I am not sold on PUFs because the way I have seen them described so far raise all the red flags of bad crypto. It was funny to read the article that started with the Kirchoff principles because I was going to start a comment about just how PUFs were the most recent chancer having a go in a long line of systems designed to sidestep Kirchoff principles.<p>The steelman cases I think for PUFs are a) that it could be a solution for device attestation (theoretically, you can use the PUF as a secret diversification component in a KDF), or b) use it the way initialization keys are used in secure elements today, where they are the bootstrapping keys for a protocol that installs personalized device keys. (e.g. a temporary, weak attestation)<p>I agree with another commenter here that the use case for this is DRM, but the econmics of why to use PUFs over more dynamic and resiliant actual cryptosystems haven't been compelling so far. The cases I've read, "more security!" is both dubious, and past the point of marginal diminishing returns on increased security. Sure, you can never have too much assurance, but how much are you really going to pay for, and at what flexiiblity/switching cost?<p>For PUFs to be used in case b), they would have to be more economical than provisioning secure elements, and the certification and accreditation of the PUF modules would be a big part of those economics. Their failure mode is also catastrophic, as you can't update the PUF component across a device ecosystem, so the use cases are automatically narrow, like maybe disposable drones.<p>Everything about my reading about them so far as been designed to persuade people who are not equiped to reason about them, and sometimes discredit anyone who is. The hidden counterfactuals to me are that it depends on standards bodies approving one, as nobody serious is going to touch it otherwise, and then a customer is going to take on a PUF module vendor and have their entire product line and supply chain depend on the company that produces it. There are still precedents for that, as that's what companies like Gemalto, Oburthur and any other peers do, but those companies are such that it doesn't matter what their tech does because they are unique entities among tech companies. If one of them had a PUF product that was competitive with their other business, it would be just another tech that was effectively mandated on an industry top down.<p>It also seems to presume that the problems in security have anything to do with our ability to produce sufficient entropy/randomness (instead of verifying its integrity) and the reliance on a single or few points of centralized PUF key generation means it is <i>guaranteed</i> to be sabotaged by IC actors.<p>The conversation goes something like, "we have a physical secret thing nobody can ever find, but you can verify it!" and you ask, "how do I know nobody else knows it?" and they say, "you trust us!" so you ask, "can your insurance handle replacing my entire market cap?" and they say, "not necessary because of physics! where is your physics degree from again?" and it usually ends there, with a PUF vendor mystified at how their potential customer can make so much revenue but still be so stupid as to reject the brilliance of their discovery.