PaperlayerView exact revision on arXiv

Source-linked AI summary

D-RaNGe: Using Commodity DRAM Devices to Generate True Random Numbers with Low Latency and High Throughput

Jeremie S. Kim, Minesh Patel, Hasan Hassan, Lois Orosa, Onur Mutlu

arXiv:1808.04286v2cs.AR

TL;DR

Existing TRNG approaches may require specialized hardware or fail to sustain continuous high throughput, while prior DRAM-based designs have limitations in nondeterminism or speed. D-RaNGe deliberately shortens DRAM activation timing and uses resulting failures as entropy; it passes NIST tests and exceeds the best prior DRAM-based TRNG’s throughput by over two orders of magnitude.

  • Problem

    Many TRNG proposals require specialized hardware or cannot sustain continuous high-throughput operation, and prior DRAM-based approaches may be too slow or lack a fundamentally nondeterministic source.

    Source: §1 · p. 1

  • Method

    D-RaNGe lowers DRAM tRCD to induce activation failures, profiles vulnerable cells, and repeatedly accesses them to extract a continuous stream of random numbers.

    Source: §1 · p. 2

  • Results

    717.4 Mb/s maximum and 435.7 Mb/s average throughput on four LPDDR4 channels exceed the best prior DRAM-based TRNG by over two orders of magnitude; D-RaNGe passes every NIST test.

    Source: §1 · p. 2

  • Takeaways & Limitations

    D-RaNGe offers a software-based way to generate high-throughput true random numbers from commodity DRAM where memory-controller timing can be manipulated.

    Source: §1 · p. 2

    The paper explores reduced tRCD; using other timing parameters to generate true random values is left to future work.

    Source: §6.1 · p. 7

Abstract

from arXiv · show

We propose a new DRAM-based true random number generator (TRNG) that leverages DRAM cells as an entropy source. The key idea is to intentionally violate the DRAM access timing parameters and use the resulting errors as the source of randomness. Our technique specifically decreases the DRAM row activation latency (timing parameter tRCD) below manufacturer-recommended specifications, to induce read errors, or activation failures, that exhibit true random behavior. We then aggregate the resulting data from multiple cells to obtain a TRNG capable of providing a high throughput of random numbers at low latency. To demonstrate that our TRNG design is viable using commodity DRAM chips, we rigorously characterize the behavior of activation failures in 282 state-of-the-art LPDDR4 devices from three major DRAM manufacturers. We verify our observations using four additional DDR3 DRAM devices from the same manufacturers. Our results show that many cells in each device produce random data that remains robust over both time and temperature variation. We use our observations to develop D-RanGe, a methodology for extracting true random numbers from commodity DRAM devices with high throughput and low latency by deliberately violating the read access timing parameters. We evaluate the quality of our TRNG using the commonly-used NIST statistical test suite for randomness and find that D-RaNGe: 1) successfully passes each test, and 2) generates true random numbers with over two orders of magnitude higher throughput than the previous highest-throughput DRAM-based TRNG.

1. Introduction

D-RaNGe uses errors from deliberately shortened DRAM activation timing to generate true random numbers, addressing the need for TRNGs that are unpredictable, fast, and practical on commodity systems. It passes NIST tests and reports throughput more than two orders of magnitude above the best prior DRAM-based TRNG.

1. Introduction

  • Prior TRNG proposals often require specialized hardware or cannot sustain continuous Mb/s-scale throughput, while earlier DRAM-based approaches may be too slow or lack a fundamentally nondeterministic source.These limitations constrain widespread adoption.Source: §1 · pp. 1–2
  • An effective TRNG should provide unpredictable output, high throughput at low latency, and practical implementation; the paper also targets continuous output with minimal application interference.DRAM is presented as a promising substrate because its timing sensitivity can induce failures, it supports continuous high-throughput transfers, and it is prevalent in computing systems.Source: §1 · p. 1
  • D-RaNGe lowers tRCD to induce activation failures, profiles vulnerable cells, then repeatedly accesses them to generate a continuous stream of random numbers.It runs in software where memory-controller timing parameters can be manipulated; other systems need only expose a software API, with no DRAM hardware changes.Source: §1 · p. 2
  • 717.4 Mb/s maximum and 435.7 Mb/s average throughput on four LPDDR4 channels exceed the best prior DRAM-based TRNG by over two orders of magnitude.D-RaNGe passes every NIST statistical test and maintains high-quality generation over 15 days and 55°C–70°C.Source: §1 · p. 2

2. Background

The background explains how DRAM organization and command timing govern data access, then introduces TRNG components and the throughput cost that post-processing can impose.

2. Background

  • The background provides the DRAM and TRNG concepts needed to understand generation from inherent DRAM properties.An entropy source’s entropy affects unpredictability and throughput; a good extraction technique should harvest quickly without disturbing the physical process.Source: §2 · p. 2, §2.2 · p. 4

2.1.1. DRAM System Organization.

  • A DRAM system connects memory controllers to independent channels; modules share a channel bus, and ranks serialize transfers over that bus.Ranks contain chips that operate in lock-step on different bits.Source: §2.1.1 · p. 2

2.1.2. DRAM Chip Organization.

  • A bank contains subarrays of rows and columns: rows share wordlines, columns share bitlines and sense amplifiers, and the selected row is copied into a local row-buffer.The local row-buffer connects to the internal I/O bus through a global row-buffer; each cell stores one bit as capacitor charge.Source: §2.1.2 · pp. 2–3

2.1.3. DRAM Commands.

  • DRAM reads and writes operate on an open row; accessing another row in the same bank requires precharging the open row first.The controller issues ACT to open a row, READ or WRITE to access words, and REF periodically to prevent charge-leakage data loss.Source: §2.1.3 · p. 3

2.1.4. DRAM Cell Operation.

  • The controller must observe timing constraints between commands; tRCD separates ACT from READ so the bitline can reach a reliable read voltage.Reading before tRCD elapses may return a wrong value, while insufficient restoration time can also cause errors on a subsequent activation.Source: §2.1.4 · p. 3

2.2. True Random Number Generators

  • A TRNG samples nondeterministic physical processes and typically combines an entropy source, randomness extraction, and sometimes post-processing.Post-processing can remove bias and correlation or protect against environmental changes and tampering, but may reduce throughput by up to 80%.Source: §2.2 · p. 4

3. Motivation and Goal

The paper motivates a widely available DRAM-based TRNG by connecting random-number demand in security and other applications with six desired design properties. Its stated goal is to satisfy those properties on DRAM devices.

3. Motivation and Goal

  • A widely available high-throughput, low-latency TRNG could support security, scientific simulation, and applications such as one-time-pad quantum key distribution, which requires at least 4 Gb/s.The paper also describes potential uses in memory scheduling, randomized PARA, and processing-in-memory applications.Source: §3 · pp. 4–5
  • DRAM-based TRNGs could bring high-throughput randomness to mobile, embedded, and microcontroller systems that lack dedicated high-performance TRNG engines.The paper connects this potential to scientific simulations and cryptographic applications.Source: §3 · p. 4
  • The paper’s six desired TRNG properties are low cost, full nondeterminism, continuous high throughput, low latency, low system interference, and low energy overhead.The stated goal is to provide a widely available DRAM-device TRNG satisfying all six.Source: §3 · p. 5

4. Testing Environment

The testing setup gives precise control over DRAM commands and timing to characterize LPDDR4 and validate the approach on DDR3. Its procedure refreshes target rows before reduced-tRCD reads to induce and record activation failures.

4. Testing Environment

  • The LPDDR4 infrastructure tests 282 2y-nm chips from three manufacturers, while a separate SoftMC-based setup validates the mechanism on four DDR3 chips from one manufacturer.A logic analyzer verifies precise command and timing control in both environments.Source: §4 · p. 5
  • The LPDDR4 chamber is held at 45°C ambient with temperature stabilized within 0.25°C, while DRAM is maintained 15°C above ambient.The reported reliable ambient testing range is 40°C–55°C.Source: §4 · p. 5
  • Experiments generally reduce tRCD from 18 ns to 10 ns, write a data pattern, refresh each target row, then issue ACT, READ, and PRE commands to induce and record failures.The refresh step gives cells the same charge before each reduced-latency read; the procedure enables fast failure induction while minimizing testing time.Source: §4 · p. 5

5. Activation Failure Characterization

The characterization examines how spatial location, data patterns, temperature, and time affect activation failures in 282 LPDDR4 devices, with findings also compared against prior DDR3 studies. It identifies failure behavior that can provide entropy, while showing that its probability depends on cell location, pattern, and temperature.

5. Activation Failure Characterization

  • The study characterizes reduced-tRCD activation failures across 282 LPDDR4 devices and compares findings with prior DDR3 studies to assess their viability as an entropy source.It examines spatial distribution, data-pattern dependence, temperature, and failure probability over time.Source: §5 · p. 5

5.1. Spatial Distribution of Activation Failures

  • Activation failures cluster in a few columns within subarrays and become more likely in higher-numbered rows, patterns the authors hypothesize reflect local sense-amplifier variation and bitline distance.The observed spatial patterns are similar to those reported in prior DDR3 studies.Source: §5.1 · pp. 5–6
  • Only the first cache line accessed after row activation exhibits failures; the accessed region and bitline affect failure counts, and subarrays and bitlines vary in entropy.Subsequent accesses to an already-open row do not cause failures because cells have longer to restore their charge.Source: §5.1 · p. 6

5.2. Data Pattern Dependence

  • Different data patterns reveal different failure subsets; walking-1 patterns have similarly high coverage across manufacturers, while the best patterns for finding cells near 50% failure probability vary by manufacturer.For manufacturers A, B, and C, solid 0s, checkered 0s, and solid 0s find the most cells with Fprob between 40% and 60%, respectively.Source: §5.2 · p. 6

5.3. Temperature Effects

  • As temperature rises, Fprob generally increases, but fewer than 25% of data points fall below the x = y line and manufacturer-specific variation differs.Manufacturer A shows the least variation; manufacturers B and C show higher variation in Fprob change.Source: §5.3 · p. 7, Figure 6 · p. 7

5.4. Entropy Variation over Time

  • Across 250 rounds over 15 days, each accessing every DRAM cell 100 times at reduced tRCD, a cell’s activation-failure probability does not change significantly under the same experimental conditions.Source: §5.4 · p. 7

6. D-RaNGe: A DRAM-based TRNG

D-RaNGe uses probabilistic activation failures from selected DRAM cells as a source of true random numbers, with the mechanism implemented in the memory controller. It identifies suitable cells and samples them using reduced tRCD, while restoring data and coordinating access to the selected rows.

6. D-RaNGe: A DRAM-based TRNG

  • D-RaNGe sources high-throughput true random numbers from a subset of DRAM cells that fail probabilistically under reduced tRCD, using a mechanism built fully within the memory controller.The design focuses on lowering tRCD below manufacturer-recommended values to induce activation failures.Source: §6 · p. 7

6.1. RNG Cell Identification

  • RNG-cell identification reads every DRAM cell 1,000 times with reduced tRCD and selects cells whose 3-bit-symbol counts are within ±10% of expected counts.The method approximates each cell’s Shannon entropy from its 1,000-bit stream; identified cells are unbiased and retain high entropy across reboots.Source: §6.1 · pp. 7–8

6.2. Sampling RNG Cells for Random Data

  • For sampling, D-RaNGe alternates reads between two selected DRAM words in distinct rows of each bank, harvesting RNG-cell values in parallel and restoring each word’s original data.The known data pattern is written to selected words and neighboring cells, which are kept under exclusive access; tRCD is restored to its default value when sampling ends.Source: §6.2 · p. 8

6.3. Full System Integration

  • A memory-controller firmware routine runs the sampling algorithm when random data is requested and DRAM bandwidth is available; a small harvested-data queue may reduce response latency.Queue size and memory-controller prioritization can be tuned to minimize overall performance overhead, while application interfaces are system-specific.Source: §6.3 · pp. 8–9

7. D-RaNGe Evaluation

D-RaNGe’s evaluated bitstreams pass the NIST randomness tests, and RNG cells occur across banks and chips. The evaluation reports throughput, latency, interference, energy, and implementation characteristics of the design.

7.1. NIST Tests

  • All 236 tested bitstreams pass all 15 NIST tests, with minimum RNG-cell Shannon entropy of 0.9507.The tests use α = 0.0001; the tested cells came from four RNG cells on each of 59 chips.Source: §7.1 · p. 9, Table 1 · p. 9

7.2. RNG Cell Distribution

  • Across 472 banks, RNG cells occur widely; a word can contain up to four, multiplying random bits sampled per access.Every analyzed bank has multiple words containing at least one RNG cell; the bank with the fewest had 100 words containing one RNG cell each.Source: §7.2 · p. 9, Figure 7 · p. 9

7.3. TRNG Key Characteristics Evaluation

  • 108.9 Mb/s is the average throughput across manufacturers when using banks, and each device reaches at least 40 Mb/s with all eight banks in one channel.Throughput increases linearly with the number of banks used; manufacturer medians are similar despite device variation.Source: §7.3 · p. 10, Figure 8 · p. 10
  • 717.4 Mb/s maximum and 435.7 Mb/s average throughput are reported for a four-channel memory hierarchy.The estimates can be multiplied by the number of available DRAM channels.Source: §7.3 · p. 10
  • 100 ns is the empirical minimum latency for 64 random bits in the tested devices; the maximum estimate is 960 ns.The minimum assumes parallelization across banks in four channels and four RNG cells per accessed word; the maximum assumes one bank and one bit per access.Source: §7.3 · p. 10
  • D-RaNGe requires exclusive access to six DRAM rows per bank, equivalent to 0.018% storage overhead.The six rows include two rows containing RNG cells and their four physically adjacent rows.Source: §7.3 · p. 11
  • 83.1 Mb/s average throughput is estimated from idle DRAM bandwidth across SPEC CPU2006 workloads, with no significant impact on overall system performance.D-RaNGe can trade throughput against interference by adjusting intervals using reduced and default tRCD.Source: §7.3 · pp. 10–11
  • 4.4 nJ/bit is the average energy cost estimated for D-RaNGe’s random bits.The estimate subtracts DRAM idling energy from energy used while generating random numbers.Source: §7.3 · p. 11

8. Comparison with Prior DRAM TRNGs

D-RaNGe uses activation failures as an entropy source and is presented as the highest-throughput TRNG for commodity DRAM devices. The comparison highlights throughput and practical limits of prior DRAM-based approaches, while noting that the distinct mechanisms can be combined.

8. Comparison with Prior DRAM TRNGs

  • D-RaNGe is presented as the highest-throughput TRNG for commodity DRAM devices, and its distinct sampling mechanism can be combined with prior DRAM-based TRNGs.The comparison evaluates prior proposals against six properties of an effective TRNG.Source: §8 · p. 11, §8.4 · p. 12

8.1. DRAM Command Scheduling

  • D-RaNGe’s maximum throughput is 211x and average throughput 128x that of DRAM command-scheduling TRNGs.The comparison estimates a maximum of 3.40 Mb/s for the prior approach on a modernized system, versus 717.4 Mb/s maximum and 435.7 Mb/s average for D-RaNGe; generating 64 bits takes 18 µs versus D-RaNGe’s 100 ns minimum and 960 ns maximum.Source: §8.1 · p. 11

8.2. DRAM Data Retention

  • A 40-second retention-failure wait yields an estimated maximum of 0.05 Mb/s, far below D-RaNGe’s measured maximum of 717.4 Mb/s.Even a one-second wait is estimated to yield only 2 Mb/s; the throughput estimate assumes 32 GiB of DRAM and ignores readout and hashing time.Source: §8.2 · p. 11, Table 2 · p. 12
  • Retention-time-based TRNG energy is estimated at 6.8 mJ per bit, compared with D-RaNGe’s 4.4 nJ per bit.The retention estimate models writing a 4 MiB region, waiting 40 seconds, and reading it to obtain 256 bits.Source: §8.2 · p. 12

8.3. DRAM Startup Values

  • DRAM startup-value methods require a power cycle, making them unsuitable for continuous high-throughput operation.Their latency depends on system and device initialization; the comparison’s 60 ns estimate counts only a read after initialization.Source: §8.3 · p. 12

9. Other Related Works

The related-work discussion contrasts DRAM activation failures with other entropy sources and their constraints in commodity systems. It notes that some alternatives require power cycling or custom hardware, while others do not sustain continuous high-throughput operation.

Related work

  • Prior activation-failure studies examined latency reduction or PUFs, but did not measure their randomness or use them to generate random numbers.D-RaNGe instead proposes activation failures as an entropy source.Source: §9 · p. 12

Flash Memory Read Noise

  • Flash read-noise TRNGs reach up to 1 Mbit/s, but flash is orders of magnitude slower than DRAM.The passage therefore describes flash as unsuitable for high-throughput, low-latency operation.Source: §9 · p. 12

SRAM-, GPU-, FPGA-, and Custom-Hardware Designs

  • SRAM startup-value approaches require a power cycle, while GPU and FPGA approaches avoid commodity-device modifications but rely on less prevalent hardware.The cited GPU throughput reaches 447.83 Mbit/s and FPGA throughput reaches 12.5 Mbit/s; custom-hardware TRNGs are limited in widespread use by their hardware requirements.Source: §9 · p. 12

10. Conclusion

D-RaNGe harvests true random numbers from DRAM row activation failures induced by accessing rows faster than required. It passes the NIST statistical test suite and outperforms the previous highest-throughput DRAM-based TRNG.

  • D-RaNGe outperforms the previous highest-throughput DRAM-based TRNG by up to 211x (128x on average).Source: §10 · p. 12
  • D-RaNGe harvests fully non-deterministic random numbers from row activation failures induced by accessing DRAM with lower latency than required.Source: §10 · p. 12
  • The evaluation validates D-RaNGe’s random-number quality with the commonly used NIST statistical test suite.Source: §10 · p. 12

Related papers

Loading 1808.04286v2…