CW340/CW341 daughtercard — cannot recover key, possibly a "Normal" (non-SCA) board?

1

Hi,

We purchased a CW340 board with the CW341 (Kintex UltraScale) target daughtercard, and are trying to capture AES power traces using a ChipWhisperer-Husky Plus, following the official CW340_AES_test.ipynb notebook.

We are running into the same symptom described in this thread: CW340 AES test - cannot recover key. Some details from our own testing:

  • Physical setup: Husky Plus (+) SMA → CW341 J7 “amplified” port, Husky Plus (-) SMA → shorting cap, 20-pin SCA cable connected, JP9 in the 3.3V (top) position, JP5 in the 1-3 (bottom) position.
  • clkgen_src = 'extclk', adc_mul = 4, adc_phase = 15, adc.samples = 300, matching the CLOCKS_FIXED = True branch of the notebook.
  • HW/SW AES output comparison passes every time (the encryption core itself works correctly).
  • With 10,000 traces, avg_pge stays around 120-130 (essentially random-guess level for a 256-value key byte).
  • We had to raise scope.gain.db from 32 dB up past 44-54 dB during capture just to avoid “gain too low” ADC errors, suggesting the actual signal amplitude reaching the ADC is very small.
  • A per-sample standard deviation check across 10,000 traces shows an almost perfectly uniform std (~0.025) across all 300 samples, with no visible round-structure spikes — it looks like clock feedthrough rather than a data-dependent power signal.

After reading this thread about the CW310/Bergen board, it looks like the CW341 daughtercard schematic also distinguishes a “Normal” version (decoupling caps mounted) from a “DPA/SCA” version (caps DNM), specifically caps C36, C40, C35, C44, C39, C29, C42, C26, C21, C20 on the +1V0_VCCINT net, with the schematic note “Caps will be DNM on DPA versions.”

We checked the back side of our CW341 daughtercard and those capacitors (including the large C20/C21 1210-package parts, silkscreened as “VCC-INT Caps”) are populated. There was no “Normal vs SCA” option presented when we purchased the board.

Could you confirm:

  1. Is our board indeed a “Normal” (non-SCA) version, and is that the root cause of our inability to recover the key?
  2. If so, is a decap/rework service available for the CW341 daughtercard (similar to what’s mentioned for CW310), and what would that involve/cost?
  3. Alternatively, is there anything else in our capture configuration that could explain this before we conclude it’s a hardware limitation?

Thanks in advance!

2

Yes, if those capacitors are mounted then you have the non-SCA version.

Contact sales@newae.com for pricing on converting the board to the SCA version.