What stops a physical attacker to use a dumped uninitialized SRAM with SRAM-PUF?

Question

Does SRAM-PUF require the microcontroller/system to be (1) on the same silicon piece and (2) to prevent access from dumping the SRAM in an uninitialized state in order to be tamper-proof?

In SRAM PUF, there are two types of challenges that can be applied to the system. The challenge can be either the whole SRAM memory or specific addresses.

source: *Setyawan Sajim, A. (2018). Open-Source Software-Based SRAM-PUF for Secure Data and Key Storage Using Off-The-Shelf SRAM.

Does it mean that the response is only derived from the content of the SRAM in an uninitialized state? How can this be tamper-proof? As an attacker, I could just dump the content of the SRAM in an uninitialized state.

Answer 1

Does it mean that the response is only derived from the content of the SRAM in an uninitialized state?

For the raw RAM-PUF response, that's my understanding. How that is turned into a stable value (in practice identical across power-up cycles) is more complex, and requires long-term storage like conventional Flash for associated error-correction data (which at least in principle needs not be secret).

How can this be tamper-proof?

My understanding is that the implicit attack model here includes: the adversary has no physical access to the RAM, and can't remotely read it in its power-up state. Perhaps the early stages of boot read the initial state of the RAM, use that, then zero that RAM.

Update: as noted in comment, if we assume that getting access to the content of the RAM-PUF at power-up is impossible without de-caping the IC, and such de-caping alters the RAM-PUF beyond the error-correction capability of the associated error-correction data, then the RAM-PUF can become a tamper-resistant vault for a secret key. I have no information about if the above assumptions hold in practice (and welcome input on that).

Another attack model commonly considered for RAM-PUF is that the attacker only attempts to make a silicon-level exact copy, or steal ICs on the fabrication line (perhaps rejects). That adversary is unable to write in Flash the associated error-correction data which, together with the unique content of the RAM-PUF, makes the device operative. In this model, reading the initial content of the RAM won't help the adversary bound to not redesign the IC.