I have read that one of the PUF's application is software licensing, but do not know how. I have been reading different articles and forums (such as here), but still not clear for me.

One vague point for me is that PUF is a hardware and I do not think that vendors provide a separate hardware rather than maybe just a CD including the software.

I also want to know what is the functionality of PUF in this application? Key generator (like explained here)? or chip ID (like explained here - minute 16)? I found a protocol explained in here, but it is not very clear if PUF can act as product key, hardware ID, or activation number.

I was wondering if some one can explain it to me or give me some references.

  • 1
    $\begingroup$ "I do not think that vendors provide a separate hardware", though getting less common, it is not unheard of to get a hardware token with software that is required to run the software. I've seen this in the form of a USB device that must be present or the software won't work and as a parallel port device. $\endgroup$ – mikeazo Apr 24 '19 at 18:49
  • $\begingroup$ I'm not sure that any dongle device can protect software. There is a small protocol here may help you. A dedicated hacker can hack all since you have the device and software. I've seen hacked famous programs that were need dongles. $\endgroup$ – kelalaka Apr 24 '19 at 19:00
  • 1
    $\begingroup$ @kelalaka, yep, nothing is 100%, but there are things you can do to raise the bar. $\endgroup$ – mikeazo Apr 24 '19 at 19:06
  • $\begingroup$ You could also mug users on the street, but there's a much greater air of respectability to casting cryptographic spells to sabotage users' computations remotely until they cough up extortion money in the name of ‘software licensing’. $\endgroup$ – Squeamish Ossifrage Apr 24 '19 at 19:11
  • 1
    $\begingroup$ Separate hardware: That's what I was referring to with "PUFesque". There's a lot of error correction on a CD disc. That means there are errors. Does that therefore mean the 'errors' are non reproducible? With suitable driver software that might be PUFy. $\endgroup$ – Paul Uszak Apr 25 '19 at 20:24

You're right about hardware activation devices for desktop applications. Dangling dongles outa your printer port is quite legacy. New applications tend to use some form of on-line activation system. You see this in games and Windows.

But it is becoming more common in the embedded world, where it can act as product key, hardware ID, or activation number. Consider the most fundamental behaviour of a PUF. It allows a challenge–response protocol to generate a non clone-able set of values, each usually (but not necessarily) one bit wide, with some degree of repeat ability. Using fuzzy extraction, secure sketches, error correction and compression, a single number can be produced with very good reliability. The PUF (oscillator based) with multiple challenge-response pairs would live within an FPGA like so:-


And that's it: a set of bits. Use the set as you will. It could very well simply be the (uncloneable) device ID. PUFKY is a design for a random 128 bit cryptographic key extracted from ring oscillators. Intel have Stratix FPGAs/SoCs that incorporate on-board SRAM PUFs for protection against counterfeiting, cloning or reverse engineering. It can also be the key for cryptographic communications from the chip. You can see where the PUF fits into the Stratix:-


Circling back to software activation, a PUF is the evolved in-built "dongle" of yesteryear protecting modern software. It's just that the 'software' these days can be intellectual property like IP cores, gate/block configurations, digital signal processing algorithms etc. and communications data within and around embedded devices.

  • $\begingroup$ thanks for your explanation. In my mind, I think vendor should have a recorded set of CRPs before sending the dongle, so that it can check the received response. If they start using the built-in hardwares of the user, how do they get the info of CRPs? In other words, how do they validate the received response? $\endgroup$ – Shabnam Apr 29 '19 at 18:14
  • $\begingroup$ The CRPs themselves wouldn't be read as their responses are soft and only probability based. The manufacturer could read the downstream key which is fixed. $\endgroup$ – Paul Uszak Apr 29 '19 at 21:04
  • 1
    $\begingroup$ I should have made para.1 clearer. Software like CAD/GIS/Windows etc is commonly activated via the internet so a hard dongle isn't required. The PUF is used to protect embedded systems and micro controllers, especially their intellectual property which might be FPGA logic block configuration and it's firmware. If the micro controller wanted to 'call home', the PUFed key(s) can be used for encryption or a secure authentication code. Although this isn't the common use case. $\endgroup$ – Paul Uszak Apr 29 '19 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.