Adc_freq setting

Embedded Security ChipWhisperer Hardware
1

Hi,

I try to capture (for the first time) the power traces from a new chip.
I think my electrical setup is good but I still don’t get something that makes sense.
I’m wondering if I run the ADC fast enough (I don’t know the clock frequency on the target because it’s running a proprietary bootloader and uses an internal oscillator). I decided to clock the ADC at 100MHz but I get weird results. I may use the API the wrong way:

scope.default_setup()
print(scope.clock)

scope.clock.adc_src = "clkgen_x4"
scope.clock.clkgen_freq = 25000000
scope.clock.reset_dcms()

while scope.clock.clkgen_locked == False:
    print("wait")

print(scope.clock)

This gives me:


adc_src       = clkgen_x4
adc_phase     = 0
adc_freq      = 94368759
adc_rate      = 94368759.0
adc_locked    = True
freq_ctr      = 0
freq_ctr_src  = extclk
clkgen_src    = system
extclk_freq   = 10000000
clkgen_mul    = 2
clkgen_div    = 26
clkgen_freq   = 7384615.384615385
clkgen_locked = True

wait
wait
....
wait
wait
adc_src       = clkgen_x4
adc_phase     = 0
adc_freq      = 94368759
adc_rate      = 94368759.0
adc_locked    = True
freq_ctr      = 0
freq_ctr_src  = extclk
clkgen_src    = system
extclk_freq   = 10000000
clkgen_mul    = 25
clkgen_div    = 96
clkgen_freq   = 25000000.0
clkgen_locked = True

As you can see the clkgen_freq parameter changed but not adc_freq. Sometimes it changes and shows the good value, sometimes something incoherent…

Any clue ?

Franck.

2

Hi Franck,

Try setting scope.clock.adc_src = "clkgen_x4" after you update the clock frequency. We cache some scope parameters and I think you’ve found a situation where we don’t read the actual value back when we should.

Alex

3

Moving scope.clock.adc_src = "clkgen_x4" doesn’t change anything.
However, I looked at the clock with an oscilloscope and the frequency is correct. Good enough for me.

I still can’t see any pattern in the trace.

Could it be that the sampling frequency is too low ?
Having a maximum sample rate at 105MSPS means we can only work on targets with a maximum frequency of 25MHz. Am I correct ? I guess the bootloader I’m working on runs way faster than that.
I didn’t pay attention at the running frequency of the targets used in the courses and other writeups using the CW but 25MHz seems to be very low…

(I’m a bit out of topic here sorry).

Franck.

4

Yeah, it might be that the sampling frequency is too low. We usually run targets at 7.37MHz and the ADC at 4x that. Honestly, the 4x doesn’t make as much of a difference as you’d think - you gain a lot more by having your ADC clock be synchronized with the target clock. If you look at Fig. 1 of this paper (https://eprint.iacr.org/2013/294.pdf), you can see that, at least for this CPA attack, a synchronous 7.37MHz clock outperforms something 10x as fast running asynchronously.

We do have the ChipWhisperer-Husky coming out (ChipWhisperer-Husky | Crowd Supply), which has a 200MS/s ADC, but I think fast ADCs tend to get very expensive very quick.

Alex

5

Thank you, interesting paper.

I see Colin and his associates have done a lot on the subject.
Every time I’m thinking about something I could do, there is a paper about it :slight_smile:

I guess I didn’t use the simplest target as a first real life experiment on power analysis.

Anyway, thanks for your help.

Franck.