Difference between revisions of "CW1101 ChipWhisperer-Nano"

Examples of Tutorials you can Run

ChipWhisperer-Nano is a complete tutorial platform. You could run the following tutorials on it for example (using the included target):

• Perform a CPA (power analysis) attack on a textbook AES implementation.
• Perform a CPA attack on MBED-TLS AES implementation.
• Perform a DPA attack on an XOR password check.
• Perform a SPA attack on an RSA library.
• Perform a timing attack on a password check.
• Perform fault injection attacks to demonstrate corrupting a variable (NB: not as reliable due to limitations listed below).

If you were to attach an external target, you could also do the following:

• Perform a CPA attack on a hardware AES accelerator.
• Perform a power analysis attack on a FPGA target.
• Perform the LPC1114 tutorial.
• Connect to CW308 UFO Board for use with a wide variety of targets.

Limitations compared to ChipWhisperer-Lite and Pro

The ChipWhisperer-Lite and Pro both use an FPGA for performing all clock routing, in addition to using better ADCs and analog front ends. Fundamentally, the design of the ChipWhisperer-Nano means it has the following major limitations:

• Sampling clock in external mode directly follows the input clock (no ability to multiply/divide/offset clock as in CW1173/CW1200).
• Sampling clock in internal mode limited to specific fixed divisions of 240 MHz PLL clock.
• Fixed analog front-end gain of approx 10dB.
• ADC limited to 20MS/s (can be overclocked slightly, up to 30MS/s but not guaranteed).
• No ADC offset to delay capture for some specific number of cycles after the trigger.
• Cannot generate clock glitching waveforms.
• VCC crowbar limited to coarse offset and width steps.
• Considerable jitter on glitch offset (due to interrupt-based source).
• Rising edge trigger only.
• Full-speed USB instead of high-speed USB.

Note that despite these limitations, ChipWhisperer-Nano can be used for attacking real devices. You can attack hardware crypto running on a microcontroller, or use power-analysis to recover a bootloader password or key. The fundamental synchronous architecture of the device (which powers all of our capture hardware tools) means it achieves considerably better performance than a regular asynchronous oscilloscope, even when that oscilloscope is running 5-20x faster.

Tri-State via Program

If using the tri-state mode, you should ensure the PDIC line is held LOW to avoid accidentally entering bootloader mode on the STM32F0.

There will be some additional noise due to the STM32F0 being on the power line. You can reduce this by opening the solder jumper that links the STM32F0 to the input stage.

Cutting end Off

Similar to the ChipWhisperer-Lite, you can break off the end section. To do that, you will have to do the following:

1. Use an xacto knife or similar to deeply score along the perforated holes on both top and bottom, being very careful not to cut towards or near your hand. You will need to hold the CWNANO in an appropriate jig or vice.
2. Align the holes on the edge of a hard surface (suggested: block of wood), and firmly push down on the target end while pushing against down the PCB against the edge. The objective is to avoid flexing the PCB which is likely to break components or solder joints.
3. With appropriate protection from the fiberglass dust, lightly sand the broken edges.