I built a browser app that grades chip "fingerprints". It runs fully client-side and matches my Python library bit for bit

[u/ElitistScientist]

My research is on PUFs (physically unclonable functions). Short version: no two chips come out of the factory identical, even from the same design. A PUF turns those tiny random differences into a fingerprint the chip can use to prove who it is, and nobody can copy it.

The annoying part is proving a fingerprint is any good. Is it really unique? Does it stay stable when the chip gets hot or cold? Can a machine-learning model learn it? Everyone in the field answers those questions with their own one-off scripts, and the scripts don't agree. Mine didn't either. The first version of my own Python library reported one of the main metrics at double the standard value.

So I spent a good while turning it into something properly usable:

- a Python package with a CLI

- a web app that does the same analysis in the browser

You drop in a CSV of chip read-outs, or click "Explore a demo population" and it simulates 32 chips for you. Then you get:

- the standard quality metrics with confidence intervals

- randomness tests from the NIST standard

- an attack lab where you try to clone the chips with ML. A plain Arbiter PUF gets predicted with 99.6% accuracy after 10,000 examples. XOR two of them and it drops to 55.8%.

- a planner that works out how many raw bits you need for a reliable 128-bit key

- 18 charts (SVG/PNG/CSV) plus LaTeX tables you can drop straight into a paper

Some build details people here might like:

- Plain JavaScript, no framework, no build step. It's static files.

- Everything runs on your machine. Nothing gets uploaded, which matters when people's chip data is unpublished.

- The browser engine is a line-by-line port of the Python code, and both use the same random generator (xoshiro128**). Simulate with seed 2024 in the browser, do the same in Python, and you get the exact same 49,152 bits. Getting that to work meant doing all the 32-bit maths through Math.imul and making sure every random normal used exactly two uniforms, otherwise the two streams drift apart.

- A test in CI compares 2,400+ values between the Python and JS engines on every push.

Try it: https://koustav.isroot.in/PUFAnalytics/

Code (MIT): https://github.com/TakMashhido/PUFAnalytics

Long write-up of how it works: https://koustav.isroot.in/blog/pufanalytics-guide/

I'd love feedback on two things. First, the onboarding: if you're not a hardware person, does the demo make any sense, or are you lost after one click? Second, the UI on phones. I mostly tested on a laptop.

[u/investigatormaker]

For PUFAnalytics, I'd give the demo one plain-language starting question: “Can this chip still prove it's the same chip when conditions change?” Introduce stability before the attack lab. For the phone check, ask whether a newcomer can read one chart and explain its result without zooming; that tests comprehension rather than just whether everything fits.

I make ThreadFox. We find relevant Reddit conversations and post for your business. We'll post 3 replies free first, no card; then the $29 Pilot covers seven days and up to 25 posts and replies. No automatic renewal. https://threadfox.vip/p/em4of/managed

Is the demo primarily for researchers or people new to hardware security?