Changes

This tutorial uses can use either the [[CW1173_ChipWhisperer-Lite]], [[CW1200_ChipWhisperer-Pro]], or [[CW1002_ChipWhisperer_Capture_Rev2]] hardware along with the [[CW301_Multi-Target]] board. Note that you '''don't need hardware''' to complete the tutorial. Instead you can download [https://www.assembla.com/spaces/chipwhisperer/wiki/Example_Captures example traces from the ChipWhisperer Site], just look for the traces titled ''XMEGA: AES128 Hardware Accelerator (ChipWhisperer Tutorial #A6)''. '''NOTE: The ChipWhisperer-Lite Target Board contains an XMEGA device, but this device DOES NOT contain the hardware crypto engine. Only the CW301 Multi-Target board contains an XMEGA with a hardware AES engine.'''

The Multi-Target board should be plugged into the ChipWhisperer Capture Rev2 via the 20-pin target cable. The ''VOUT'' SMA connector is wired to the ''LNA'' input on the ChipWhisperer-Capture Rev2 front panel. The general hardware setup is as followsslightly different for the ChipWhisperer-Lite/Pro and older Capture-Rev2:

<blockquote>=== Using ChipWhisperer-Lite / ChipWhisperer-Pro === # 20-Pin Header connects Multi-Target to Capture Hardware# VOUT Connects to SMA Cable# SMA Cable connects to 'LNA' on CHA input Jumpers on the Multi-Target Victim board are as follows: [[File:xmegajumpers_cwlite.jpg]] # NO jumpers mounted in AVR Portion (JP1,JP4-6,JP28) or SmartCard Portion. Note if your multi-target board does not have JP28, the TRIG jumper for the AVR, you will have to remove the AVR from the socket.# 3.3V IO Level (JP20 set to INT.)# FPGAOUT is routed to XTAL1 pin of XMEGA (requires jumper wire to JP4/JP15).# The 7.37 MHz oscillator is not connected (JP18)# The TXD &amp; RXD jumpers are set on the XMEGA portion (JP5, JP6)# The TRIG jumper is set on the XMEGA portion (JP13)# The PWR jumper is set on the XMEGA portion (JP14)# Power measurement taken from VCC shunt (JP12) === Using Capture Rev 2 === # 20-Pin Header connects Multi-Target to Capture Hardware

<blockquote>[[File:xmegajumpers.jpg|image]]

Device: atxmega128a3atxmega16a4

Using either AVRStudio or AVRDudethe XMEGA Programmer, program the XMega16A4 device (it is connected to the programmer built into the ChipWhisperer) with the resulting simpleserial.hex file.

=== Running the Capture Capturing Traces ===

<ol style="list=== CW-styleCapture Lite/Pro Specific Setup ====  The following are specific instructions only for the ChipWhisperer-typeLite or -Pro: decimal;"><li>Close # From the Project menu select the Example Scripts and then ChipWhisperer-Lite: AES SimpleSerial on XMEGA# This should connect to the target board &amp; reopen run a few encryptions. You should check the capture software "Encryption Status Manager" along with viewing the resulting power measurement.# Jump to the generic instructions (to clear out any previous connection which may be invalidskip the CWC-Rev2 instructions next).</li><li><p>==== CW-Capture Rev2 Specific Setup ==== The following are specific instructions only for the ChipWhisperer-Capture Rev 2: #From the ''Project'' menu elect select the ''Example Scripts'' and then ''ChipWhisperer-Rev2: SimpleSerial Target''</p><p>#: [[File:runscript.png|image]]</p></li><li><p>#The script will automatically connect to the capture hardware and run 2 example traces. They will not yet work on the XMega as additional setup is required. You must switch the RX/TX pins:</p><p>#:[[File:xmegarxtx.png|image]]</p></li><li><p>#Run a 'Capture 1', you should confirm the encryption algorithm is working:</p><p>#:[[File:capture1_working.png|image]]</p></li><li><p>#Jump to the generic capture instructions (next) ==== Trace Capture Instructions ==== #Switch from software to hardware crypto. To do this change the 'Goyou' command ll have to change the <code>h$TEXT$\nmakefile</code>for the project.#:In the makefile, add a define for </pcode>HWCRYPTO=1<p/code>[[File:gocommand.png|image]]</ppre>#Multi-Target Board, XMEGA DevicePLATFORM = CW301_XMEGA#Optional - use hardware cryptoCDEFS += -DHWCRYPTO=1</lipre><li><p>#Build a new hex-file, and program the file in.#Run a few 'capture 1' traces, and confirm (using the Encryption Status Manager) that the encryption was successful.#Finally, set the offset to 1500, and number of samples to only 1000:</p><p>#:[[File:slength.png|image]]</p></li><li><p>#Confirm you now get something like this with a 'capture 1':</p><p>#:[[File:capture1_fullworking.png|image]]</p></li><li><p>To complete the tutorial, follow these steps:</p><blockquote><ol style="list-style-type: decimal;"><li>#Switch to the ''General Settings'' tab</li><li>#Change the number of traces to 3000.</li><li>#Hit the ''Capture Many'' button (M in a green triangle) to start the capture process.</li><li>#You will see each new trace plotted in the waveform display.</li><li>#Wait until the capture is complete.</li></ol></blockquote></li><li>#Finally save this project using the ''File --&gt; Save Project'' option, give it any name you want.</li></ol>

<dt>The API calling parameters changed in release 0.10 a number of the ChipWhisperer softwaretimes. If using version 0.09 release 10 or older, either see the documentation that</dt><dd><p>is present in the 'doc' directory (which will always correspond to your release), or see Appendix B -2/B-1 for the full attack script.</p></dd></dl>

return self.attack</pre></li>

== Appendix B-1: Full Attack Script for older (< 3.1.x) ==

Here is the full attack script for older releases:- '''DO NOT attempt to use with a current release (3.1.8 or later)'''.

== Appendix B-2: Full Attack Script for 0.09 or Older Releases ==

Here is the full attack scriptfor VERY old releases: