Approved_users
510
edits
Changes
no edit summary
The ChipWhisperer-Lite Bare Board consists of two main parts: a multi-purpose power analysis capture instrument, and a target board. The target board is a standard microcontroller which you can implement algorithms onto. For example if you wish to evaluate an AES library, you can program that library into the target board and perform the power analysis.
[[File:cwlite_basic.png|image]]
You can see a [http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1 Video] of the quickstart guide, which will take you through all the setup items discussed here:
[[File:cwlite_demo_video.png|YouTubeCW1173Demo]]_
<ol style="list-style-type: decimal;">
<li>Your ChipWhisperer-Lite is now connected. See the next section for details of the demo attack.</li></ol>
# See [[Tutorial_B5_Breaking_AES_(Straightforward)]]for details. Note the hardware setup is slightly different -- but you can skip to step 5.5.3, and should be able to pick up from there. Be sure to use the <code>ChipWhisperer-Lite: AES SimpleSerial on XMEGA</code> script instead of the one referenced in step 5.5.3.
The following includes various things that might trip you up:
# By default the XMEGA device was programmed with a partial AES implementation only. This is done to avoid any crypto export issues. This does not affect your side-channel analysis, but be aware the returned value might not appear to be correct (since only the first couple rounds of AES occurred).
<blockquote></blockquote>
The CW1173 has built-in support for programming either Atmel AVR or Atmel XMEGA device. This is designed to allow you to program our target boards (either the built-in XMEGA target, or the Multi-Target board).
Note this programmer is fairly simple, and ''does not'' provide all the features of a stand-alone programmer.
The AVR device programmer requires four connections to the target: RESET, MOSI, MISO, SCK. See [[#20-Pin_Connector]] for details of AVR programming pin connections.
To access the AVR Programmer, select the "CW-Lite AVR Programmer" from the pull-down Tools menu:
Which should give you the AVR Programmer Window.
Note to use the AVR programmer you may require a valid clock source for the AVR. It is suggested to select one of the setup scripts (such as <code>ChipWhisperer-Lite: AES Simple-Serial on ATMega328P</code>) which will generate a 7.37 MHz clock.
The 'slow clock mode' is used to provide a slower SPI clock than would otherwise be possible. When switching into 'slow clock mode' it will cause all DCM blocks in the FPGA to become unlocked. You will need to reset the DCM blocks, or simply restart the CW-Capture software and run the setup script.
</blockquote>
By default the AVR programmer allows you to modify the LOW fuse byte only, as this byte controls the clock source selection. To change the value of the fuse byte:
The low fuse byte must be changed to <code>D0</code> to use the external clock provided by the ChipWhisperer toolchain.
</blockquote>
Programming the flash is accomplished by selecting the new .hex file in the "Find" menu, and pressing the "Erase/Program/Verify FLASH" button. The "Status" line will show the following information:
[[File:avrprog_progok.png|image]]
The XMEGA device programmer requires only two connections to the target: clock (PDIC) and data (PDID). The PDIC line is usually shared with the RESET pin, and the PDID pin is a specific pin on the XMEGA device. See [[#20-Pin_Connector]] for details of XMEGA programming pin connections.
[[File:xmegaprog_main.png|image]]
The "GLITCH" port is used for voltage glitching. It's connected to two MOSFET elements, as the following figure shows:
Be careful using this feature, as you don't want to short the MOSFETs for too long. It's also possible to damage the ChipWhisperer-Lite by burning these MOSFETs up if used incorrectly. See tutorial #A3 for more information on using this feature.
The "MEASURE" port is the input to the low-noise amplifier and ADC.
The pinout is as follows:
|}
The CW1173 contains two 8-pin connectors, which use our standard 8-pin Smart-Card header pinout. One header connects to the SAM3U device (which has ISO-7816 drivers), one header connects to the FPGA. Note there is currently no firmware support for these devices, but the hardware is designed for any of the following:
|}
When talking about the ChipWhisperer-Lite's firmware, there is really two parts to this:
The FPGA bitstream alone is what is normally configured by the ChipWhisperer-Capture software. This bitstream is always the most up-to-date, since it's automatically reloaded by the computer every time you power cycle the ChipWhisperer-Capture. The SAM3U firmware however is not automatically updated, but it tends to change less frequently.
The firmware version is printed at start-up. You will see a line that looks like this indicating the version of the SAM3U Firmware:
Note the main version is 0.11 in this example. The "b0" indicates a "build" number. Typically this will be "build 0", but special versions will use a different build number to indicate a variant of a regular version.
Before updating, you must put your ChipWhisperer-Lite into bootloader mode. Once put into this mode you will need to load a new firmware file. There is two ways of doing it: the ''automatic'' method, and the ''manual'' method. The automatic method is done through the GUI, and works if you have valid firmware image loaded. The ''manual'' method is always guaranteed to work.
# Close the update widgets, and reconnect to your ChipWhisperer-Lite.
If the above instructions fail, there is no big problem. The SAM3U chip contains a hardware-resident bootloader. You may need to follow instructions on the [[Manual SAM3U Firmware Update]] page (including using BOSSA) if you are unable to use the automatic system that is part of ChipWhisperer-Capture.
You may wish to break the target section apart from the main capture board. This can easily be accomplished by following these instructions:
Applying even pressure will help prevent damage to the ChipWhisperer-Lite main section. Flexing the PCB too much may cause damage to solder joints, but by holding the entire board flat against the edge this is prevented.
Note the ChipWhisperer-Lite main board and target section contain a number of jumper options. By default these are not mounted, and solder jumper bridges on the PCB have been bridged to select the appropriate options when required. Some options are only solder jumpers, which to move the jumper requires a soldering iron to bridge or clear the appropriate connections.