Based on this datasheet or this patent, one of the usage of PUF is printer cartridge identification and authentication. I was wondering why printer cartridge needs identification and authentication. In other words, what is the security concept behind it?
Furthermore,
what is the required protocol for it?
which item behaves as PUF?
who sends the challenge?
who verifies the correctness of the response for the given challenge?
A company can make more money if the printers it sells only work with the cartridges they sell, which does not work if there is competition. It's cheaper to force a vendor lock-in than it is to innovate and ensure that your product holds up to the competition. All the printer's authentication does is prevent you from using cartridges made by other companies. Think of it like DRM for ink. It's just capitalism.
There is no standard protocol. Each vendor is free to implement this in their own way. Most likely it's some form of challenge-response authentication done between the cartridge and the printer.
The chip user doesn't really do any PUFy stuff. PUF manipulation is not entirely deterministic, so the stochastic methods used to convert that to determinism are hidden within the bowels the ChipDNA thing.
The security concept is that the PUF holds the SHA3 secret, which is simply a truly random (but fixed) bit sequence. The 'secret' can be an authentication key $(K)$ for use with the FIPS 198 keyed-hash message authentication mode (HMAC) functionality off the front page. Maxim have opted for SHA3 as the hash function. They suggest that SHA3 is better than the others?
Communications $(m)$ can be authenticated $ \operatorname{HMAC-SHA3}(K,m) $. But notice that there is no cipher component on the datasheet. The datasheet only deals with the electrical connectivity to the device. Note though that this chip only came out towards the end of last year. There mightn't be any cartridges that use it yet. Something simpler will be currently used. Security protocols and how the chip's components might be used exactly will be a trade secret for the particular printer manufacturer. We do know that "ChipDNA secure key never resides statically in registers or memory, nor does it ever leave the electrical boundary of the IC" as it's in Maxim's literature. But the chip's network ID is public, yet "The unique ROM ID is used as a fundamental input parameter for cryptographic operations and serves as an electronic serial number within the application." There's an evaluation board for this chip, so you might have to buy one and experiment.
A use case for printers of the 3D type is:-
Sharing the other answer's distopian worldview, the chip also has a 17 bit down counter. This allows the cartridge to be forcibly scrapped after $2^x$ pages/metres of filament.
