Twin physically unclonable functions based on aligned carbon nanotube arrays

Physically unclonable functions (PUFs) are a promising technology for generating cryptographic primitives using random imperfections in a physical entity. However, the keys inside PUFs are still vulnerable as they must be written into non-volatile memories and shared with participants that do not hold the PUF before secure communication. Here we show that pairs of identical PUFs (twin PUFs) can be fabricated together on an aligned carbon nanotube array and used for secure communication without key pre-extraction and storage. Two rows of field-effect transistors are fabricated perpendicular to the carbon nanotube growth direction, randomly producing three types of transistor channel—based on metallic nanotubes, semiconducting nanotubes and no nanotubes—that can be used to extract ternary bits for use as a shared key. The twin PUFs exhibit high uniformity, uniqueness, randomness and reliability, as well as a consistency of approximately 95%. We show that separated twin PUFs can provide secure communication with a bit error rate of one bit per trillion via a fault-tolerant design. A pair of rows of field-effect transistors fabricated perpendicular to the growth direction on an aligned carbon nanotube array can create twinned physically unclonable functions for use in secure communication.

C lassical cryptography uses cryptographic algorithms and keys to authenticate electronic devices and encrypt or decrypt information 1 . The most popular asymmetric algorithm for secure communication is Rivest-Shamir-Adleman encryption 2,3 , which is predicated on the difficulty for a classical computer for factoring a very large number. This task has, however, been mathematically shown to be accomplishable in polynomial time using a quantum computer 4 . Another strategy is symmetric encryption where all the communication participants possess the same secret keys for encryption or decryption, and secret keys are stored in non-volatile memory, such as erasable programmable read-only memory or static random-access memory. However, the stored keys are vulnerable to physical and side-channel attacks, such as by observing the consumed power or emitted radiation 5,6 and thus can be accessible to an attacker. Quantum key distribution can exhibit higher security than classical methods by exploiting quantum theory 7,8 -specifically, the feature of quantum systems to be intrinsically disturbed by the process of measuring them-but this technology requires expensive and unproven equipment 9,10 .
Physically unclonable functions (PUFs), also known as physical one-way functions 11 , are hardware-based security primitives that allow secret keys to be extracted on demand from a reliable and random physical system instead of being stored in non-volatile memory [12][13][14] . Random physical imperfections and small-scale variations caused by the fabrication process can be used by PUFs to generate the keys, and these imperfections cannot be predicted or cloned even by the original manufacturer 15,16 . A single PUF can be considered to be a unique and unclonable black-box challenge-response system 12 . The first PUFs were based on the unique speckle pattern generated by a laser beam going through a scattering medium at a select angle and point of incidence 11 . However, PUFs based on electrical properties are preferred to those based on optical ones due to their simple connection to key-readout circuits.
Unclonability ensures the safety of PUF-generated keys from being predicted or copied. If a PUF is used for secure communication, then the generated keys must be written into non-volatile memory and shared with other participants that do not hold the PUF [30][31][32] , which makes the keys vulnerable. An alternative would be to develop a way to initially make two identical PUFs in a single fabrication run that can then be separated and placed in two places, with the extracted keys being used to encrypt and decrypt communications. There is also a need to develop PUF technology that is compatible with CNT-based electronics. Due to developments in solution-derived CNT materials 33 , there has been recent progress in CNT-based complementary metal-oxide-semiconductor field-effect transistors (FETs) and integrated circuits (ICs) [33][34][35][36][37] . Wafer-scale fabrication of complementary metal-oxide-semiconductor CNT FETs on an eight-inch wafer 36,37 , high-speed transistors and ring oscillators with oscillation frequency up to 8 GHz 33,34 , and large-scale digital ICs including a 16-bit microcontroller unit containing 14,000 transistors 37 have been demonstrated on high-purity semiconducting CNT films. Due to low-temperature fabrication, CNT PUFs could also be heterogeneously integrated with silicon or other semiconductor-based ICs as an encryption module, as previously shown with the monolithic integration of silicon ICs and CNT FETs 38,39 .
In this Article, we show that pairs of identical PUFs (twin PUFs) can be fabricated using chemical vapour deposition (CVD)-grown aligned CNT arrays and used for secure communication without Physically unclonable functions (PUFs) are a promising technology for generating cryptographic primitives using random imperfections in a physical entity. However, the keys inside PUFs are still vulnerable as they must be written into non-volatile memories and shared with participants that do not hold the PUF before secure communication. Here we show that pairs of identical PUFs (twin PUFs) can be fabricated together on an aligned carbon nanotube array and used for secure communication without key pre-extraction and storage. Two rows of field-effect transistors are fabricated perpendicular to the carbon nanotube growth direction, randomly producing three types of transistor channel-based on metallic nanotubes, semiconducting nanotubes and no nanotubes-that can be used to extract ternary bits for use as a shared key. The twin PUFs exhibit high uniformity, uniqueness, randomness and reliability, as well as a consistency of approximately 95%. We show that separated twin PUFs can provide secure communication with a bit error rate of one bit per trillion via a fault-tolerant design.
key pre-extraction and storage (Fig. 1). Aligned CNT arrays should have random characteristics, such as chirality and position, perpendicular to the CNT growth direction and identical characteristics along the growth direction. Back-gated FETs fabricated on arrays perpendicular to the growth direction show three channel types with distinct electrical properties-channels containing some metallic CNTs, purely semiconducting CNTs and no CNTs at all ('open channel')-from which ternary bits can be extracted and used as secure keys. Through simulation and optimization of purity and device dimensions, the ternary bits are tuned to have maximum randomness. Two rows fabricated in parallel on the same CNT array produce twin PUFs with a consistency of approximately 95%, compared with approximately 35% for two independent PUFs. We illustrate the potential of twin PUFs for secure communication using twin binary keys (2 × 1,120 bits) generated by the devices. Through a fault-tolerant design, where multiple key bits are used to encrypt one plain text bit, the bit error rate (BER) of the encryption and decryption process can be reduced, potentially down to one bit per trillion.

Fabrication of twin PuFs on aligned CNT array
Well-aligned CNT arrays were grown via CVD on ST-cut quartz substrates using iron nanoparticles as the catalyst ( Supplementary  Fig. 1). Deposited via electron-beam evaporation (EBE), the iron nanoparticles in the catalyst stripes were randomly positioned and had different sizes owing to the statistical nature of the EBE process. In addition, nucleation through the vapour-liquid-solid processes is also stochastic; therefore, CNT arrays were randomly distributed perpendicular to the growth direction defined by the crystal orientation in terms of both chirality and position (Supplementary Figs. 2 and 3), which is highly unwanted for high-performance electronics applications [40][41][42] . As shown in Fig. 1a, FETs fabricated on such CNT arrays have three distinct channel types: with no CNTs or open channel ('O'), with pure semiconducting CNTs ('S') and with at least one metallic CNT ('M'). These different channel types lead to distinguishable electronic characteristics, that is, O channel with very low current and a conducting channel with large current on/ off ratio (S channel) and small on/off ratio (M channel with metallic CNT). Since the location and type of CNTs in the channel are determined by stochastic nucleation and random catalyst distribution, FETs fabricated on the CNT arrays (defined by the source/drain contacts) will show O, S and M characteristics in a random manner perpendicular to the growth direction. The random nature is not predictable or clonable; therefore, in principle, one row of FETs meets the requirements of PUFs. Induced by the quartz lattice-CNT interaction 43 , CNT arrays grew along the [2, -1, -1, 0] crystal orientation for several hundred micrometres 44 , which ensured that the properties of CNT arrays were identical parallel to the growth direction. As shown in Fig. 1b, two rows of FETs fabricated in parallel on the same CNT array show O, S and M types with the same order; therefore, two identical PUFs can be fabricated together.
To fabricate FETs, CNT arrays were transferred using polymethyl methacrylate (PMMA) as a medium to the target Si/SiO 2 substrate before device fabrication 45 , and the substrate served as the global back gate to measure the transfer characteristics. Palladium (Pd) films were deposited as the source/drain contacts to form p-type FETs with a channel length (L ch ) of 1 μm and variable channel width (W ch ) controlled by the contact width and etched area (Fig. 2a). The test units of CNT twin PUFs were designed to be 2 × 24 or 24 pairs of FETs with an equal spacing of 5 μm, and all the FETs were connected to peripheral on-chip pads ( Fig. 2b and Supplementary Fig. 4). According to the patterned catalyst stripes with 0.25 mm distance and pad settings, the test units were batch fabricated in the form of a matrix with 0.50 mm distance ( Fig. 2c and Supplementary Fig. 4).
We measured the transfer characteristics of three typical pairs of FETs in a test unit with a drain-to-source voltage (V ds ) of -1.0 V (Fig. 2d). The FETs with no CNTs in the channel exhibited an on-state current (I on ) below 1 pA, whereas the FETs with CNTs in the channel showed I on far above 1 μA. Among the conducting FETs, the FETs with only semiconducting CNTs showed an on/off ratio of up to 6 decades, whereas those having at least one metallic CNT showed an on/off ratio of less than 10. Because they were fabricated on the same CNT array, those FET pairs with the same order from the two rows of FETs showed transfer characteristics that almost coincide, indicating that they were identical. Here 500 FETs on  CNT arrays were readily classified into these three types (O, S and M devices) according to their extracted on-state current I on and current on/off ratio, by defining O-type FETs as the ones with I on below 0.1 nA, S-type FETs with I on above 0.1 nA and an on/off ratio greater than 100, and M-type FETs with I on above 0.1 nA and an on/off ratio of less than 100 ( Fig. 2e and Supplementary Fig. 5).
To utilize CNT PUFs to generate ternary bits and thus keys with maximum randomness and entropy, O-, S-and M-type FETs should be tuned to have an equal occurrence probability of 1/3, which is realized by tuning the CNT array density and FET channel width W ch . As shown in Fig. 2f, we extracted CNT positions from scanning electron microscopy (SEM) images of CNT arrays and then calculated the tube-to-tube spacing (CNT pitch (CP)). Through statistical distribution fitting, the CPs were found to meet the log-normal distribution, which was verified by other CNT samples that we grew with different densities and those published by other groups 41,46 (Fig. 2g and Supplementary Fig. 6). According to the simulation with a CP of 1.0 ± 0.5 μm and an ideal metallic/semiconducting CNT ratio (MSR) of 1/2, Fig. 2h shows that the ratio of O-type FET decreases and M-type FETs increases with increasing W ch , whereas the ratio of S-type FET first increases and then decreases ( Supplementary Fig. 4). The non-monotonic change in the ratio of S-type FETs results from the fact that the possibility of metallic CNTs appearing in the S-type channel rapidly increases when W ch exceeds 1 μm, which effectively turns the S-type FET into an M-type FET ( Supplementary Fig. 7). We define the minimal difference (MD) as the sum of the square difference between the ratios of O-, S-and M-type FETs, and assume an ideal value (1/3) for a given CP and MSR to maximize randomness. When W ch is set to 0.8 μm, MD is 0.03, with O, S and M ratios of 0.4, 0.4 and 0.2, respectively; therefore, the ratio of S-type FETs needs to be decreased, which can be realized by two strategies. One is to increase the MSR to increase M-type FETs ( Supplementary  Fig. 8), and the other is to increase the deviation in the CP to increase mixed FETs ( Supplementary Fig. 9). The MSR can be adjusted by many factors, including catalyst, carbon source, atmosphere and electromagnetic field 47,48 , whereas CP is mainly determined by the distribution of iron nanoparticles. Through the co-optimization of CP and MSR, MD is reduced down to 10 −4 ( Supplementary  Fig. 10). Finally, CNT arrays with a CP of 0.65 ± 0.58 μm and MSR of approximately 0.4 ( Supplementary Fig. 11) were selected to demonstrate CNT twin PUFs with ideal ternary bits, and the experimental result is in good agreement with the simulation (Fig. 2h). A total of 1,600 FETs with W ch of 600 nm were fabricated to generate a 40 × 40 ternary bit map (Fig. 2i), in which 532, 516 and 552 O, S and M bits were counted, respectively.

Security and reliability performance of CNT PuFs
High-quality PUFs should be uniform, unique and reliable 49,50 ; when applied to cryptography applications, randomness and unpredictability are also indispensable 46 . The optimized ternary bit distribution showed that the three types of FET have occurrence probabilities of 33.25%, 32.25% and 34.50% and are uniformly distributed in different regions ( Supplementary Fig. 12). The high uniformity substantially increases the combination number (CN) of ternary keys, which can be calculated as C(n, c) times C(c, m), where n is the total device number, c is the conducting (C)-type device number and m is the M-type device number. For 300-bit ternary keys, the numbers of O-, S-and M-type FETs are 100, 97 and 103, respectively, and the CN is calculated to be 3.44 × 10 140 , which is very close to the maximum value (3.76 × 10 140 ) and 10 8 larger than that of previously reported ternary keys made from self-assembled CNTs of the same size ( Fig. 3a and Methods) 26 . Additionally, a delayed ternary PUF circuit based on CNT FETs was also designed to exhibit high randomness and the CN is calculated to be 1.81 × 10 140 from the simulation 29 . Although the CN of the same quantity of PUF units is close to our result, the unit of the PUF also contains more than 50 transistors; therefore, the key density will be much lower than our transistor-based PUFs. Because of one more possibility for every bit than when using binary keys, ternary keys have a much larger CN (10 50 larger for 300-bit binary keys; Supplementary  Fig. 13). Besides that, the entropy of our ternary PUF was up to 1.58, higher than those PUFs based on other technologies 23,25-27 (Supplementary Table 1).
Uniqueness measures the ability of a PUF to be different from other PUFs and is generally characterized by the inter-Hamming distance (HD) 31 . To quantify the uniqueness, ternary bits were divided into 25 64-bit keys. The normalized inter-HD was centred at 66.8% with a standard deviation of 8.3% (Fig. 3b), and the mean was close to the ideal value (2/3), determined by the fact that two bits from two different ideal ternary keys differ with a 2/3 probability. To commonly assess CNT PUFs, 1,600-bit ternary keys were converted into 3,200-bit binary keys by successively extracting two types of bit to form three groups of binary keys and then connecting them (Supplementary Fig. 14). The normalized inter-HD of the divided 50 64-bit binary keys was centred at 50.1% with a standard   The key size is set to be 64 bits. d, NIST statistical randomness test suite of binary keys transformed from ternary keys. The error bar is the standard deviation of P-values of the non-overlapping template test. e,f, Long-term stability of CNT PUFs. g,h, High-temperature stability of CNT PUFs. The green squares represent experimental data, and the red lines represent perfect performance with no electrical property changes after six months or at a temperature of 100 °C. deviation of 8.6% (Fig. 3c), and the mean was close to the ideal value (1/2). For different-sized keys, the normalized inter-HDs of ternary and binary keys still approached 2/3 and 1/2, respectively, and the distributions narrowed with increasing key size ( Supplementary  Fig. 14). To assess the randomness and unpredictability of CNT PUFs, 3,200-bit binary keys were subjected to the National Institute of Standards and Technology (NIST) statistical randomness test suite 51 . For the 1% significance level, all the p values were larger than 0.01, and most of them were even larger than 0.1; therefore, it is accepted that highly random keys were generated through CNT PUFs. CNT PUFs can be considered as strong PUFs and exhibit true unclonability 13 , since they can support a very large number of challenge-response pairs benefitting from the small size of the PUF cell and wafer-scale growth of CNT arrays.
Reliability measures the ability of a PUF to generate a consistent response to a corresponding challenge and the stability of the bits in the generated key, which is generally quantified by the intra-HD. To demonstrate the long-term stability, we compared the electrical properties of 240 as-fabricated FETs and the same set of FETs after six months. As shown in Fig. 3e,f, the extracted I on values and on/off ratios of these FETs follow the ideal 1:1 guideline, and there was no change among the O-, M-and S-type FETs. To demonstrate the temperature stability, we compared the electrical properties of 240 FETs at room temperature and at 100 °C. As shown in Fig. 3g,h, the extracted I on values of these FETs basically followed the ideal 1:1 guideline, whereas the on/off ratios decreased by approximately a decade on average, which was caused by the high-temperature-induced increase in the off-state current ( Supplementary Fig. 16). The electrical property changes of CNT FETs arise from the temperature-dependent carrier concentration and mobility, and then increase the BER. However, the digitalized classification of CNT FETs into three types does not require exactly the same properties of twin PUFs; therefore, it would be tolerant to considerable temperature variations. Besides that, we can store twin PUFs in the same temperature or use some fault-tolerant cryptography to reduce the BER. Since no FETs changed their types in our experiment, the intra-HD was close to the ideal value (zero). The high reliability of CNT PUFs comes from at least three aspects: the intrinsic stability of CNT randomness 52 , stable or reliable contacts between electrodes and CNTs 53 , and large noise margin between the three types of FET, ensuring immunity to environmental noise.

Consistency of twin PuFs and secure communication
Generally, if a normal PUF is utilized for secure communication, the keys inside the PUF must be extracted in advance and shared with other participants or stored in a central server [30][31][32] . However, this strategy makes the keys vulnerable and greatly reduces the security of communication. Our twin PUFs based on aligned CNT arrays can avoid this problem. After fabrication, twin PUFs are separated and placed in two places. When secure communication starts, the instantly extracted keys from the identical twin PUFs on the two sides of communication are used to encrypt the plain text and decrypt the cipher text (Fig. 1c). In principle, more than two PUFs can be fabricated to enable 'multiple-birth' PUFs ( Supplementary  Fig. 17), especially on long CNT arrays. The 'multiple-birth' PUFs can have an advantage over twin PUFs as multiple users participate in the secure communication, where one user can send the cipher text to all the others holding 'multiple-birth' PUFs. However, if more than two PUFs were fabricated, there is a risk of leaking one copy from the manufacturer. To put an end to this risk, we can control the number of fabricated PUFs by controlling the mean length of the CNT arrays on the wafer or using separate PUF design, fabrication and packaging.
To study the consistency of keys, we measured the I-V curves of 2 × 560 FETs in twin PUFs. Figure 4a shows a comparison of I on extracted from two sets of PUF pairs, in which 2 × 543 FETs were the same in terms of conducting or non-conducting types, whereas 2 × 17 FETs had different types between the C type and O type. Among the 2 × 385 conducting FETs, 2 × 12 FETs had different types between the M type and S type (Fig. 4b). In total, 2 × 531 FETs had the same types, making the consistency of twin PUFs approximately 95%, whereas two independent PUFs had a low consistency of only 35% ( Supplementary Fig. 18). The small number of inconsistent FETs in twin PUFs was mainly caused by imperfection during CNT growth, including chirality transition, existence of broken tubes between catalyst stripes and misalignment ( Supplementary  Fig. 19). The occurrence probability of CNTs with tube lengths longer than L and unchanged chirality (considering only the chirality transition between metallic tubes and semiconducting tubes) is given by where l is the tube length and α and β are the probabilities of growth stopping and chirality transition per unit distance, respectively (Supplementary Information). The misalignment is characterized by the angle between the CNTs in the array, which is measured to have a standard deviation of 0.09° (Supplementary Fig. 20). The inconsistency can also be caused by the fabrication process, including FET failure and angular deviation (0.05°) between the FET channel direction and CNT growth direction ( Supplementary Fig. 21). We estimated that currently, our FET failure would cause a 1% inconsistency, but this can be reduced to a very low level in a mature device fabrication process. To safely separate twin PUFs, the distance between the twin PUFs should be larger than approximately 20 μm, considering that the cut size is approximately 10 μm using plasma dicing 54 . The larger the distance between the twin PUFs, the smaller is the damage caused by dicing but larger is the inconsistency. Two approaches are helpful to mitigate this contradiction: reducing the substrate thickness to reduce the dicing size and improving the growth of aligned CNT arrays. It is well known that this inconsistency mainly arises from the imperfect CNT growth caused by an unclean substrate, lattice mismatch, unstable growth temperature and unstable growth atmosphere, which is hard to minimize in a university-level lab, but can be greatly reduced by fabrication in an industry-level factory. According to the simulated results, the consistency of twin PUFs decreases to a barely acceptable value of 85% when the PUF distance is 30 μm (Fig. 4c). Through the optimization of CNT growth and device fabrication, the consistency at long PUF distances can be largely increased to exceed 95% (Fig. 4d). To demonstrate secure communication, we generated twin binary keys with 2 × 1,120 bits, in which the solid green, solid red and hollow black circles represent bit '1' , bit '0' and inconsistent bit, respectively (Fig. 4e). Effects resulting from these inconsistent or 'wrong' bits can be greatly reduced if a fault-tolerant design is used. Assuming the transfer of the word 'Twin' (the corresponding binary code is '1010100111011111010011101110' in 7-bit ASCII), the plain text is encrypted into the cipher text '1001101101111100011101100010' by performing an XOR operation with key A. After transferring from location A to B through a public channel, the cipher text is decrypted into the binary code '1010100111011111010011101110' by performing an XOR operation with key B, which is translated into the word 'Twin' to complete the secure communication. However, due to the non-perfect consistency of twin PUFs, the encryption and decryption process could introduce wrong bits, which is generally measured using the BER. To reduce the BER, we designed fault-tolerant cryptography in which multiple key bits (≥3, odd) are used to encrypt one plain text bit into multiple cipher text bits, and the multiple cipher text bits are decrypted and then one plain text bit is generated through a majority vote (Fig. 4f). Since inconsistent key bits of more than one-half occurring in one group key will cause an incorrect bit, the BER is given by where p is the consistency of twin PUFs and k is the number of key bits used to encrypt one plain text bit. According to the calculation, the BER will be exponentially reduced with increasing k for consistency greater than 80% (Fig. 4g). For our twin PUFs with a consistency of 95%, the BER can be reduced to one in a trillion when the fault-tolerant number is up to 29; therefore, the accuracy of communication can be greatly strengthened.

Conclusions
We have reported twin PUFs made using well-aligned CNT arrays. The properties of the CNT arrays are random and impossible to predict or clone perpendicular to the CNT growth direction and are identical along the parallel direction. Rows of back-gated FETs fabricated perpendicular to the CNT growth direction create FETs with three types of channel and distinct electrical properties, which can be used to extract ternary bits. Through simulation and optimization of the purity and device dimensions, the randomness of the ternary keys was maximized. The PUFs exhibited high uniformity, uniqueness, randomness, unpredictability and reliability over six months and at a high temperature of 100 °C. Two parallel rows of FETs on the CNT arrays can be used to create twin PUFs, which showed a consistency of approximately 95%; two independent PUFs show a consistency of approximately 35%. The twin PUFs were used to demonstrate secure communication, and the BER could be decreased to one bit per trillion through a fault-tolerant design. Our twin PUFs offer a convenient, low-cost and reliable technology that can serve as alternative high-security hardware primitive to typical PUFs. The technology could also be easily integrated with other CNT-based electronic devices and circuits.

Methods
CNT growth and transfer. Well-aligned CNT arrays were grown on quartz substrates. ST-cut (Hoffman) quartz wafers were annealed at 900 °C for 9 h to improve the crystallinity. Standard ultraviolet photolithography was performed to pattern catalyst stripes with a width of 5 μm and spacing of 250 μm. The catalyst stripes were patterned perpendicular to [2, -1, -1, 0] of the quartz surface. An iron film with a thickness of approximately 0.1 nm was deposited as a catalyst layer using an electron-beam evaporator followed by a lift-off process. CNT growth was performed in a horizontal CVD furnace. The prepared substrate with the patterned catalyst was annealed at 800 °C for 1 h in air to oxidize the catalysts and remove the remaining polymer residue from the photolithography process. After cooling to room temperature, the furnace was again heated to 800 °C in 30 min under the protection of Ar (500 s.c.c.m.) before CNT growth. In a typical CVD growth process of CNTs, H 2 /Ar (50/50 s.c.c.m.) was used to reduce the catalyst for 10 min at 800 °C. Subsequently, an Ar flow of ~50 s.c.c.m. through an ethanol bubbler and a hydrogen flow of ~50 s.c.c.m. were introduced into the CVD furnace for 23 min for CNT growth. The system was then cooled to room temperature in an Ar atmosphere to finish the growth process.
PMMA films were used as the medium to transfer the CNT arrays from a quartz substrate onto the target Si/SiO 2 structure. The substrate with CNT arrays was covered with a photoresist film by spin coating and then dried at room temperature. An open-box tape was attached to the photoresist film for avoiding fracture, and then the substrate was immersed in a hydrofluoric acid buffer. After being automatically released from the substrate, the photoresist film with CNTs was taken out and immersed into deionized water for removing the remains of the hydrofluoric acid buffer. Then, a drop of water was dropped onto the target substrate and the photoresist film was put on the water drop. After the water drop dried and the photoresist film was firmly attached, the new substrate with the photoresist film and CNTs was immersed into acetone, N-methyl-2-pyrrolidone and alcohol for 20 min each and then dried using high-purity nitrogen to finish the CNT film transfer process.
Fabrication and measurement of twin PUFs. CNT FETs in twin PUFs were fabricated with a back-gate structure. Pd/Au stack metal films of about 20/60 nm were first deposited via EBE on the CNT arrays to achieve an ohmic contact to CNTs. Unwanted CNTs were etched by reactive ion etching to form independent channels. Ti/Au stack metal films of about 20/100 nm were deposited as connected wires and testing pads. The as-fabricated CNT FETs were measured using a probe station (Cascade Summit 1100) and a semiconductor analyser (Keithley 4200).
Extraction of CP and fitting. The extraction of CP includes three steps: (1) read the grey values perpendicular to the CNT growth direction in the SEM image of CNT arrays; (2) locate the CNT positions by finding the local maximum values; (3) calculate the CPs by subtraction between the adjacent CNT positions. We used normal distribution, logistic distribution and log-normal distribution to fit the experiment data, and found that log-normal distribution yields the best fitting. Supplementary Fig. 6 shows the results of four samples with different CNT densities, where Supplementary Fig. 6c,d are extracted from the literature. Variable X is log-normally distributed if Y = ln(X) is normally distributed, and the probability density function and cumulative distribution function of log-normal distribution are given by respectively, where σ and μ are parameters, x is a random variable and erfc is the complementary error function. Specifically, the arithmetic mean and standard deviation of a log-normally distributed variable X are given by respectively, where E and SD are the arithmetic mean and standard deviation, respectively. Conversely, the parameters μ and σ can be obtained from the arithmetic mean and standard deviation and are given by respectively.
Randomness of CNT arrays. The randomness of CNT PUFs comes from the randomness of CNT arrays themselves including position and chirality. As shown in Supplementary Fig. 2, CPs are randomly distributed and the adjacent pitch differences follow a normal distribution, which means there is little influence of one pitch on adjacent pitches. As shown in Supplementary Fig. 3, from the atomic force microscopy image of the CNT arrays, we extracted the diameters along with tubes, and the diameters are also randomly distributed perpendicular to the CNT growth direction.
Simulation of PUFs on CNT arrays. CNT arrays are simulated using three parameters: the mean of the CP, the standard deviation of the CP and the MSR. Through equations (7) and (8), parameters μ and σ can be obtained to generate a set of data (CP), and to generate the CNT positions by accumulating CPs. The generated CNTs are semiconducting with a probability of 1/(1 + MSR), and the others are metallic. The FETs are simulated with different channel widths (W ch ) and a spacing of 5 μm. Supplementary Fig. 7 shows the illustration of a simulated CNT array and FETs, given the following parameters: CP = 2.0 ± 1.5 μm, MSR = 1:2 and W ch values of 0.5, 1.0 and 2.0 μm. According to the electrical properties, CNT FETs can be classified into three types: O type (without CNTs in the channel), S type (only semiconducting CNTs in the channel) and M type (at least one metallic CNT in the channel). We simulated 3 × 10 5 FETs for every W ch value, changing from 0 to 4.0 μm with a step of 0.1 μm (CP = 1.0 ± 0.5 μm and MSR = 1/2), and calculated the relation of the probabilities of three FET types with W ch values ( Supplementary Fig. 7a). With W ch increasing, the ratios of O-, S-and M-type FETs decreases monotonously, first increases and then decreases, and increases monotonously, respectively. The non-monotonic change in the ratio of S-type FETs comes from the rapid increase in FETs having mixed semiconducting and metallic CNTs in the channel when W ch exceeds 1 μm (Supplementary Fig. 7b).
Optimization of ternary keys. O-, S-and M-type FETs should be tuned to have an equal probability of 1/3 to realize an ideal ternary key. This optimization requires the ratio-W ch curves of three FET types have the same intersections, which can be simplified to another task that the longitudinal coordinate of the intersection of two of the curves is equal to 1/3. We selected O-and M-type FETs to study it, because their ratios change monotonously.
As shown in Supplementary Fig. 8, we simulated the ratio-W ch curves with different metallic CNT ratios (MR, CP = 1.0 ± 0.5 μm). With the MR increasing from 0.3 to 0.6, the ratio of M-type FETs increases, whereas the ratio of O-type FETs remains constant. When the MR is about 0.48, the longitudinal coordinate of the intersection of two of the curves is closest to 1/3. As shown in Supplementary  Fig. 9, we simulated the ratio-W ch curves with different standard deviations (MR = 1/3 and the mean of the CP is 1 μm). With the standard deviation of CNT pitches increasing from 0.1 to 0.9, the ratio of M-type FETs decreases slightly, whereas the ratio of O-type FETs increases substantially. When the MR is increasing, the longitudinal coordinate of the intersection of two of the curves is closer to 1/3.
To study the influence of both standard deviation and MR on the optimized target, we define MD as a sum of the square difference between the ratios of O-, S-and M-type FETs and the ideal value (1/3) for a given CP and MR. The MD is given by where R O , R S and R M represent the ratios of O-, S-and M-type FETs, respectively, and are functions of W ch . We used the coefficient of variation to replace the standard deviations to perform the simulation so that it is more universal. We simulated MD with the coefficient of variation from 0.4 to 1.0 and MR from 0.2 to 0.7 ( Supplementary Fig. 10). Through the co-optimization of CP and MR, MD can be reduced to be smaller than 10 −4 , and our work yielded MD of close to 10 −4 .
Extraction of metallic ratio of CNT arrays. The most common way based on the electrical measurement to extract the MR or semiconducting ratio (SR) is to calculate the on/off ratio (OR) from the transfer characteristic curves of FETs with a wide channel on the CNT array. The MR and SR values are given by respectively. We used this method to extract MR of the CNT arrays used in PUFs to be 38% ( Supplementary Fig. 11a). This method is based on a hypothesis that the on-state current of a semiconducting tube is equal to that of a metallic CNT; however, this hypothesis is not accurate, since metallic CNTs have large on-state currents. We designed another method to more accurately extract the MR/SR of CNT arrays in which many small FETs are used. The channel needs to be narrow enough to make sure that the number of CNTs in the channel is not larger than one; then, R M /R S will be equal to MSR. MR and SR are given by respectively. According to the simulation shown in Supplementary Fig. 8, the ratio of the mixed M/S FETs is close to zero when W ch is smaller than about 500 nm. As shown in Supplementary Fig. 11b, we calculate R M /(R S + R M ), and used these data with W ch ranging from 100 to 500 nm to fit the MR of about 43%.
Calculation of possible CN. The possible CNs of ternary keys and binary keys are given by respectively, where n, c, s, m and o represent the number of all the FETs, connected FETs, S-type FETs, M-type FETs and O-type FETs, respectively. We calculated CN 3 by changing s and m and keeping n constant; we found that CN 3 reaches the maximum value when m = s = n 3 . Fabricating a 300-bit ternary key, our PUF gives (s, m) of (103, 97), making CN 3 reach 3.44 × 10 140 , whereas the PUF from the literature gives (s, m) of (69, 80), making CN 3 reach 2.90 × 10 132 . As shown in Supplementary Fig. 14, we also compared the maximum CN of ternary keys and binary keys with the same key size, and ternary keys have a much larger CN.
Inter-HD and intra-HD. The uniqueness and reliability of a PUF are characterized by inter-HD and intra-HD, respectively, and the means of normalized inter-HD and intra-HD are given by respectively, where S i and S j are the ith and jth key extracted from the CNT PUFs, respectively, S ′ i is the ith key extracted from the CNT PUFs at a different time or different environment (where K is the size of one key) and N is the total number of keys. For an ideal multivariate key with M choices in one bit, the expectation of inter-HD is equal to MK M+1 ; therefore, the mean of normalized inter-HD is given by The means of normalized inter-HD of ideal ternary keys and binary keys are 2/3 and 1/2, respectively, according to equation (18).
Entropy calculation. In information theory, given a discrete random variable X, with possible outcomes x 1 , x 2 ,…, x n , which occur with probability P(x 1 ), P(x 2 ),…, P(x n ), the entropy of X is defined as For our ternary PUFs, P O = 33.25%, P S = 32.25% and P M = 34.50%; therefore, the entropy is calculated as 1.58.
Simulation of consistency of twin PUFs. The inconsistent FETs in twin PUFs can be caused by imperfect CNT growth, which includes the existence of broken tubes, chiral change and array misalignment. First, we consider the existence of broken tubes, and assume a tube has a constant and uniform probability to stop growing in every unit distance. The probability of a tube with length larger than L is given by where l is the length of the tube, α is the probability of stopping growing in every unit distance and L 0 is a very short length and can be divisible by L. When L 0 is close to zero, the limitation of equation (20) is given by According to equation (18), the average length of the CNT array is given by According to the literature, the average length is about 300 μm (ref. 37 ); then, α is equal to 3.33 mm −1 . However, α can be reduced by optimizing the growth condition including proper C:H ratio, steady growth environment, cleaner substrate and so on.
Then, we consider the chiral transition between metallic tubes and semiconducting tubes, and assume a tube has a constant and uniform probability to change its chirality in every unit distance. The probability of a tube at a distance L having a different chirality with its original chirality is given by where β is the probability of a chiral transition in every unit distance and L 0 is a very short length and can be divisible by L. Because of the need of extra energy to overcome the barrier, the chiral transition is difficult; hence, we only consider a single chiral transition. Then, equation (20) is simplified as Overall, the probability of a tube at a distance L having the same electrical properties with its original ones is given by The misalignment comes from the defect and dislocation of the quartz substrate, containment on the substrate and unsteady growth atmosphere. We use angles between the CNTs to measure the misalignment degree ( Supplementary  Fig. 20) and the normalized angle has a small standard deviation of 0.09°.
This inconsistency can also be caused by the fabrication process, including FET failure and angular deviation between the FET channel direction and CNT growth direction. In a mature device fabrication process, the probability of FET failure can be reduced to a very low value, and we assume it causes a 1% decrease in our simulation. In our twin PUFs, the angle between the FET channel direction and CNT growth direction is smaller than 0.05°.
Overall, we simulated the consistency versus distance of the twin PUFs (Fig. 4c). The consistency can be largely increased by optimizing the growth of the CNT arrays and device fabrication process ( Fig. 4d and Supplementary Fig. 21) and thus increase the allowable distance of twin PUFs.

Data availability
The data that support the findings of this study are available from the corresponding authors upon reasonable request.