Tutorial B5 Breaking AES (Straightforward) - Revision history

Adewar at 13:10, 29 July 2019

2019-07-29T13:10:50Z

Show changes

Adewar: /* Flashing Firmware */

2018-10-09T16:35:19Z

‎Flashing Firmware

Adewar: /* Next Steps */

2018-10-01T17:03:16Z

‎Next Steps

Adewar at 21:41, 28 September 2018

2018-09-28T21:41:36Z

Adewar at 17:30, 28 September 2018

2018-09-28T17:30:38Z

Adewar at 20:25, 27 September 2018

2018-09-27T20:25:01Z

Adewar at 20:24, 27 September 2018

2018-09-27T20:24:24Z

Adewar at 20:23, 27 September 2018

2018-09-27T20:23:34Z

Fheubach at 18:44, 1 May 2018

2018-05-01T18:44:43Z

Fheubach at 14:57, 1 May 2018

2018-05-01T14:57:58Z

@@ Line 54: / Line 54: @@
 === Flashing Firmware ===
-Note that for this tutorial, you'll need to use the <code>simpleserial-aes</code> firmware.{{CollapsibleSection
+Note that for this tutorial, you'll need to use the <code>simpleserial-aes</code> firmware. We won't be modifying the firmware, so feel free to just build in the <code>simpleserial-aes</code> folder.{{CollapsibleSection
 |intro = ==== Programming the XMEGA Target ====
 |content= Programming XMEGA}}

@@ Line 191: / Line 191: @@
 == Next Steps ==
-This has only briefly outlined how to perform a CPA attack. You can move onto more advanced tutorials, especially showing you how the actual attack works when performed manually.
+This has only briefly outlined how to perform a CPA attack. You can move onto more advanced tutorials, especially showing you how the actual attack works when performed manually. This tutorial also utilized tiny-AES128-C for Arm targets, which uses the same operations as the XMEGA target. For a more typical 32 bit AES attack, see [[Tutorial A8 32bit AES]].
 == Links ==

@@ Line 41: / Line 41: @@
 === Building Firmware ===
-{{CollapsibleSection
+Note that for this tutorial, you'll need to use the <code>simpleserial-aes</code> firmware.{{CollapsibleSection
 |intro = ==== Building for CWLite with XMEGA Target ====
 |content= Building for XMEGA}}
@@ Line 54: / Line 54: @@
 === Flashing Firmware ===
-{{CollapsibleSection
+Note that for this tutorial, you'll need to use the <code>simpleserial-aes</code> firmware.{{CollapsibleSection
 |intro = ==== Programming the XMEGA Target ====
 |content= Programming XMEGA}}

@@ Line 26: / Line 26: @@
 [[File:Cwlite_demo_video.png|link=http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1]]
-==== Hardware Setup ====
+=== Hardware Setup ===
-<ol style="list-style-type: decimal;">
+{{CollapsibleSection
-<li><p>Connect the CW1173/CW1200 by USB cable to computer.</p>
+|intro = ==== CW1173 (Lite) Hardware Setup ====
-<blockquote><p>[[File:cw1173_microusb.jpg|image]]</p></blockquote>
+|content= CWLite HW Setup}}
-</li>
-<li> The software AES implementation that will run on the target is located in <code>chipwhisperer\hardware\victims\firmware\simpleserial-aes</code>. In a terminal window, navigate here and run the command <code>make</code> to build the firmware.
-As in previous tutorials, ensure that the firmware has been built for the correct board. Here, the output of <code>make</code> should end like
+{{CollapsibleSection
-<pre>
+|intro = ==== CW1200 (Pro) Hardware Setup ====
-AVR Memory Usage
+|content= CW1200 HW Setup}}
-----------------
-Device: atxmega128d3
-Program:    3078 bytes (2.2% Full)
+{{CollapsibleSection
-(.text + .data + .bootloader)
+|intro = ==== CW308 (UFO) Hardware Setup ====
-Data:        352 bytes (4.3% Full)
+=== Building Firmware ===
-(.data + .bss + .noinit)
+{{CollapsibleSection
-Built for platform CW-Lite XMEGA
+{{CollapsibleSection
--------- end --------
+=== Flashing Firmware ===
-</pre>
+{{CollapsibleSection
-Like before, if you're using the ARM target, use <code>make PLATFORM=CWLITEARM CRYPTO_TARGET=TINYAES128C</code>.
+|intro = ==== Programming the XMEGA Target ====
-Make sure that the platform is correct.
+{{CollapsibleSection
-</li>
+|intro = ==== Programming the STM32F3 (CW303 Arm) Target ====
-<li> Upload the firmware to the target chip. The process to do this is the same as the previous tutorials:
+{{CollapsibleSection
-* Open the ChipWhisperer Capture software.
+|intro = ==== Programming Other Targets ====
-* Connect to the ChipWhisperer. (You can do this using a script or by filling out the generic settings and connecting to the board yourself.)
+|content= Programming Other}}
-* Open the XMEGA Programmer (**Tools > ChipWhisperer-Lite XMEGA Programmer**), or, if you're using the ARM target, open the STM32F Programmer.
-* Find the hex file you compiled and program it onto the target.
-</li>
-</ol>
-==== Capturing the Traces ====
+=== Capturing the Traces ===
 [[File:cwsetup_scriptselection.png|889x889px]]
@@ Line 85: / Line 87: @@
 Note in previous software versions, this tutorial took you through manual setup. This can still be done (using the GUI), but instead now the API has been made more powerful, so the example configuration script will be used instead.
-To do so, simply scroll down and select the "setup_cwlite_xmega_aes.py" if you're using the XMEGA target. If you're using the ARM target, select "setup_cwlite_stm32f_aes.py":
+To do so, simply scroll down and select the "setup_cwlite_xmega_aes.py" if you're using the CW303 XMEGA target. If you're using the CW303 Arm target, select "setup_cwlite_stm32f_aes.py".
 [[File:cwsetup_scriptselection_xmegaconfig_cwliterun.png|718x718px]]
@@ Line 93: / Line 97: @@
 To complete the tutorial, follow these steps:<ol start="7" style="list-style-type: decimal;">
 <li>Switch to the ''General Settings'' tab</li>
-<li>If you wish to change the number of traces, do so here. The default of 50 should be sufficient to break AES though!</li>
+<li>If you wish to change the number of traces, do so here. The default of 50 should be sufficient to break AES for most targets though!</li>
 <li>Hit the ''Capture Many'' button (M in a green triangle) to start the capture process.</li>
 <li>You will see each new trace plotted in the waveform display.</li>
@@ Line 99: / Line 103: @@
 <li>Finally save this project using the ''File --&gt; Save Project'' option, give it any name you want.</li>
 <li>Skip ahead to [[#Analyzing_the_Traces]].</li></ol>
 == Analyzing the Traces ==

@@ Line 51: / Line 51: @@
 -------- end --------
 </pre>
-Like before, if you're using the ARM target, use <code>make PLATFORM=CWLITEARM CRYPTO_TARGET=TINYAES128C.</code>
+Like before, if you're using the ARM target, use <code>make PLATFORM=CWLITEARM CRYPTO_TARGET=TINYAES128C</code>.
 Make sure that the platform is correct.

@@ Line 8: / Line 8: @@
 |capture hardware       = CW-Lite, CW-Lite 2-Part, CW-Pro
 |Target Device          =
-|Target Architecture    = XMEGA
+|Target Architecture    = XMEGA/ARM
 |Hardware Crypto        = No
 |Purchase Hardware      =
@@ Line 51: / Line 51: @@
 -------- end --------
 </pre>
 Make sure that the platform is correct.
 </li>
@@ Line 57: / Line 59: @@
 * Open the ChipWhisperer Capture software.
 * Connect to the ChipWhisperer. (You can do this using a script or by filling out the generic settings and connecting to the board yourself.)
-* Open the XMEGA Programmer (**Tools > ChipWhisperer-Lite XMEGA Programmer**).
+* Open the XMEGA Programmer (**Tools > ChipWhisperer-Lite XMEGA Programmer**), or, if you're using the ARM target, open the STM32F Programmer.
 * Find the hex file you compiled and program it onto the target.
 </li>
@@ Line 83: / Line 85: @@
 Note in previous software versions, this tutorial took you through manual setup. This can still be done (using the GUI), but instead now the API has been made more powerful, so the example configuration script will be used instead.
-To do so, simply scroll down and select the "setup_cwlite_xmega_aes.py" file:
+To do so, simply scroll down and select the "setup_cwlite_xmega_aes.py" if you're using the XMEGA target. If you're using the ARM target, select "setup_cwlite_stm32f_aes.py":
-[[File:cwsetup_scriptselection_xmegaconfig_cwliterun.png]]
+[[File:Stm32f aes.PNG|frameless|798x798px]]
-<p>To complete the tutorial, follow these steps:</p>
+To complete the tutorial, follow these steps:<ol start="7" style="list-style-type: decimal;">
 <ol start="7" style="list-style-type: decimal;">
 <li>Switch to the ''General Settings'' tab</li>
 <li>If you wish to change the number of traces, do so here. The default of 50 should be sufficient to break AES though!</li>

@@ Line 189: / Line 189: @@
 This has only briefly outlined how to perform a CPA attack. You can move onto more advanced tutorials, especially showing you how the actual attack works when performed manually.
 {{Template:Tutorials}}
 [[Category:Tutorials]]

@@ Line 15: / Line 15: @@
 This tutorial will take you through a complete attack on a software AES implementation. The specific implementation being attacked is a well-known AES implementation written in C, which is likely to be similar to other implementations used by proprietary systems.
-= Capturing =
+== Capturing ==
 This tutorial runs on four different hardware targets. You only need to follow the steps for your given hardware.
-== Capturing with ChipWhisperer-Lite/Pro with default XMEGA Target (CW303) ==
+=== Capturing with ChipWhisperer-Lite/Pro with default XMEGA Target (CW303) ===
 WARNING: This video was recorded with API V3.x, some changes happened so please take note.
@@ Line 26: / Line 26: @@
 [[File:Cwlite_demo_video.png|link=http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1]]
-=== Hardware Setup ===
+==== Hardware Setup ====
 <ol style="list-style-type: decimal;">
@@ Line 62: / Line 62: @@
 </ol>
-=== Capturing the Traces ===
+==== Capturing the Traces ====
 [[File:cwsetup_scriptselection.png|889x889px]]
@@ Line 97: / Line 97: @@
 <li>Skip ahead to [[#Analyzing_the_Traces]].</li></ol>
-== Capturing with ChipWhisperer-Lite and UFO Board ==
+=== Capturing with ChipWhisperer-Lite and UFO Board ===
 TODO
-= Analyzing the Traces =
+== Analyzing the Traces ==
-== Opening File & Viewing Traces ==
+=== Opening File & Viewing Traces ===
 <ol style="list-style-type: decimal;">
@@ Line 121: / Line 121: @@
 </ol>
-== Running Attack Script ==
+=== Running Attack Script ===
 In ChipWhisperer V4.0, we now use attack scripts for everything. As in the capture program, switch to the '''Python Console''' tab & find the attack scripts. There may be additional scripts there, but you should find one called "attack_cpa.py". It has the following contents:
@@ Line 186: / Line 186: @@
 <p>[[File:attack-done2.png|image]]</p></li></ol>
-= Next Steps =
+== Next Steps ==
 This has only briefly outlined how to perform a CPA attack. You can move onto more advanced tutorials, especially showing you how the actual attack works when performed manually.