Tutorial P1 Using a Custom Trigger - Revision history

Fheubach at 14:29, 1 May 2018

2018-05-01T14:29:42Z

Fheubach at 13:16, 25 May 2017

2017-05-25T13:16:23Z

Fheubach at 13:14, 25 May 2017

2017-05-25T13:14:52Z

Fheubach at 20:22, 24 May 2017

2017-05-24T20:22:35Z

Fheubach at 13:59, 24 May 2017

2017-05-24T13:59:03Z

Fheubach at 12:57, 24 May 2017

2017-05-24T12:57:24Z

Fheubach at 20:26, 23 May 2017

2017-05-23T20:26:01Z

Fheubach at 20:25, 23 May 2017

2017-05-23T20:25:14Z

Fheubach: The beginning of a pro specific tutorial

2017-05-23T20:24:54Z

The beginning of a pro specific tutorial

New page

{{Warningbox|This page is in progress}}
This tutorial will explore the ChipWhisperer Pro's custom trigger and stream features.

{{TOC|limit=1}}

<h1>Prerequisites</h1>
<p>

This tutorial can only be completed using the [[CW1200_ChipWhisperer-Pro]]. The ChipWhisperer software and its prerequisites should be installed. If not, this is the page for you: [[Installing ChipWhisperer]]. This tutorial is an extension of [[Tutorial B1 Building a SimpleSerial Project]] and [[Tutorial B5 Breaking AES (Straightforward)]], which should be completed first for better understanding.
</p>

<h1>Introduction</h1>
<p>
Unique to the [[CW1200_ChipWhisperer-Pro]]'s more advanced FPGA, the stream feature allows continuous power measurement data streaming, removing the upper limit (due to a smaller FPGA) of total samples possible. This allows to you to continuously stream data for a time period in which you can manually send data to the target to record the power response. You can later find the subsection of sample points in the streamed power trace that correspond to the encryption of data. You can now use a subsection of 128 sample points to create a custom trigger using the sum of differences (TODO: link to subsequent section). This eliminates the need for the target to have a code that signals the ChipWhisperer when encryption begins. The subset of points for triggering is chosen by you, so anything is possible... We will explore one possibility in this tutorial.
</p>

<h1>Building the Target Code</h1>
<p>
We will begin by modifying the <code>simpleserial-aes.c</code> code with a editor of your choice.
</p>
<ol>
<li>Navigate to the ChipWhisperer installation directory and find the <code>simpleserial-aes</code> folder, the folder is in the <code>...\chipwhisperer\hardware\victims\firmware</code> directory. The beginning of the file path may be different depending on the installation directory.
</li>
<li>
Copy the <code>simpleserial-aes</code> folder into the same directory and rename it as you see fit. For example: <code>simpleserial-aes-stream</code>.
</li>
<li>
Now open the <code>simpleserial-aes-stream</code> folder and rename the <code>simpleserial-aes.c</code> file to match the directory name change. For example: <code>simpleserial-aes-stream.c</code>
</li>
<li>
Open the <code>simpleserial-aes-stream.c</code> file in the text editor of your choice and find this section of the code near the top.
<syntaxhighlight lang="c">
/**********************************
* Start user-specific code here. */
uint8_t get_pt(uint8_t* pt)
{
trigger_high();
aes_indep_enc(pt); /* encrypting the data block */
trigger_low();
simpleserial_put('r', 16, pt);
return 0x00;
}
/* End user-specific code here. *
********************************/
</syntaxhighlight>
</li>
<li>
Modify this code by commenting out the <code>trigger_high();</code> and <code>trigger_low();</code> to remove the signal produced by the target to tell the ChipWhisperer it is starting the encryption process. Your c ocde should look like this:
<syntaxhighlight lang="c">
/**********************************
* Start user-specific code here. */
uint8_t get_pt(uint8_t* pt)
{
//trigger_high();
aes_indep_enc(pt); /* encrypting the data block */
//trigger_low();
simpleserial_put('r', 16, pt);
return 0x00;
}
/* End user-specific code here. *
********************************/
</syntaxhighlight>
</li>
</ol>

@@ Line 1: / Line 1: @@
 This tutorial will explore the ChipWhisperer Pro's custom trigger and stream features.
 {{TOC|limit=1}}
-<h1>Prerequisites</h1>
+<h2>Prerequisites</h2>
 <p>
@@ Line 10: / Line 9: @@
 </p>
-<h1>Introduction</h1>
+<h2>Introduction</h2>
 <p>
 Unique to the [[CW1200_ChipWhisperer-Pro]]'s more advanced FPGA, the stream feature allows continuous power measurement data streaming, removing the upper limit (due to a smaller FPGA) of total samples possible. This allows to you to continuously stream data for a time period in which you can manually send data to the target to record the power response. You can later find the subsection of sample points in the streamed power trace that correspond to the encryption of data. You can now use a subsection of 128 sample points to create a custom trigger using the sum of differences (TODO: link to subsequent section). This eliminates the need for the target to have a code that signals the ChipWhisperer when encryption begins. The subset of points for triggering is chosen by you, so anything is possible... We will explore one possibility in this tutorial.
 </p>
-<h1>Building the Target Code</h1>
+<h2>Building the Target Code</h2>
 <p>
 We will begin by modifying the <code>simpleserial-aes.c</code> code with a editor of your choice.
@@ Line 84: / Line 83: @@
 </ol>
-<h1>Setting up Stream Mode</h1>
+<h2>Setting up Stream Mode</h2>
 <ol>
@@ Line 112: / Line 111: @@
 </ol>
-<h1>Capturing the Encryption Process</h1>
+<h2>Capturing the Encryption Process</h2>
 <ol>
@@ Line 149: / Line 148: @@
 </ol>
-<h1>Using a Power Pattern to Activate the Trigger</h1>
+<h2>Using a Power Pattern to Activate the Trigger</h2>
 We are going to use this repeating pattern to allow the [[CW1200_ChipWhisperer-Pro]] to identify when the encryption process occurs and use this to trigger our capture process. We can then use these traces to break the AES-128 encryption exactly the same as in [[Tutorial B5 Breaking AES (Straightforward)]].
@@ Line 201: / Line 200: @@
 </ol>
-<h1>Breaking the Encryption</h1>
+<h2>Breaking the Encryption</h2>
 We will now use the analyzer software to break the AES-128 encryption on the target and figure out the key. This section is analogous to [[Tutorial B5 Breaking AES (Straightforward) #Analyzing the Traces|Analyzing the Traces]] section of Tutorial B5.
-<h1>Conclusion</h1>
+<h2>Conclusion</h2>
 In this tutorial we have learned to use two of the [[CW1200_ChipWhisperer-Pro]]'s exclusive features stream mode and SAD Trigger. The stream feature allows us the continually stream and manually send plain text to the target to observe the encryption process. Then 128 sample points that make up a unique feature of the encryption process where chosen to activate the trigger during our following traces. These two features together can be used to break the AES encryption of a device without any help from the target.

← Older revision		Revision as of 13:16, 25 May 2017
Line 208:		Line 208:

	In this tutorial we have learned to use two of the [[CW1200_ChipWhisperer-Pro]]'s exclusive features stream mode and SAD Trigger. The stream feature allows us the continually stream and manually send plain text to the target to observe the encryption process. Then 128 sample points that make up a unique feature of the encryption process where chosen to activate the trigger during our following traces. These two features together can be used to break the AES encryption of a device without any help from the target.		In this tutorial we have learned to use two of the [[CW1200_ChipWhisperer-Pro]]'s exclusive features stream mode and SAD Trigger. The stream feature allows us the continually stream and manually send plain text to the target to observe the encryption process. Then 128 sample points that make up a unique feature of the encryption process where chosen to activate the trigger during our following traces. These two features together can be used to break the AES encryption of a device without any help from the target.
		+
		+	{{Template:Tutorials}}
		+	[[Category:Tutorials]]

@@ Line 149: / Line 149: @@
 </ol>
-<h1>Creating a Custom Trigger</h1>
+<h1>Using a Power Pattern to Activate the Trigger</h1>
 We are going to use this repeating pattern to allow the [[CW1200_ChipWhisperer-Pro]] to identify when the encryption process occurs and use this to trigger our capture process. We can then use these traces to break the AES-128 encryption exactly the same as in [[Tutorial B5 Breaking AES (Straightforward)]].
@@ Line 175: / Line 175: @@
 <ol start="3">
 <li>
-Once you have chosen the points that initialize the trigger you can drag the selection box around and take note of the <b>SAD Reference vs. Cursor</b> value and how it changes. Choose a threshold
+Once you have chosen the points that initialize the trigger you can drag the selection box around and take note of the <b>SAD Reference vs. Cursor</b> value and how it changes. Notice the when the selection cursor is not in the correct spot the SAD should be around 10000 or more. Choose a <b>SAD Threshold</b> that will trigger only when the selected pattern is observed. For example: 5000 for this example works fine.

@@ Line 82: / Line 82: @@
 Open your command line in the <code>simpleserial-aes-stream</code> directory and run the <code>make</code> command for the correct target. For example: for the XMEGA run <code>make PLATFORM=CW303</code>. This will create a <code>.hex</code> file in the same directory. This step requires avr-gcc to be set-up and added to your system path. If you have not done this go back to [[Installing ChipWhisperer]] under the <b>Required Tools</b> dropdown.
 </li>
 <li>
 Next open the ChipWhisperer software. Hopefully you know how to do this by now.
 </li>
 <li>
-Run the <code>Project>Example Scripts>ChipWhisperer-Lite: AES SimpleSerial on XMEGA</code> script. We will modify some of the settings.
+Run the <code>Project > Example Scripts > ChipWhisperer-Lite: AES SimpleSerial on XMEGA</code> script. We will modify some of the settings.
 </li>
 The modifications to the settings will allow us the use stream mode while manually sending a plain text for encryption. We will then look at the stream data and identify where the encryption takes place and what it looks like.
@@ Line 96: / Line 101: @@
 <li>
 Under the <b>Scope Settings</b> find the <b>Trigger Setup</b> section. Enable <b>Stream Mode</b>. The <b>Mode</b> field needs to be set to <code>low</code> so the sample capture starts right away because the target does not set the trigger line to high anymore during encryption.
 </li>
 <li>
@@ Line 101: / Line 108: @@
 </li>
 Note: The <b>Timeout (secs)</b> field needs to be set greater than the time it needs to stream the samples and a little additional time to allow for hardware communication. For example: 11 million samples take about 1.5 seconds at the sampling rate of 7.3MS/s so this field should be set to <code>2</code> seconds. You can set it higher if needed.
 </ol>

@@ Line 88: / Line 88: @@
 Run the <code>Project>Example Scripts>ChipWhisperer-Lite: AES SimpleSerial on XMEGA</code> script. We will modify some of the settings.
 </li>
 <li>
-Under the <b>Scope Settings</b> find the <b>ADC Clock</b> section. Here change the <b>Source</b> setting to <b>CLKGEN x1 via DCM</b>
+Under the <b>Scope Settings</b> find the <b>ADC Clock</b> section. Here change the <b>Source</b> setting to <code>CLKGEN x1 via DCM</code>. The <b>ADC Sample Rate</b> field should auto-populate to <b>7.3846 MS/s</b> or a number approximately equal. If the sampling rate is above 10 MS/s the streaming mode will not work as the buffer in the FPGA will overflow.
 </li>
 </ol>

@@ Line 7: / Line 7: @@
 <p>
-This tutorial can only be completed using the [[CW1200_ChipWhisperer-Pro]]. The ChipWhisperer software and its prerequisites should be installed. If not, this is the page for you: [[Installing ChipWhisperer]]. This tutorial is an extension of [[Tutorial B1 Building a SimpleSerial Project]] and [[Tutorial B5 Breaking AES (Straightforward)]], which should be completed first for better understanding.
+This tutorial can only be completed using the [[CW1200_ChipWhisperer-Pro]]. The ChipWhisperer software and its prerequisites should be installed and the [[CW1200_ChipWhisperer-Pro]] and hardware should be connected to each other and your computer. If not, this is the page for you: [[Installing ChipWhisperer]]. This tutorial is an extension of [[Tutorial B1 Building a SimpleSerial Project]] and [[Tutorial B5 Breaking AES (Straightforward)]], which should be completed first for better understanding.
 </p>
@@ Line 65: / Line 65: @@
   ********************************/
 </syntaxhighlight>
 </li>
 </ol>

@@ Line 33: / Line 33: @@
 /**********************************
   * Start user-specific code here. */
 uint8_t get_pt(uint8_t* pt)
+{
@@ Line 41: / Line 42: @@
 	return 0x00;
+}
 /* End user-specific code here. *
   ********************************/
@@ Line 50: / Line 52: @@
 /**********************************
   * Start user-specific code here. */
 uint8_t get_pt(uint8_t* pt)
+{
@@ Line 58: / Line 61: @@
 	return 0x00;
+}
 /* End user-specific code here. *
   ********************************/

@@ Line 46: / Line 46: @@
 </li>
 <li>
-Modify this code by commenting out the <code>trigger_high();</code> and <code>trigger_low();</code> to remove the signal produced by the target to tell the ChipWhisperer it is starting the encryption process. Your c ocde should look like this:
+Modify this code by commenting out the <code>trigger_high();</code> and <code>trigger_low();</code> to remove the signal produced by the target to tell the ChipWhisperer it is starting the encryption process. Your c code should look like this:
 <syntaxhighlight lang="c">
 /**********************************