PUF as private key

PUF as private key will be weak, if

• PUF can be read out all of the CRPs

countermeasure: 

(1) make CRPs large enough, that it takes much longer time to read  out than its lifespan as ID.

• PUF can be attacked by limited CRPs, modeled to predict future CRPs

countermeasure: 

(1) Hash challenges against choosing-text attack

(2) Hash response against modelling

• PUF can be cloned

countermeasure: 

(1) ideal: cannot be modeled, such as optical  PUF

(2) impossible to produce same PUF with assigned parameter. Since PUF parameter follows process variation which cannot be assigned or human manipulated, so it's by nature impossible.

(3) But can be achieved to have same CRPs with distinguished device such as PC or FPGA or MCU if already modeled.