Hi Mates,
I am planning to build price efficient cyber security lab for my HW designs. I came across Chipwhisper product, but could not select which one is suitable for my application. Could someone help me about it?
My use case scenario is basically power rail fault injection. There are different voltage levels which are 0.35V, 0.75V, 1.2V, 1.8V, 3.3V and 5V. I plan to apply the glitches with variable length (min 5ns max 500ns).
I am looking for a product which I can set voltage amplitude for different levels. Which ChipWhisper product can support that voltage level can be set as variable?
From the datasheet of Husky, it has Digital IO output from FPGA, but I cannot find the information of switching frequency of pins. That’s why I am a little lost how to bring up the test setup. Is it fine to connect Chipwhisper Husky DIO pin to N-MOS Mosfet gate? If so, do you have a recommendation of selecting NMOS?
Best regards,
Berkay
All ChipWhisperer products can do voltage glitching; have a look at our comparison table here.
Our voltage glitching is a crowbar of the target supply to ground via MOSFETs that are already in the ChipWhisperer capture board. The target supply can be “anything” within spec of our glitch MOSFETs.
Our target infrastructure mates the target to ChipWhisperer via our CW308 or CW313 target adapter boards, and these boards provide several supply voltage options for your target, from 1.2V to 5V (5V is not available on the CW313).
Note however that all ChipWhisperer I/O is 3.3V.
Hi @jpthibault
Thank you for the answer. I assume that Chipwhisperer MOSFET is connected to 3.3V and the glitch output is connected to drain output (for NMOS). As the MOSFET supply voltage is 3.3V, it can exhaust target supply input pin which are less than 1V during the idle state because of the current flow between target and Chipwhisperer.
Does Chipwhisperer has an internal diode or serial resistor to limit the current?
What is the rise time of internal MOSFET of Chipwhisperer? Can I generate glitch which has 5ns glitch length?
Best regards,
Berkay
It’s not quite like that.
We don’t have a diagram which gives the full picture (that’s on the TODO list), but you can build that picture yourself via our schematics.
The glitch infrastructure is spread across:
- The capture side (e.g. Husky)
- The target board adapter (e.g. CW313)
- The target board itself (e.g. SAM4S)
Here’s a basic picture (from Colin’s crowbar glitching paper)
Note VCC is not necessarily 3.3V; it is one of the supplies generated by the CW313, and this supply gets chosen by the target board.
That is left up to the target side. On our target boards, the shunt resistor performs double-duty for this.
On Husky we use IRF7807ZTRPBF and DMN3200U-7. We don’t publish rise times because it will depend on the target board. We use two MOSFETs, a “high power” one and a “low power” one, and you can choose to enable either or both.
Depending on which capture device you select, yes; have a look at the comparison table. Note these specs are for the digital signal that controls the MOSFETs; the actual glitch times will depend on the target.
