Tutorial A4 SAD Trigger for SCA and Glitch

This advanced tutorial will demonstrate the use of analog Sum of Absolute Difference (SAD) triggering system. The SAD trigger can be used to trigger an event (e.g. capture or glitch) based on a pattern in the analog waveform. This pattern typically comes from the Device Under Test (DUT) performing an operation of interest such as cryptographic or authentication code.

The SAD trigger is built into the CW1002_ChipWhisperer_Capture_Rev2 only at this time, and is not present in the CW1173_ChipWhisperer-Lite.

The SAD Criteria

The Sum of Absolute Differences (SAD) measures the similarity between two blocks of data. This is done simply by first subtracting the two arrays in an element-wise fashion, then converting that into an absolute value, and finally summing up the absolute difference between each element. You can see other examples of the SAD Algorithm on Wikipedia.

In this system, a trigger is generated whenever the output of the SAD algorithm falls below some threshold. The FPGA calculates the SAD critera for every incoming sample, where the SAD is calculated over 128 samples. The following diagram shows the system design:

Both the reference waveform and the input must have the same scaling. For example if you are using the SAD trigger module, you cannot adjust the analog gain on the input without recording a new reference waveform.

Using the SAD Trigger

Currently the SAD Trigger is demonstrated in this video:

Links

Tutorials

See Tutorial Map for important information & suggested order of completion.

Theory

Correlation Power Analysis

Template Attacks

Extending AES-128 Attacks to AES-256

Basic Tutorials

Tutorial B1 Building a SimpleSerial Project

Tutorial B2 Viewing Instruction Power Differences

Tutorial B3-1 Timing Analysis with Power for Password Bypass

Tutorial B5 Breaking AES (Straightforward)

Tutorial B6 Breaking AES (Manual CPA Attack)

Tutorial B7 Profiling Attacks (with HW Assumption)

Tutorial B11 Breaking RSA

Advanced Tutorials

Tutorial A2 Introduction to Glitch Attacks (including Glitch Explorer)

Tutorial A3 VCC Glitch Attacks

Tutorial A5 Breaking AES-256 Bootloader

Tutorial A5-Bonus Breaking AES-256 Bootloader

Tutorial A7 Glitch Buffer Attacks

Tutorial A8 32bit AES

Hardware-Specific Tutorials

Tutorial P1 Stream Mode and Advanced Triggering (CW Pro)

Tutorial CW305-1 Building a Project

Tutorial CW305-2 Breaking AES on FPGA

Tutorial CW305-3 Clock Glitching

Tutorial CW305-4 Voltage Glitching with Crowbars

Archived Tutorials (v4/v3 only)

Tutorial B3-2 Timing Analysis with Power for Attacking TSB

Tutorial B4 Testing Two Partitions of Traces

Tutorial B5-2 Breaking DES (Straightforward)

Tutorial B8 Profiling Attacks (Manual Template Attack)

Tutorial B9 The Preprocessing Modules

Tutorial B10 Using with SASEBO-W CardOS or DPA Contest v4.2

Tutorial A1 Synchronization to Communication Lines

Tutorial A4 SAD Trigger for SCA and Glitch

Tutorial A6 Replication of Ilya Kizhvatov's XMEGA® Attack

Tutorial A9 Bypassing LPC1114 Read Protect