  A securely maintained key is the premise upon which data stored and
transmitted by ubiquitously deployed resource limited devices, such as those in
the Internet of Things (IoT), are protected. However, many of these devices
lack a secure non-volatile memory (NVM) for storing keys because of cost
constraints. Silicon physical unclonable functions (PUFs) offering unique
device specific secrets to electronic commodities are a low-cost alternative to
secure NVM. As a physical hardware security primitive, reliability of a PUF is
affected by thermal noise and changes in environmental conditions;
consequently, PUF responses cannot be directly employed as cryptographic keys.
A fuzzy extractor can turn noisy PUF responses into usable cryptographic keys.
However, a fuzzy extractor is not immediately mountable on (highly) resource
constrained devices due to its implementation overhead. We present a
methodology for constructing a lightweight and secure PUF key generator for
resource limited devices. In particular, we focus on PUFs constructed from
pervasively embedded SRAM in modern microcontroller units and use a batteryless
computational radio frequency identification (CRFID) device as a representative
resource constrained IoT device in a case study.
