Main Page

ChipWhisperer® by NewAE Technology Inc.

Welcome to ChipWhisperer - the complete open-source toolchain for side-channel power analysis and glitching attacks. This is the main landing page for ChipWhisperer. ChipWhisperer has been presented at conferences such as DEFCON and Blackhat, had a successful Kickstarter (that delivered ahead of schedule), and placed 2nd place in the first annual Hackaday Prize. ChipWhisperer has been used in a number of academic articles, and is featured in the Car Hacking Handbook. Portions of the design have even been used by Los Alamos Labs for an electron accelerator. You can see a full list of references on the Press page.

ChipWhisperer is maintained by NewAE Technology Inc., which sells a combination of open-source hardware, supporting tools, training, and consulting services. ChipWhisperer is trademark of NewAE Technology Inc., registered in the US and Europe. This means only NewAE can sell official products under the ChipWhisperer name, and was done to ensure products meet Quality Control Guidelines, as these fairly complex products require good testing to ensure you don't have a frustrating experience.

Beyond supporting just the ChipWhisperer project, this wiki is now growing towards the objective of offering a complete reference on embedded security.

Getting Started

Where to begin? If you're new to this area, see the Getting Started page, which details how you can get involved in side-channel power analysis. From there you can see the hardware documentation (linked below), or take one of the Training Courses.

If you're stuck, you can also get help on the Discussion Forum.

Hardware Documentation

Old Hardware (see RTFM.NEWAE.COM for new)

3rd Party Targets	SAKURA-G Target • SASEBO-W Target
Test Equipment	PicoScope (USB Scope) • VISA Connected Oscilloscope
Obsolete	CW1002 ChipWhisperer Capture Rev2 • CW301 Multi-Target

Software Documentation

ChipWhisperer is an open-source project. All of the source code is available from the Git Repository. For more information about the software releases, see Releases or the installation instructions at Installing ChipWhisperer.

The following pages document some of the many features of the ChipWhisperer Capture and Analyzer software, along with some other ChipWhisperer interfaces:

• Installing ChipWhisperer
• Common Tool Information
  • Making Scripts
  • Adding Modules/Parameters
• CW-Capture Tool
  • Glitch Explorer
  • Serial Terminal
• CW-Analyzer Tool
• File Formats
• MATLAB Control of CW-Lite

The remaining documentation is intended for developers:

• Error Messages / Common Problems
• FPGA Details
• CW Release Steps

Sample Projects and Tutorials

ChipWhisperer Tutorials

The following tutorials use the ChipWhisperer software and/or hardware. They are designed to take you through a complete attack. You may also want to check the page on Embedded Attacks for more snippets of simple attacks and other things you should verify when making a secure system.

Not all tutorials are possible with all hardware. See the various tutorial pages for details.

Tutorials

See Tutorial Map for important information & suggested order of completion.

Theory

Correlation Power Analysis

Template Attacks

Extending AES-128 Attacks to AES-256

Basic Tutorials

Tutorial B1 Building a SimpleSerial Project

Tutorial B2 Viewing Instruction Power Differences

Tutorial B3-1 Timing Analysis with Power for Password Bypass

Tutorial B5 Breaking AES (Straightforward)

Tutorial B6 Breaking AES (Manual CPA Attack)

Tutorial B7 Profiling Attacks (with HW Assumption)

Tutorial B11 Breaking RSA

Advanced Tutorials

Tutorial A2 Introduction to Glitch Attacks (including Glitch Explorer)

Tutorial A3 VCC Glitch Attacks

Tutorial A5 Breaking AES-256 Bootloader

Tutorial A5-Bonus Breaking AES-256 Bootloader

Tutorial A7 Glitch Buffer Attacks

Tutorial A8 32bit AES

Hardware-Specific Tutorials

Tutorial P1 Stream Mode and Advanced Triggering (CW Pro)

Tutorial CW305-1 Building a Project

Tutorial CW305-2 Breaking AES on FPGA

Tutorial CW305-3 Clock Glitching

Tutorial CW305-4 Voltage Glitching with Crowbars

Archived Tutorials (v4/v3 only)

Tutorial B3-2 Timing Analysis with Power for Attacking TSB

Tutorial B4 Testing Two Partitions of Traces

Tutorial B5-2 Breaking DES (Straightforward)

Tutorial B8 Profiling Attacks (Manual Template Attack)

Tutorial B9 The Preprocessing Modules

Tutorial B10 Using with SASEBO-W CardOS or DPA Contest v4.2

Tutorial A1 Synchronization to Communication Lines

Tutorial A4 SAD Trigger for SCA and Glitch

Tutorial A6 Replication of Ilya Kizhvatov's XMEGA® Attack

Tutorial A9 Bypassing LPC1114 Read Protect

Example Attacks / Other

While ChipWhisperer started as a side-channel power analysis platform, it has grown to be useful in other attack types. This section is designed to show you a wide variety of attacks on embedded systems, to give you an idea of what is required for building secure embedded systems. These are held on the page Embedded Attacks.

In 2016, ChipWhisperer was used as part of the CHES2016 CTF challenge. See details of the event on the CHES2016 CTF page.

Recent/Upcoming Events

Upcoming events with NewAE:

• Blackhat USA 2017 (Hands-on Power Analysis & Glitching with the ChipWhisperer)

These are some past events that were attended by someone from NewAE:

• Blackhat USA 2016: Training based on ChipWhisperer, 2x talks by Colin, Arsenal
• CHES 2016: Sponsor with exhibit booth
• Blackhat USA 2014: Training class
• RECON 2014: Video and Slides
• O'Reilly Solid 2014: Demo
• COSADE 2014: Paper
• CHES 2013: Slides and Video
• Blackhat USA 2013
• iSEC Open Security Forum (April 2013)
• Design West 2013
• Blackhat EU 2013
• AtlSecCon 2013
• Blackhat Abu Dhabi 2012

Extra Notes

See the page Thanks for a note about the people who made this project possible.

ChipWhisperer is a Trademark of NewAE Technology Inc., registered in the U.S and Europe. Used with Permission.