Why is SRAM PUF considered weak PUF? I have read in many places that SRAM PUF is considered a weak PUF, since it generates a single response (based on the value of all RAM cells upon power-up).

Why can't I use just a limited number of bytes from the RAM space in order to create a CRP? 
For example  if I have a 64kB RAM, I can divide it into 256 sections, each section 256B long, obtaining 256 CRP's? (Assuming that all the RAM cells are stable and can be used for PUF...)
In the article, &quot;weak PUFs&quot; are for key storage, and &quot;strong PUFs&quot; are for authentication, but both are PUFs.  It's just a function of how you use them.  A 32-bit PUF is just a random 32-bit number.  What makes a weak PUF strong is pairing it with an HMAC circuit, or something for a challenge response.
A few notes on the article:  the assumption that EEPROMs are expensive in both power and area is not really true.  It's difficult to find any IC without some sort method to hold the serial number, and if it is not EEPROMs, it's e-fuses (eFUSE, antifuse).  Everything in IoT has some sort of method to program memory.   To that end, if I have EEPROM infrastructure already, PUFs cost more regarding area, and both circuits have the same issues when I de-cap something and put my probes on it.  The circuit discussion was rather weak and some of the implementation examples in the overview won't work on aggressive nodes.