Tutorial A1 Synchronization to Communication Lines

One of the first requirements of attacking real devices will be to synchronize to communications from the device itself.

Using ChipWhisperer-Lite Hardware

The ChipWhisperer-Lite does not currently have hardware triggers for I2C/SPI/UART. This is something which may be added in a future firmware release.

Instead, you can use the #Using External Hardware Tools method.

Using ChipWhisperer-Capture Rev2 Hardware

The ChipWhisperer-Capture Rev2 includes an arbitrary digital pattern trigger. The ChipWhisperer-Capture software provides an example of using this with a UART data line, to trigger on specific UART data.

The following is based on the Tutorial A2 Introduction to Glitch Attacks (including Glitch Explorer) tutorial, where you want to call a glitch when the glitch1() routine happens. You can use this method to trigger both glitches or side-channel power analysis measurements.

We'll use an automatic digital pattern trigger, instead of the Trigger line. This will detect when the DUT sends the A character indicating the infinite loop is going to happen.

1. Switch the Trigger Module to Digital Pattern Matching:

   

2. Setup the system to monitor both TX & RX lines, using an AND logic. The lines normally idle high, thus the AND combination allows you to trigger on either sent or received data:

   

3. Under the Digital Pattern Trigger Module, set the Baud rate to 38400. Set the Trigger Character to A:

   

When the glitch sends an A, the glitch will trigger. If you want to check the trigger is occurring, you can use the normal analog capture. To do so follow these steps:

4. Set the gain setting to 30:

   

5. Set the trigger mode to rising edge:

   

6. Set the ADC clock source to CLKGEN x4 via DCM, and ensure the DCM Locked checkbox indicates the DCM is locked, along with the ADC frequency being 29.5 MHz. Hit the Reset ADC DCM button if this is not the case:

   

Finally - we can check both the triggering and the glitches. To check the triggers our occurring:

7. Hit the Capture 1 box. If you have configured the automatic reset, it should send an A causing the trigger to occur. If the system is working the ADC will capture data, If the trigger is NOT working you will instead see a message printed about Timeout in OpenADC capture(), trigger FORCED in the Debug Logging tab:

   

8. The glitch trigger will occur whenever the trigger conditions are met now.

Using External Hardware Tools

The triggers built into the ChipWhisperer hardware are considerably more basic than those available in normal bench test equipment. This means one of the best methods to achieve advanced triggering is by using standard bench hardware. Examples of suitable hardware are:

• Teledyne Lecroy Logic Studio, a $900 logic analyzer with hardware trigger out for detection of I2C, SPI, or UART traffic.
• Oscilloscope with I2C/Serial/SPI trigger option and trigger out capability.
• Custom FPGA design to look for specific pattern of data.

Simply connect this "Trigger Out" to one of the IO lines on the ChipWhisperer, and specify that IO line as the trigger event.

Links

Tutorials

See Tutorial Map for important information & suggested order of completion.

Theory

Correlation Power Analysis

Template Attacks

Extending AES-128 Attacks to AES-256

Basic Tutorials

Tutorial B1 Building a SimpleSerial Project

Tutorial B2 Viewing Instruction Power Differences

Tutorial B3-1 Timing Analysis with Power for Password Bypass

Tutorial B5 Breaking AES (Straightforward)

Tutorial B6 Breaking AES (Manual CPA Attack)

Tutorial B7 Profiling Attacks (with HW Assumption)

Tutorial B11 Breaking RSA

Advanced Tutorials

Tutorial A2 Introduction to Glitch Attacks (including Glitch Explorer)

Tutorial A3 VCC Glitch Attacks

Tutorial A5 Breaking AES-256 Bootloader

Tutorial A5-Bonus Breaking AES-256 Bootloader

Tutorial A7 Glitch Buffer Attacks

Tutorial A8 32bit AES

Hardware-Specific Tutorials

Tutorial P1 Stream Mode and Advanced Triggering (CW Pro)

Tutorial CW305-1 Building a Project

Tutorial CW305-2 Breaking AES on FPGA

Tutorial CW305-3 Clock Glitching

Tutorial CW305-4 Voltage Glitching with Crowbars

Archived Tutorials (v4/v3 only)

Tutorial B3-2 Timing Analysis with Power for Attacking TSB

Tutorial B4 Testing Two Partitions of Traces

Tutorial B5-2 Breaking DES (Straightforward)

Tutorial B8 Profiling Attacks (Manual Template Attack)

Tutorial B9 The Preprocessing Modules

Tutorial B10 Using with SASEBO-W CardOS or DPA Contest v4.2

Tutorial A1 Synchronization to Communication Lines

Tutorial A4 SAD Trigger for SCA and Glitch

Tutorial A6 Replication of Ilya Kizhvatov's XMEGA® Attack

Tutorial A9 Bypassing LPC1114 Read Protect