulations show that our method can reach a mean error as low as 0.04% and a maximum error of up to 5%.This is consistent with our very conservative upper bound of the error of 12.3% -the errors we found were always much smaller.
From the analysis presented we can draw several conclusions: first, jitter measurement methods based on long accumulation time greatly overestimate the thermal component of the jitter, so methods based on short accumulation time should be largely preferred.Second, although our method can be easily embedded in logic devices, like that of [FL14], it also uses very short accumulation times, like that of [YRG + 17].Our new method is thus the best compromise between accuracy and ease of hardware implementation.Moreover, while our method has relatively slow measurement rate, it does not require any previous calculation.
In our theoretical analysis and simulations, we assumed that only thermal noise affected the stability of oscillator clocks.However, as explained in [HLL99], flicker noise becomes increasingly important at higher frequencies as modern transistor channels are continuously shrinking, hence overcoming the thermal jitter component faster.This can lead to overestimating entropy and can compromise the security of the entire cryptographic system.For example, according to our implementation results, the method from [FL14] yields a slightly higher average jitter measurement than ours or that of [YRG + 17], but uses accumulation times about three times longer than our method.It is thus more impacted by the jitter coming from the flicker noise than other two methods.
To avoid overestimating entropy, two options remain: avoiding the impact of flicker noise on the measured jitter by reducing the jitter accumulation time or including the impact of flicker noise, including autocorrelation, on the total measured clock jitter and on the stochastic model.The novel method we propose in this paper will be further improved regarding both these aspects.

Figure 1 :
Figure 1: Circuitry of the ERO-TRNG with an additional counter aimed at the jitter measurement.

Figure 2 :
Figure 2: Signal timings in the jitter measurement circuitry.

Figure 3 :
Figure 3: Illustration of the position of the last edge of the clock signal s 1 at the end of the measurement interval: before (a), after (b), at (c), and far from (d).

Figure 4 :
Figure 4: Variance of counter values c k as a function of k generated by the circuit shown in Fig. 1 implemented in hardware.

Figure 5 :
Figure 5: Illustration of the case where the measurement interval ends in the vicinity of the edge of the clock signal s 1 , whereas it most probably ends: a) after the edge of the clock signal s 1 ; b) before the edge of the clock signal s 1 .r k A (resp.r k B ) denotes the distance between the last rising edge of s 1 and the end of the measurement window in Case a) (resp. in Case b)).

α
AB depending on − r kB σ Fk B +1

α
AB depending on − r kB σ Fk B +1

Figure 6 :Figure 7 :
Figure 6: Variations of |α AB | depending on the selection of suitable (right panels) or unsuitable (left panels) relative positions between the last rising edge of s 1 and the end of the measurement interval, for N min = 2 048 and N min = 4 096, respectively.In orange color for Case a) (resp.blue color for Case b)), for a given r k A/σF k A (resp.r k B /σ F k B +1 ) ∈ [r min ; r max ], α AB is computed for all values of r k B /σ F k B +1 (resp.r k A/σF k A ) ∈ [r min ; r max ].So for each x-axis, all possible values α AB are plotted.
100 (to assume thermal noise dominates), we obtain |α 0,1 | ≤ |k A − k B | • 0.003.Hence, if we want |α 0,1 | ≤ 0.05, we have to choose |k A − k B | ≤ 0.05 0.003 = 16.6.From now on, we impose |k A − k B | ≤ 16.Again, depending on the desired upper bound for |α 0,1 |, we can define a condition for k A and k B .In other words, we can tune the condition on |k A − k B | to find more couples (k A , k B ) at the cost of increasing the error on |α 0,1 | and always find the best trade-off between the number of couples (k A , k B ) and the error made.

Figure 8 :
Figure 8: Histogram of the simulated jitter measurements.The value of the jitter entered in the simulator is represented by the vertical black dashed line.The mean measured value obtained in simulations is represented by the vertical red dashed line.The two values are very close, thereby confirming the accuracy of the method.

Figure 9 :
Figure 9: Acquisition of an example set C 3 with N = 2 in the jitter measurement circuitry.

Figure 10 :
Figure 10: Histogram of maximum differences between counter values obtained using a synchronous counter.

Figure 11 :
Figure 11: Histogram of maximum differences between counter values obtained using an asynchronous counter.

Figure 12 :
Figure 12: Boxplots of 75 jitter measurements of the five compared methods.

Table 1 :
Example of simulation results obtained using Algorithm 1.

Table 2 :
Error analysis of three suitable and two unsuitable (in grey) couples (k A , k B ) from Table

Table 3 :
Results of jitter measurements of a th/T1 in three different FPGA families.

Table 4 :
Measurement and implementation results of the five jitter measurement methods while measuring the same jittered clocks in a Cyclone V FPGA.