EP2052319A1

EP2052319A1 - Device and method for generating a random bit string

Info

Publication number: EP2052319A1
Application number: EP07805161A
Authority: EP
Inventors: Boris Skoric; Pim T. Tuyls; Roelof H. W. Salters; Hans P. Tuinhout; Antonius H. M. Akkermans
Original assignee: Koninklijke Philips Electronics NV
Current assignee: Intrinsic ID BV
Priority date: 2006-07-31
Filing date: 2007-07-16
Publication date: 2009-04-29
Also published as: JP2009545908A; WO2008015603A1; CN101495957A

Abstract

The invention relates to generating a bit string based on the circumstances of a breakdown of a diode or a number of diodes (11, 21, 31, 41, 51). One or more diodes (11, 21, 31, 41, 51) are fed with a voltage exceeding a breakdown voltage of the diodes (11, 21, 31, 41, 51) connected to a diode breakdown processor (13, 23, 33, 43, 53), which detects the breakdown and optionally relevant circumstances such as an exact breakdown voltage, and generates a bit string based on the detection, which may be used as a unique identifier or as a secret key.

Description

DEVICE AND METHOD FOR GENERATING A RANDOM BIT STRING

FIELD OF THE INVENTION

The present invention relates to a device and a method for generating a bit string, in particular a bit string representing a cryptographic key or a unique identifier.

BACKGROUND OF THE INVENTION

In many electronic devices, such as smart cards, cell phones, DRM hardware, and chips in general, there is a need for unique identifiers and/or secret cryptographic keys embedded in the hardware. Conventionally, a chip is provided with such identifiers/keys in a separate process, after manufacture of the chip itself. One method is to set the value of what are called "fuses". Another method is to equip the chip with an additional EEPROM into which the identifier/key can be written.

However, bit strings stored by means of these methods can be read out rather easily, which is problematic especially if the bit string is to be used as a secret key. Once the bit string is known to an attacker, it is easy for him to create a clone of the chip, containing the same secret as the original chip, or to write a computer program that can mimic the behavior of the chip.

Furthermore, the extra writing process is costly and the EEPROM even introduces extra cost. The EEPROM has an extra drawback because an attacker may change the stored data. In order to avoid the extra cost and to achieve better security, it has been proposed in the prior art that bit strings should not be derived from stored values, but from some physical property of the chip itself, such as resistances, conductances, capacitances or delay times (cf. R. Posch, Protecting Devices by Active Coating, Journal of Universal Computer Science, vol.4, no.7 (1998), pp.652-668; B. Gassend, D. Clarke, M. van Dijk, S. Devadas, Silicon Physical Random Functions, Proc. 9th ACM Conf. on Computer and Communications Security, Nov. 2002).

Such a physical property is sometimes called a Physical Uncloneable Function (PUF) or a Physical Random Function if the property is to some extent uncontrollable during manufacture of the relevant device. The lack of controllability is advantageous because it allows deriving a bit string from a value of the property which is random and unique with a very high probability.

Using PUFs has advantages over the above methods in that: the production cost may be reduced, - it is hard for an attacker to read the values of the relevant physical parameters from "outside" the chip, a chip virtually cannot be cloned even if an attacker has obtained the secret key or the identifier, and a PUF provides some inherent tamper detection, as many types of probing attacks will measurably influence the relevant physical parameters from which the bit string is derived.

However, several drawbacks are related to different types of PUFs. For example, it is rather complex and costly to integrate an optical PUF (cf. R. Pappu, Physical One- Way Functions, PhD thesis, MIT 2001) into a structure of an integrated circuit or a chip, most of all because of the needed optics which result in higher costs than implementation of other types of PUF. Furthermore, the processing of the acquired sensor data (e.g. a large bitmap) requires many resources. It is assumed that it is possible to guess or predict a bit string generated from delay times of an integrated circuit (cf. B. Gassend, D. Clarke, M. van Dijk, S. Devadas, Silicon Physical Random Functions, Proc. 9th ACM Conf. on Computer and Communications Security, Nov. 2002) with a significant hit rate. According to what is known about exploiting e.g. a resistance or a conductance of structures (cf. R. Posch, Protecting Devices by Active Coating, Journal of Universal Computer Science, vol.4, no.7 (1998)) extra efforts are necessary to avoid that the relevant property may easily be read out from outside the chip. Another drawback of this approach is that even current production methods allow good control of the property. It may thus be possible to "clone" such a physical random function.

OBJECT AND SUMMARY OF THE INVENTION

It is an object of the present invention to provide a device and a method for generating a bit string, in particular a bit string representing a cryptographic key or a unique identifier, which overcomes or avoids the above-mentioned drawbacks.

In particular, it is an object of the present invention to provide a device and a method for generating a bit string using a physical random function, wherein a chip in which the invention is implemented is able to perform the physical measurement without too much effort, in particular with a reasonable delay time, power consumption, CPU load and memory usage.

In a first aspect of the present invention, a device for generating a bit string is provided, which comprises: - at least one diode, connectors connected to said at least one diode for applying a voltage to said at least one diode, and a diode breakdown processor connected to said at least one diode for detecting a breakdown of said at least one diode resulting from a voltage applied to said at least one diode, which exceeds a breakdown voltage of said at least one diode, and for generating said bit string on the basis of said detection of said breakdown.

In a further aspect of the present invention, an apparatus, which - in contrast to the device described above - does not comprise any diodes itself, for generating a bit string is provided, which comprises: - connectors for connecting at least one diode to said apparatus and for applying a voltage to said at least one diode, and a diode breakdown processor connected to said connectors for detecting a breakdown of said at least one diode connected to said connectors resulting from a voltage applied to said at least one diode, which exceeds a breakdown voltage of said at least one diode, and for generating said bit string on the basis of said detection of said breakdown.

In yet a further aspect of the present invention, a method of generating a bit string is provided, which comprises the steps of applying a voltage to at least one diode, which exceeds a breakdown voltage of said at least one diode, - detecting a breakdown suffered by said at least one diode resulting from the application of said voltage, and generating a bit string on the basis of said detection of said breakdown.

Another aspect of the present invention includes a computer program comprising program code means for causing a device or an apparatus according to the present invention to carry out the steps of the method according to the present invention when said computer program is carried out on said device or said apparatus. The computer program might itself completely contain the program code for implementing all the steps of the corresponding method in software, or might simply be a short script or link that refers to or makes use of such a complete computer program. A further aspect of the present invention includes the use of a diode for generating a bit string, wherein the bit string is generated on the basis of a breakdown of the diode resulting from a voltage applied to said diode, which exceeds a breakdown voltage of said diode. Preferred embodiments of the invention are defined in the dependent claims. It will be understood that the device, the apparatus, the method and the computer program of the present invention have similar and/or identical preferred embodiments as defined in the respective dependent claims.

The invention is based on the insight that the circumstances of a breakdown of a diode are complex enough for the diode suffering a breakdown to be used as a physical uncloneable function (PUF) or physical random function, because the exact voltage value at which a breakdown would occur is virtually uncontrollable during manufacture and virtually impossible to predict by ordinary inspection of the diode. A plurality or an array of diodes exhibits an even more complex behavior resulting in a larger variety of responses to challenges given to the diodes. Furthermore, a diode breakdown is not only a complex and virtually unpredictable event (in its exact value) but may also be easily detected by simple means of common integrated circuits. Thus, exploiting a breakdown of a diode or a number of diodes for generating a bit string allows including a PUF into an integrated circuit without a need for complex additional equipment. The present invention relates to generating a bit string based on the circumstances of a breakdown of a diode or a number of diodes. One or more diodes are provided with a voltage exceeding a breakdown voltage of the diodes, which are connected to a diode breakdown processor detecting the breakdown and, optionally, relevant circumstances like an exact breakdown voltage and generates a bit string based on the detection of this breakdown. The bit string may be used as a unique identifier or as a secret key.

The present invention provides the advantageous effect that additional components and sensors for embodying such a PUF and, if necessary, for reading out the PUF are inexpensive and easy to handle. In an ideal case, the PUF consists of components that are already present in the chip. Thus, a PUF having an entropy (information content) which is large enough to be able to derive sufficiently long bit strings (e.g. 40 bits for an identifier; 128 bits for an AES key) can be obtained, so that an attacker will not be able to guess the bit string. Furthermore, for example, electromagnetic emissions, power consumption, and other "side channels" during a PUF measurement of a chip in which the invention is implemented do not enable an attacker to derive the bit string, which is particularly useful if the bit string represents a secret (key).

BRIEF DESCRIPTION OF THE DRAWINGS These and other aspects of the invention are apparent from and will be elucidated with reference to the embodiments described hereinafter. In the drawings,

Fig. 1 shows a first embodiment of a device according to the present invention;

Fig. 2 shows a second embodiment of a device according to the present invention, together with an external voltage source;

Fig. 3 shows a third embodiment of a device according to the present invention, together with an external voltage source;

Fig. 4 shows a first embodiment of an apparatus according to the present invention, together with an external plurality of diodes; Fig. 5 shows a second embodiment of an apparatus according to the present invention, together with an external plurality of diodes and an external voltage source; and Fig. 6 is a flow chart of a method according to the present invention.

DESCRIPTION OF EMBODIMENTS Fig. 1 shows a first embodiment of a device 10 according to the present invention. The device 10 comprises a diode 11, a diode breakdown processor 13 and a voltage source 15. The diode 11 is connected with the voltage source 15 via connectors 12 and the diode breakdown processor 13, which is arranged parallel to diode 11, is also connected to these connectors 12. The voltage source 15 is adapted to apply a voltage in reverse bias direction to diode 11. As long as the voltage applied to diode 11 is lower than its breakdown voltage, this diode 11 is non-conducting and no or only a small current will flow. Once the voltage applied to diode 11 exceeds its breakdown voltage, this diode 11 will break down and a (larger) current will flow. The diode breakdown processor 13 detects a breakdown of diode 11 and, based on this detection, a bit string is generated by breakdown processor 13.

In this embodiment, the voltage at which the breakdown occurred is detected and serves as a basis for generating the bit string. The diode breakdown processor 13 then outputs this generated bit string. Since the bit string is derived from a characteristic of diode 11, which is unique to this diode 11, the generated bit string may serve as an identifier of the device 10.

A number of different ways and methods for detecting a breakdown are known to the skilled person and a detailed description of the diode breakdown processor 13 may therefore be omitted here. For example, a dedicated circuit may be used, which is able to detect the breakdown by detecting the (increased) current flowing through the diode 11 at a breakdown, as well as a general purpose integrated circuit or processor connected to the diode 11 in a suitable way. Changing the state of a flip-flop (e.g. included in the diode breakdown processor 13) may be used for recording a diode breakdown. In cases in which the generated bit string is to be used as an identifier, it is preferable to provide a diode which may suffer a breakdown without taking damage so that the bit string, i.e. the identifier, may be read out repeatedly.

Fig. 2 shows a second embodiment of a device 20 according to the present invention together with an external voltage source 25. The device 20 comprises a plurality of diodes 21 which are arranged in parallel, a diode breakdown processor 23, a plurality of resistors 27 and two connectors 22. The diode breakdown processor 23 is arranged in series with the plurality of diodes 21 and is connected separately to each diode 21 of this plurality. A resistor 27 of the plurality of resistors 27 is arranged in series with each diode, each resistor having a resistance of 1 MΩ. In the present embodiment, a line is formed from one connector 22 through the breakdown processor 23, the plurality of diodes 21 and the plurality of resistors 27 to the other connector 22. During operation, the device 20 is connected to a controllable voltage source 25 via the connectors 22.

During operation, the external voltage source 25 provides a voltage to the connectors 22 and thus to the plurality of diodes 21 in reverse bias direction. The voltage is controlled to rise from a lower voltage value to a higher voltage value. During this voltage sweep, breakdown voltages of diodes 21 of the plurality of diodes 21 are reached and exceeded, wherein the order in which the diodes 21 suffer a breakdown depends on their respective breakdown voltages. The occurrence of a breakdown in a diode 21 is detected by the diode breakdown processor 23 and, based on this detection, a bit string is generated. Since the diode breakdown processor 23 is connected separately with each diode 21, the occurrence of a breakdown can be related to the particular diode 21 in which the breakdown occurred. Thus, not only the occurrence of breakdowns is detected but also the order in which the diodes 21 suffered a breakdown. The diode breakdown processor 23 generates the bit string based on the detected order. In this embodiment, two diodes 21 are considered to form a pair of diodes leading to four pairs of diodes 21. Depending on which one of the diodes 21 of each pair suffers a breakdown first, a respective bit of a four-bit string is set or not set. There are other possible ways of generating the bit string based on the breakdowns of the diodes. For example, a part of the bit string may be calculated from the (exact) value of the breakdown voltage of one diode and several of such parts are then combined to form the bit string. Furthermore, it may be decided on the setting of a particular bit of the bit string whether or not a breakdown occurred for a particular diode during e.g. the first half of the voltage sweep.

In the case of a breakdown, a resistance of the diode which suffered the breakdown dramatically drops. However, the resistor 27 arranged in series with the diode 21 prevents a high current from flowing through this diode 21 which could otherwise damage it.

In a modification of the present embodiment, the voltage sweep is no sweep in the normal sense but is reduced to a single voltage which is applied to said plurality of diodes 21. In this case, the lower voltage value and the higher voltage value are the same and there is no detectable order in which the diodes suffer a breakdown. However, depending on the applied voltage, some diodes will suffer a breakdown and the others will not. The result of this single- voltage "sweep" also forms a suitable basis for generating a bit string.

In the present embodiment, the plurality of diodes comprises eight diodes. However, it will be evident that the number of diodes in the plurality of diodes may also be any other number depending on the size of the bit string to be generated and the way of generating the bit string based on the breakdown of diodes. This also applies to other embodiments of the present invention described herein.

Furthermore, in the present embodiment, the resistors 27 have a resistance of 1 MΩ, but they may of course have a different resistance (preferably at least 100 kΩ) which, if necessary, ensures that the current flowing through a diode during or after breakdown is small enough to avoid damage. Other ways of controlling the current known to the skilled person may be used instead or additionally.

However, in a different implementation of the present invention, it may be desired to limit the number of operations a device according to the invention is capable of, or to limit the number of times a diode may be used for generating a bit string to a given number. In such an embodiment, it may be desirable not to provide resistors or some other current control in order to ensure that the diodes are terminally damaged after a given number ofuses. The order in which different components are arranged in a serial connection is not important for the present invention. A different order of arrangement may be chosen for implementing the present invention.

In an alternative embodiment, which is quite similar to that of Fig. 2, the external voltage source 25 is adapted to provide a predetermined voltage sweep, wherein the diode breakdown processor 23 is adapted to detect a start of the predetermined voltage sweep and the times at which breakdowns occur in the plurality of diodes. Similar to the embodiment described above with reference to Fig. 2, it is not necessary in this alternative embodiment to measure the voltage at which a breakdown occurs, as, for generating a bit string depending on the breakdown characteristics of the plurality of diodes, it is sufficient to detect the order or time of the breakdowns.

Fig. 3 shows a third embodiment of a device 30 according to the present invention, together with an external voltage source 35. The device 30 comprises a plurality of diodes 31 arranged in parallel, a diode breakdown processor 33, a voltage meter 36 arranged in parallel to the plurality of diodes 31 and a resistor 37. The device 30 further comprises two connectors 32, which are connected by the diode breakdown processor 33, the plurality of diodes 31 and the resistor 37 arranged in series, and a memory unit 38. The diode breakdown processor 33 is connected to a memory unit 38 for receiving data therefrom upon request. The diode breakdown processor 33 is further connected to the voltage meter 36 for receiving data on a voltage applied to the plurality of diodes 31. One of the diodes 31 of the plurality is a reference diode 31 '. During operation, the external voltage source 35 is connected to the device via the connectors 32. Furthermore, there is a data link between the external voltage source 35 and the diode breakdown processor 33.

The external voltage source 35 is adapted to generate a voltage sweep ranging between a lower voltage and a higher voltage in accordance with a predetermined function of time, to apply this voltage sweep to the device 30 (and thereby to the plurality of diodes 31 within the device 30) and to transmit an indication of this voltage function of time to the diode breakdown processor 33. Provided the higher voltage exceeds the breakdown voltages of the diodes, each diode 31 of the plurality of diodes 31 will suffer a breakdown during the voltage sweep, the time of which breakdown is detected by the diode breakdown processor 33. The voltage at which a breakdown occurred is detected by the voltage meter 36 and transmitted to the breakdown processor 33. Again, similar to the embodiment described with reference to Fig. 2, the resistor 37 prevents that a current which is high enough to damage the diodes 31 flows through the diodes 31. In this embodiment, the diode breakdown processor 33 has acquired data on the points of time at which breakdowns of diodes occurred (with reference to a starting time of the voltage sweep) and data on the voltages at which breakdowns occurred (measured by the voltage meter). Furthermore, a breakdown voltage of the reference diode 31 ' is stored in the memory unit 38 which also comprises helper data for use in a key-extraction algorithm. The helper data is acquired during an enrolment phase of the device and then stored in the memory unit 38. Based on all these data, the diode breakdown processor 33 can calculate the actual breakdown voltages of the plurality of diodes 31 with a high accuracy compensating any noise factors from sources such as, for example, temperature fluctuations, external electromagnetic fields, mechanical pressure, radiation, moisture or vibrations. A bit string is then generated on the basis of the obtained breakdown voltages. The generation of this bit string will have a high reproducibility allowing very reliable use of this bit string as an identifier identifying the device 30.

Fig. 4 shows an embodiment of an apparatus 40 according to the present invention, together with an external plurality of diodes 41. The apparatus 40 comprises a diode breakdown processor 43, a controllable voltage source 45 and a resistor 47 arranged in series with connectors 42 for connecting the external plurality of diodes 41. The external plurality of diodes 41 is comprised in a carrier unit 49. The operation of the complete arrangement is similar to that of the devices according to the invention described above. A further detailed description may therefore be omitted here. The main difference with the devices described above is that the plurality of diodes 41 is provided separately from the apparatus 40 comprising the diode breakdown processor 43. This allows replacement of the plurality of diodes by a different plurality of diodes. A carrier unit 49 comprising a plurality of diodes 41 having breakdown voltages which are intrinsically random in terms of their relative and absolute values may thus be used for transporting a (secret) key for cryptographic purposes.

Fig. 5 shows a further embodiment of an apparatus 50 according to the present invention, together with an external plurality of diodes 51 and an external voltage source 55. The apparatus 50 comprises a diode breakdown processor 53 which is provided with five connectors 52. The diode breakdown processor 53 is separately connected via four of the connectors 52 to each diode of an external plurality of diodes 51, which are arranged in parallel. An external resistor 57 and an external voltage source 55 are connected in series with the external plurality of diodes 51, the external voltage source 55 being connected to the diode breakdown processor 53. Again, the operation of the arrangement is similar to that of the above-described devices according to the invention, so that a further detailed description is not necessary. Other than in the arrangement shown in Fig. 4, the resistor and the voltage source in this embodiment are not provided within the apparatus but are comprised by a carrier unit 59 together with the plurality of diodes. Fig. 6 is a flow chart of a method according to the present invention. In a first step 1, a voltage is applied to at least one diode wherein the voltage is higher than a breakdown voltage of this at least one diode, so that it suffers a breakdown. This breakdown is detected in a subsequent step 2, and a bit string is generated on the basis of the detection in a further step 3. In the context of the present invention, the term "bit string" does not only refer to a series of symbols having two different values or states, like the commonly used series of "0" and "1", but also to series of symbols having a larger variety of values, e.g. each symbol having three different states or values.

For example, an n-bit symbol can be obtained from each diode by first dividing the whole interval of possible breakdown voltages into 2ⁿ equal-probability subintervals. These intervals are labelled 0,1, ... 2^{n l}. The breakdown voltage of one diode belongs to interval number x. The interval number x then is the PUF "response", which is an unpredictable n-bit value. It should be noted that the number of intervals does not have to be a power of 2 and that, instead of the voltage axis, the time axis can also be divided into intervals.

It will be understood that, in the context of the present invention, there is no relevant difference between these ways of encoding information because one series can easily be translated into a series encoding the same information in a different way.

The terms "breakdown" and "breakdown voltage" are well understood by those skilled in the art. However, depending on the particular circumstances of an implementation of the present invention, it is possible to give these terms a different meaning. For example, instead of taking the voltage value at which a breakdown starts (which is hard to find exactly in some cases) as the breakdown voltage, a voltage value may also be taken as the "breakdown voltage" at which the current through the diode reaches or exceeds a selected value or at which the diode exhibits in reverse bias a predetermined differential resistance.

The invention has been illustrated and described in detail in the drawings and the foregoing description. However, such an illustration and description have been given by way of example and are therefore not to be considered as limiting. Moreover, the invention is not limited to the disclosed embodiments.

Other variations of the disclosed embodiments can be understood and effected by those skilled in the art in practicing the claimed invention, from a study of the drawings, the disclosure, and the appended claims.

In the claims, use of the verb "comprise" and its conjugations does not exclude other elements or steps, and the indefinite article "a" or "an" does not exclude a plurality. A single unit may fulfill the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

A computer program may be stored/distributed on a suitable medium, such as an optical storage medium or a solid-state medium supplied together with or as part of other hardware, but may also be distributed in other forms, such as via the Internet or other wired or wireless telecommunication systems. Any reference signs in the claims should not be construed as limiting the claim.

Claims

CLAIMS:

1. A device (10, 20, 30) for generating a bit string, said device comprising: at least one diode (11, 21, 31), connectors (12, 22, 32) connected to said at least one diode (11, 21, 31) for applying a voltage to said at least one diode (11, 21, 31), and - a diode breakdown processor (13, 23, 33) connected to said at least one diode

(11, 21, 31) for detecting a breakdown of said at least one diode (11, 21, 31) resulting from a voltage applied to said at least one diode (11, 21, 31), which exceeds a breakdown voltage of said at least one diode (11, 21, 31), and for generating said bit string on the basis of said detection of said breakdown.

2. A device (20, 30) as claimed in claim 1, comprising a plurality of diodes arranged in parallel.

3. A device (10) as claimed in claim 1, further comprising a voltage source (15) connected to said connectors (12) for applying said voltage to said at least one diode (11).

4. A device (20, 30) as claimed in claim 1, wherein said connectors (22, 32) are adapted to connect an external voltage source (25, 35) to said at least one diode (21, 31).

5. A device (10, 20, 30) as claimed in claim 3 or 4, wherein said voltage source

(15, 25, 35) is adapted to apply a voltage sweep ranging between a predetermined lower voltage and a predetermined higher voltage to said at least one diode (11).

6. A device (10) as claimed in claim 1, wherein said diode breakdown processor (13) is adapted to detect a breakdown voltage of said at least one diode (11).

7. A device (20, 30) as claimed in claim 2, wherein said diode breakdown processor (23, 33) is adapted to detect, during a predetermined voltage sweep applied to said plurality of diodes (21, 31), at least one of: a timing of at least one breakdown of a diode (21 , 31 ) of said plurality o f diodes (21, 31), and an order in which diodes (21 , 31 ) of said plurality of diodes (21, 31) suffer a breakdown.

8. A device (20, 30) as claimed in claim 7, wherein said diode breakdown processor (23, 33) is adapted to receive information about the time dependence of the voltage sweep, and/or measure a voltage applied to said plurality of diodes.

9. A device (20, 30) as claimed in claim 2, wherein said diode breakdown processor (23, 33) is adapted to detect which diodes (23, 33) of said plurality of diodes suffered a breakdown upon application of a predetermined voltage.

10. A device (20, 30) as claimed in claim 2, wherein said plurality of diodes (21,

31) includes a reference diode (31 '), and said diode breakdown processor is adapted to detect a difference between a breakdown voltage of said reference diode (31 ') and a breakdown voltage of a diode (21, 31) of said plurality of diodes (21, 31) different from said reference diode (31 ').

11. A device (30) as claimed in claim 1, further comprising a memory unit (38) connected to said diode breakdown processor (33), wherein said diode breakdown processor (33) is adapted to generate a bit string from a detected breakdown voltage of said at least one diode (31) by means of a key-extraction algorithm using predetermined helper data contained in said memory unit (38) during operation.

12. A device (20, 30) as claimed in claim 1, further comprising a resistor (27, 37) arranged in series with each of said at least one diode (21, 31), in particular a resistor (27, 37) having a resistance of 100 kΩ or more.

13. A device (10, 20, 30) as claimed in claim 1, wherein said at least one diode (11, 21, 31) is capable of suffering a breakdown without getting damaged.

14. A device (10, 20, 30) as claimed in claim 1, wherein said at least one diode

(11, 21, 31) is adapted to have a changed breakdown behavior after suffering a predetermined number of breakdowns.

15. An apparatus (40, 50) for generating a bit string, said apparatus comprising: connectors (42, 52) for connecting at least one diode (41, 51) to said apparatus (40, 50) and for applying a voltage to said at least one diode (41, 51), and a diode breakdown processor (43, 53) connected to said connectors (42, 52) for detecting a breakdown of said at least one diode (41, 51) connected to said connectors (42 52) resulting from a voltage applied to said at least one diode (41, 51), which exceeds a breakdown voltage of said at least one diode (41, 51), and for generating said bit string on the basis of said detection of said breakdown.

16. An apparatus (40) as claimed in claim 15, further comprising a voltage source (45) connected to said connectors (42).

17. Use of a diode (11, 21, 31, 31 ', 41, 51) for generating a bit string, wherein the bit string is generated on the basis of a breakdown of said diode (11, 21, 31, 31 ', 41, 51) resulting from a voltage applied to said diode (11, 21, 31, 31 ', 41, 51), which exceeds a breakdown voltage of said diode (11, 21, 31, 31 ', 41, 51).

18. A method of generating a bit string, the method comprising the steps of: applying a voltage to at least one diode (11, 21, 31, 31', 41, 51), which exceeds a breakdown voltage of said at least one diode (11, 21, 31, 31 ', 41, 51), - detecting a breakdown suffered by said at least one diode (11, 21, 31, 31 ', 41,

51) resulting from the application of said voltage, and generating a bit string on the basis of said detection of said breakdown.

19. A computer program comprising program code means for causing a device (10, 20, 30) as claimed in claim 1 or an apparatus (40, 50) as claimed in claim 15 to carry out the steps of the method as claimed in claim 18 when said computer program is carried out on said device (10, 20, 30) or said apparatus (40, 50).