Spin dice: A scalable truly random number generator based on spintronics

Random numbers (RNs) are a fundamental building block of modern cryptographic systems. Much effort has been devoted to developing better random number generators (RNGs). Taxonomically, RNGs can be categorized into two distinct groups: pseudo-RNGs (PRNGs) and truly RNGs (TRNGs). PRNGs are implemented in software and use deterministic algorithms to generate a sequence of RNs. They require seeds of RNs and will always generate the same sequence of RNs from the same seed. Thus, they are considered to be cryptographically insecure. For highly secure data encryption we need TRNGs, which are implemented in hardware and generate a sequence of RNs using a nondeterministic physical event such as transmission of a photon through a half mirror,¹⁾ chaotic fluctuation of a semiconductor laser,^2–6) or flux transmission in a single flux quantum device.⁷⁾ However, all of these TRNGs have a drawback in scalability, which is important for a system expected to handle a growing amount of data securely.

Since 2007, we have been studying a spintronics-based TRNG referred to as "spin dice",^8–10) in which binary RNs or random bits (RBs) are generated by using the stochastic nature of spin-transfer-torque (STT) switching^11–15) in magnetic tunnel junctions (MTJs). The basic mechanism for generation of an RB is the same as that for writing a data bit in STT magnetic random access memory (STT-MRAM).¹⁶⁾ The main difference is that the switching probability is set to be 0.5 for generation of an RB in the spin dice, whereas it should be 1.0 for STT-MRAM. Owing to the scalability of spin-torque switching, spin dice can operate as a scalable TRNG and can be integrated on a chip in high density.

At the beginning of this study, we used CoFeB/MgO/CoFeB in-plane magnetized MTJs. However, those MTJs had only a narrow magnetic field range for bistable states and a high switching current density, which caused practical difficulty in their development as spin dice. Recently, we have succeeded in developing top-free-type perpendicularly magnetized MTJs (p-MTJs) with a synthetic antiferromagnetic bottom reference layer, thereby achieving a wide magnetic field range for the bistable states around zero magnetic field as well as a lower switching current density, which resulted in a very low writing voltage (<200 mV).¹⁷⁾ This type of p-MTJ is promising for both high integration and ultra-low-voltage operation of spin dice. This inspired us to fabricate the spin dice working at zero magnetic field and evaluate the quality of generated RBs.

In this Letter, we demonstrate the generation of practical truly RNs by using a TRNG consisting of eight spin dice (p-MTJs) integrated on a single-board circuit. We show that temperature compensation for switching probability could be easily achieved by adjusting the amplitude of the current pulse. We also show that the quality of RNs could be improved by performing an XOR operation on those generated by different p-MTJs. We evaluated the quality of the RNs by using the statistical test suite NIST SP-800¹⁸⁾ and confirmed that they were practical truly RNs.

Figure 1 shows the schematic diagram of spin dice. The film stack of the p-MTJ consisted of the following: a 2-nm-thick FeB magnetic free layer with a MgO cap layer, a 1-nm-thick MgO barrier, and a CoPt/Ru/CoPt reference layer. The film was fabricated into a pillar shape by a combination of electron-beam lithography, argon ion milling, and optical lithography. The nominal cross section of the pillar was 70 × 200 nm, and the magnetoresistance ratio was about 100%. Details of the p-MTJ preparation are described in Ref. 17. The magnetic state in the free layer was switched from up to down or vice versa by applying a 200-ns-wide current pulse. The magnetic state obtained after the current pulse was observed by measuring the resistance of the p-MTJ, which was converted to an RB ("0" or "1") by a comparator.

Zoom In Zoom Out Reset image size

The switching properties of the p-MTJ are shown in Figs. 2(a)–2(d). In Figs. 2(a) and 2(b) the resistance is plotted as a function of the applied magnetic field and applied current, respectively. Owing to the tunnel magnetoresistance effect through the MgO barrier,¹⁹⁾ the resistance of the parallel (P) state is smaller than that of the antiparallel (AP) state. As shown in Fig. 2(a), the P to AP (AP to P) switchings were observed at a magnetic field of 1260 Oe (−440 Oe), which are about ten times larger than that of in-plane magntized MTJs. This means that the p-MTJ has a larger magnetic field margin and stable operation of the spin dice can be possible practically at zero magnetic field. The resistances of the P and AP states were 212 and 411 Ω, respectively. As shown in Fig. 2(b), the P to AP (AP to P) switchings were observed at a current of 0.75 mA (−0.27 mA), which corresponds to 160 mV (−110 mV). The fact that the resistances of the P and AP states were the same as those observed in magnetic field switching [Fig. 2(a)] confirms that perfect magnetization switching was achieved by the current pulse. It should be noted that, because of the small product of resistance and area (∼3 Ω µm²), the switching voltage of the p-MTJ was as low as <200 mV for both switching directions, which is a great advantage for realizing spin dice with high integration and ultra-low-voltage operation.

Zoom In Zoom Out Reset image size

It is known that thermal agitation causes the switching field of a small magnet to have a distribution.²⁰⁾ Similarly, the switching current of a p-MTJ nano-pillar also has a distribution as a result of thermal agitation, which yields the switching probability expressed as²¹⁾

$$\begin{equation} P_{\text{sw}}(I) = 1 - \exp\left\{- \frac{t}{\tau_{0}}\exp\left[- \Delta \left(1 - \frac{I}{I_{\text{c0}}} \right)^{2} \right] \right\}, \end{equation} \tag{ 1 }$$

where t is the duration of the current pulse, τ₀ is the attempt time, Δ is the thermal stability parameter of the nanomagnet, and I_c0 is the critical switching current at 0 K.

In Fig. 2(c) the switching probabilities P_sw obtained from 4 × 10³ switching events are plotted as a function of current, which is well reproduced by Eq. (1) with τ₀ = 1 ns, t = 200 ns, Δ = 109, and I_c0 = 0.96 mA. As shown in Fig. 2(c), P_sw gradually increases with increasing current from I = 0.7 to 0.8 mA, which enables us to precisely control P_sw by altering the current. The temperature dependence of P_sw at I = 0.73 mA is shown in Fig. 2(d). At each temperature, 2 × 10⁵ switching events were measured to obtain P_sw. One can see that P_sw exhibits good linearity between 29 and 38 °C with a slope of 0.037 °C⁻¹. Therefore, the change in P_sw caused by the temperature variation of ±10 °C can be easily compensated for by varying the current by $\sim {\mp}30$ µA.

Figure 3 schematically shows the procedure for the rolling of the spin dice. The AP and P states in the p-MTJ are assigned to the binary values "0" and "1", respectively. The yellow circles on the R–I curves shown in Figs. 3(a)–3(e) indicate the resistance states of the p-MTJ. First, an unknown state represented by two yellow circles in Fig. 3(a) is initialized to the P state by the reset pulse [Fig. 3(b)]. The magnitude of the reset pulse is large enough to initialize the p-MTJ without fail. After the reset pulse is turned off, the p-MTJ remains in the P state, as shown in Fig. 3(c). Then the free-layer magnetization of the p-MTJ is excited to a bifurcation point²²⁾ by the excite pulse [Fig. 3(d)], which corresponds to the rolling of the spin dice. The magnitude and width of the excite pulse are set to satisfy P_sw = 0.5. At the bifurcation point, thermal agitation induces a small random deviation of magnetization. As a result, the magnetization will relax to the AP or P state with the same probability of 50%. Finally, we determine whether the final state is AP or P by measuring the resistance, and thus we obtain an RB [Fig. 3(e)]. We fabricated a single-board circuit that can roll eight spin dice simultaneously at a rate of 0.6 millionbits/s and could generate the XOR bits at the same rate.

Zoom In Zoom Out Reset image size

Let us now consider the statistical properties of the RBs generated by the spin dice. To generate high-quality RNs, equiprobability of each switching event is indispensable. If P_sw is exactly equal to 0.5 for all switching events, the statistical distribution of P_sw of the generated RBs should be the same as the binomial distribution. However, the switching probability fluctuates around the nominal value of P_sw = 0.5 owing to environmental effects such as thermal and current fluctuations. This lack of equiprobability causes the deviation from the binomial distribution. To evaluate the deviation, we introduced a normalized variance defined as R_σ ≡ σ_sd/σ_bin, where σ_sd is the variance of the RBs generated by spin dice and σ_bin is that of the binomial distribution. σ_bin is given by $1/(2\sqrt{n} )$, where n is the number of RBs to be examined.

Figure 4(a) shows the histograms of P_sw for two different MTJs, MTJ1 (blue) and MTJ2 (red), obtained from every 2 × 10⁵ bits from a total of 1 × 10⁹ bits. All results shown in Figs. 4(a)–4(f) were taken at a temperature of 35.7 ± 0.1 °C. Although the histograms are Gaussian shaped, the mean value and standard deviation are not coincident with those of ideal RBs. The mean values of P_sw and R_σ were 0.513 and 3.52 for MTJ1 and 0.487 and 3.53 for MTJ2, respectively.

Zoom In Zoom Out Reset image size

In Fig. 4(b), we plot the autocorrelations of RBs generated by MTJ1 (blue) and MTJ2 (red). They are positive and decay very slowly with lag. The mean and standard deviation of the autocorrelation are ∼3 × 10⁻³ and ∼5 × 10⁻⁵, respectively. For ideal RBs obeying the binomial distribution, the mean of the autocorrelation should be zero and the standard deviation of the autocorrelation should be $1/\sqrt{n}$, where n is the number of bits. For n = 1 × 10⁹, the standard deviation of the autocorrelation is 3.2 × 10⁻⁵, which is much smaller than that for the results shown in Fig. 4(b).

The results shown in Figs. 4(a) and 4(b) imply that the quality of the sequence of raw RBs generated by the spin dice is not perfect, and an extra treatment is necessary to obtain high-quality practical RBs. It is known that performing an XOR operation between two independent RBs is useful for improving the quality of RBs. To confirm that the RBs generated by MTJ1 and MTJ2 were independent, we plotted the scatter diagram of P_sw in Fig. 4(c), which shows a good circular shape, meaning that the raw RBs generated by MTJ1 and MTJ2 were independent. We also examined the correlation of the raw RBs generated by MTJ1 and MTJ2. As shown in Fig. 4(d), the correlation between the two raw RBs was as small as within the range of ±1 × 10⁻⁴, which was the same order as the expected values for the binomial distribution (∼±3 standard deviations of the autocorrelation). From the results shown in Figs. 4(c) and 4(d), we concluded that the RBs generated by MTJ1 and MTJ2 were independent.

According to Matsui's piling-up lemma,²³⁾ performing an XOR operation on two independent RBs generates the RBs with less probability bias. Let us consider the binary variables X_i with probability $P(X_{i}) = 1/2 + \epsilon _{i}$, where $\epsilon _{i}$ is the probability bias representing the deviation from 1/2. Matsui's piling-up lemma tells us that $P(X_{1} \otimes X_{2} \cdots \otimes X_{N}) = 1/2 + 2^{N - 1}\prod\nolimits_{i = 1}^{N} \,\epsilon _{i}$. Since $|\epsilon _{i}| \ll 1/2$ for RBs generated by the spin dice, the RBs after the XOR operation rapidly approach ideal RBs with the binomial distribution. Actually, by performing an XOR operation on the raw RBs generated by MTJ1 and by MTJ2, we obtained RBs with a mean of P_sw = 0.50036 and R_σ = 1.068. These P_sw and R_σ values were almost identical to the values for the RBs obeying the binomial distribution. The histogram of P_sw and autocorrelation of the RBs after the XOR operation is performed are also shown in Figs. 4(e) and 4(f), respectively. One can clearly see that the histogram of P_sw after the XOR operation is performed is almost identical to the binomial distribution (solid line), and the autocorrelation is as small as within the range of ±1 × 10⁻⁴. The results shown in Figs. 4(e) and 4(f) indicate that performing an XOR operation on the RBs generated by different MTJs is a powerful method to improve the quality of RBs.

Next, we considered that it would be of interest to investigate how the quality of RBs would be improved by taking the nested XOR operations defined as $\text{XOR}^{2} = (R_{1} \otimes R_{2}) \otimes (R_{3} \otimes R_{4})$ and $\text{XOR}^{\text{3}} = [(R_{1} \otimes R_{2}) \otimes (R_{3} \otimes R_{4})] \otimes [(R_{5} \otimes R_{6}) \otimes (R_{7} \otimes R_{8})]$, where $\otimes$ represents the XOR operation and R_i the independent RBs. We generated 120 sequences of 1 × 10⁹ RBs (from a total number of bits of 1.2 × 10¹¹ RBs) generated by eight different spin dice (p-MTJs) implemented on a single-board circuit. It took about 2.5 days, and during the generation of RBs the temperature was kept at 35.7 ± 0.4 °C. P_sw values were obtained from every n = 2 × 10⁵ bits, and R_σ values were obtained from 5000 P_sw values.

The mean and the standard deviation of R_σ are summarized in Table I. R_σ of the raw RBs were ∼3–5. After the XOR operation, R_σ decreased to ∼1.04. Performing the XOR² and XOR³ operations reduced R_σ to the ideal value of 1.00. These results indicate that the RBs after XOR² and XOR³ operations were identical to that of the binomial distribution from the viewpoint of R_σ.

We also performed the statistical tests detailed in the NIST Special Publication 800 Statistical Tests Suite (NIST-SP 800)¹⁸⁾ for the same sequences of RBs used in Table I. This test suite consists of 15 kinds of statistical tests (and 188 tests in all). It should be noted that these statistical tests are not simple yes–no test but significance tests with a certain pass rate.²⁴⁾ Since the suite consists of 188 tests with a pass rate of 0.9972, which comes from the combination of the success rate (within ±3 three standard deviations) and the uniformity of p value (significance level of 0.0001), the expected pass rate for all tests is estimated to be (0.9972)¹⁸⁸ (= 0.590).

However, as pointed out by Yamaguchi et al.,²⁵⁾ the pass rate for a limited number of RBs is smaller than the pass rate of 0.590 that is obtained for an infinite number of RBs. They performed numerical experiments to obtain the pass rates of 1 × 10⁹ bits for 1000 sets of 1 million RBs generated by using the following four types of PRNGs: VSC128S,²⁶⁾ CatMap2D,²⁷⁾ SHA-1,²⁸⁾ and AES.²⁹⁾ The obtained pass rates were distributed from 41% to 56%: 56% for VSC128S, 55% for CatMap2D, 43% for SHA-1, and 41% for AES.

The pass rates of the RBs generated by the spin dice are summarized in Table II. The pass rates of raw RBs were zero for all MTJs, as expected by the results shown in Figs. 4(a) and 4(b). However, the pass rate was increased by performing XOR, XOR², and XOR³ operations. By comparing these pass rates with those for typical PRNGs mentioned above, the RBs generated by performing XOR² or XOR³ operations can be regarded as the practical truly RNs.

In summary, we demonstrated random number generation by spin dice consisting of eight p-MTJs. The spin dice operate as a new type of truly random number generator based on the stochastic nature of the spin-torque switching at a bifurcation point. The utilization of perpendicularly magnetized MTJs for the spin dice enables us to develop the truly random number generator practically. The spin dice have the following features: (i) The binary random numbers are directly obtained from the results of spin-torque switching, and thus the equiprobability of the spin dice is ideal after a nested XOR operation is performed; (ii) temperature compensation for the switching probability can be easily achieved by adjusting the amplitude of the current pulse; and (iii) the scalability of spin-torque switching makes it possible to fabricate a large number of arrays of spin dice on a chip and will provide an unlimited supply of practical truly random numbers. We note that spin dice should prove to be a promising candidate for a scalable truly random number generator suitable for encrypting and would enable us to handle an enormous amount of data securely and confidentially.