 OK. And the last talk of the afternoon and of today is joint work with Bohan Yang, Vladimir Rochich, Miloš Gručić, and Elementants, and the English Fervorovir, and Bohan will be giving the talk. Thank you. Thank you for the introduction. And thank you for staying here for the last talk of the day. And with this talk, I would like to introduce our new TRNG, which is called ESTRNG, a high throughput, low area, true run moment generators based on the edge sampling. And as you can see, that we have a free running around authority here. And we are using a magnify to check the edge. So that's kind of a principle of our edge sampling TRNG. I'm sure some of you must seen this architecture many, many times. This is a generic architecture of TRNG. It consists of the entropy source, the digitization, the post-processing, and some online tests. And only the entropy source itself can produce true run minutes. And for other components, they are pure deterministic. And for this talk, we will focus on the digital noise source. And for other components of the architecture, will be the future work of the ESTRNG. So ESTRNG is a timing jitter-based TRNG. It has a compact implementation. It achieves a relative reasonable high throughput. And the security analysis of the ESTRNG is supported by a stochastic model. Why? Why it is important to have a stochastic model with security analysis? Because for a lot of cryptographic applications, like generating the keys, generating the initialization vectors, generating the mask, and thanks to the last speaker of the very session. And I hope our TRNG will satisfy your requirement of your random numbers. And you don't need to recycle any random numbers in the cause of a compromised security. And the security of a TRNG depends on its unpredictability. And what's the meaning of unpredictability? It means that with all your effort, an attacker cannot get an output of a TRNG. And this unpredictability cannot be measured using a statistical test, that's from these 822, like DERHA test, like fifth test. But the entropy, the unpredictability, can be estimate by using stochastic model, which is required by the ESTRNG one-times standard. And maybe it's required by the NIST 890B standard. And maybe in the future, most of them will require that. So ESTRNG is a timing jator-based TRNG. And for a free-running round-thratter, if it's noise-free, which means there's no noise. And if we know the current phase of the round-thratter and all the future phase are deterministic, we know it completely. There's no unpredictability at all. But in the real world, there's always noise. And because of this noise, the phase of a free-running round-thratter become unpredictable. And a random bit is only generated when we're trying to determine the phase of the round-thratter. For example, this is the simplest timing jator-based TRNG, which is called elementary TRNG. We use a different flow to sample the signals in the free-running round-thratter. And if the rising edge of the sampling signal is after the closest rising edge of the signal in the free-running round-thratter, the result will be encoded as 0. And if it's before, it will be encoded as 1. So for the best-case scenario, the rising edge of the sampling signal will be aligned with the rising edge of the signal in the free-running round-thratter. And we will have the same probability to have 0 and 1. But when we're designing a TRNG, we cannot realize on the best-case scenario better. We have to realize on the worst-case scenario. And we know that there's another problem. The timing jator, the Gaussian jator, the white noise, the noise we want accumulate very slowly in free-running round-thratter, which result in a very low throughput for timing jator-based TRNG. There are many techniques to improve the throughput. One technique is just implement a lot of free-running round-thratter and put them together. It is multiple round-thratter-based TRNG. There's also a technique called coherent sampling, which uses special sampling techniques to increase the throughput. But our solution is to increase the sampling resolution. Now let's think, how can we increase the sampling resolution? The most straightforward way is to increase the sampling frequency. But the maximum, the highest sampling frequency is limited by the technology, by the platform, by the system, by the power, by the energy. It can be limited by anything. Is there anything else we can do? For example, we have a TRNG implemented on FPGA. And if we directly sample the signals on the FPGA, maybe the maximum sampling frequency we can achieve is around 300 megahertz and 400 megahertz, can we do something even better? Yes, we can. We proposed the DCTRNJ at DEC 2015. And the DCTRNJ utilized time to digital count water to sample the signals in the free-running round-thratter. And the signals of the free-running round-thratter propagates through the type delay chain. And it is a representative of the signals on the type delay chain. So when we take the sample, we will have some consecutive ones and zeros, the edge representing the edge of the signal. And in the DCTRNJ, we implemented on the Zelenx Spartan 6 platform. And the minimal steps of the delay elements on Spartan 6 is around 17 picosecond in average, which is corresponding to sample the free-running round-thratter at the frequency of around 60 gigahertz, which cannot be achieved by just sampling the free-running round-thratter. And according to the principle of the DCTRNJ, the type delay chain need to be long enough to capture at least half period of the signal of the free-running round-thratter. Now here comes the problem. The fastest free-running round-thratter on the Spartan 6 we can implement is one lookup table. And the average period is around 2.2 nanoseconds. Let's do the simple math here. 2,200 picoseconds divided by 2, because we only need half period of it, divided by 17 picoseconds, because that's the average delay for each delay elements, divided by 4, because for each slice of Zellix FPJ, it consists of a primitive called carry4, which consists of four delay elements. And the result is 17, which means that we have to cascade 17 slices together to form the delay chain. And because of the variance of the temperature, wattage, we want to provide some safety margins, so maybe a reasonable number will be 20 here. 20 slices is not a lot on FPJ, but it's also not small. Especially we have to cascade them together in a row. Maybe it will among several different club regions. Can we do something different and better? We can. That's the ESTRJ we proposed today. So instead of using a long type delay chain, we only use one type delay chain. And of course, now we cannot sample the whole half period of the signal there, which means that the stochastic model and the security analysis of the ESTRJ has been changed completely. And now let's have a closer look at the ESTRJ architecture. So the realtor1 is the noise source. And the signal propagates through the type delay chain. And the sample of the type of addition is triggered by another free rendering oscillator. And the sample result is encoded using a bit extractor. And as you can see that this is a true stable to show how we handle the sample data. And as you can see that if the sample data is all 1s and all 0s, we are not going to encode the output. We are not going to generate the random bit. And that's a technique we use called variable precision-facing coding. So we can have a detailed explanation here. So the signals here propagates through the type delay chain. And if we take the sample now, the sample result will be 1, 1, 1. And according to the true stable, no output. But if the following edge appears at the first stage of the delay chain, the sample result will be 1, 1, 0, which will be encoded as 1. And the same thing for if the following edge is at the second stage. And similar storage holds for all the sample results. It's all 0s, all for the rising edge. So now let's have a generic look at what's the variable precision-face encoding. The principle here is that we only encode the face, which is close to the edge of the signal. And for the rest of the signal, we just discard them. And this is the intuitive pictures. So as you can see here, the high precision region, which is encoded as 1 and 0, is relative to the same face as the low precision region. But in the real case, the high precision region will be very narrow, very small, much smaller than the region for the low precision region. So that's why we need the second technique we proposed in the paper to increase the throughput. But before that, it is very interesting to notice that if we encoded the whole period here as 1 and whole period here as 0, it is equivalent to the elementary TNG. So this is the second technique we use. It's called repetitive sampling. And this is the timing diagram. First, we enable the free-running oscillator 1 a little bit while. And we let it accumulate jitter. Then we enable the oscillator 2 to sample the signal. And the sample signal might not be with the edge. It can be all 0s, all 1s. And we just keep sampling until there is the edge being captured. We know that we know there's dependency between each samples here. And this dependency is taken into account when we were developing the stock-husty model. And talking about the stock-husty model, we need to have some, we need to measure some platform parameters for the stock-husty model. For example, we measure the average period of the free-running oscillators. We measure the delays for the delay chance. We measure the jitter strength. And we measure the duty cycle. And once we have all the platform parameters, we have to determine what's the design parameters. Here is the example. We use different jitter accumulation time as input for our stock-husty model. And as you can see that, as increasing of the jitter accumulation time, the lower bound of the estimate entropy is also increased. And the goal of designing ESTRJ is to achieve the optimal throughput while maintaining a minimal entropy density at the output, which fulfilled the requirement of the AS31 standard, which is 0.997 per bit. And we go through all possible design parameters we can choose, like the jitter accumulation time and the stages of party filters we use as post-processing. And the optimal solution is achieved as jitter accumulation time equals to 250 nanoseconds. And I want to note that all the entropy here is the entropy claimed by our stock-husty model. And according to the experiment we did, the entropy estimate by the standard test is always larger than entropy claimed by our stock-husty model. This is architecture how we implement our ESTRJ on Dylings-IPJ. We use lookup tables to implement free-running oscillators and edge detectors and also the rob-e-thing order. And we use carry four as the type deletion to sample the signal. And in total, we utilized five leaf-leaf blocks, one carry four, and the turn lookup tables. It shows that our ESTRJ is indeed quite compact. And as a conclusion, our ESTRJ has compact hardware implementation on both Dylings and the Intel FPGA. It achieved a relative high throughput, which is around one megabit per second on both Dylings and Intel FPGA. And its security analysis is supported by a stock-husty model. And I would like to invite all of you to check the details of our papers, because in the paper we will have the details of the stock-husty model and also the comparison with other TRNJs as well. And in the future, we will put more resources of the DCTRNJ and ESTRJ in this link. Thank you very much for your attention. And if there's any questions, I would like to answer them. Questions? No questions? OK, so maybe someone will come up with a question. In the meantime, I'd like to ask a short question. So if you look at your construction for the TRNJ, it's actually quite similar to a delay type of construction. So have you looked at the relationship that these two primitives have? And do you think that some of the ideas that you have explored here could be transferred to that domain or vice versa? Thank you very much for that question. Actually, it is true. I will show the slides where the delay path. So the delay chain of the FPGA, it may have some nonlinearities. And actually, we proposed a delay chain-based path, which was published at the FPL last year. It's called the Monte Carlo path, which utilizes the physical intrinsic delay of delay elements as a path materials. And so indeed, like you said, the delay elements can be used both for TRNJ and for the path. But if we are using the delay as the elements for the path, we are using delays to measure either the timing difference or measuring the intrinsic delay of the delay elements. But the way we use the delay elements in the DC-TRNJ or ES-TRNJ is that we are utilizing the minimal steps of the delay elements as a ruler to measure the signal, to measure the position of the signal. OK. Thanks. Thank you. Any more questions? OK, let's thank the speaker again. Thank you. And I think this ends the first day of chess, 2018. And you're all welcome to the reception, which is following in about 15 minutes, I think.