I’m using the NAE-HPROBE-15 (came with the probe set) to run a CPA attack on the UFO Spartan 6 target board (with the pre-compiled AES algorithm). I collected 30,000 traces and successfully recovered 13/16 sub-keys. The placement of the probe was probably not ideal, I just placed it directly on top, and centered, on the Spartan 6 FPGA IC. I could try different positions and look at the difference in required collected traces for a given performance, but it takes a lot of time to crunch the data in Jupyter, so I just thought I’d cheat a little bit and ask if someone here knows about a “good” spot to place the H probe.
I don’t have a complete answer, just a few thought that may be helpful:
Yes the CW CPA attack code can be slow for large traces; however you can also use Lascar and it’s much faster; see this example notebook.
You could open the project in Xilinx ISE to look at the physical layout and find the physical location of the logic which is being targeted by the attack. I have no idea whether this would actually work well but in theory it could?
Having said that, here we have a probe that’s relatively quite large compared to the target, so I’m not sure to what degree you may be able to finely target a specific region of the FPGA. On the other hand, probe alignment will be less critical here on a target where the only active logic is what you’re attacking, versus a larger SoC where there would typically be many other subsystems doing other things at the same time as the AES encryption and possibly adding large amounts of “noise” to your measurements.