Hi there,
I’ve been trying to find the time to do some finishing touches on this work, but have failed to do so. It’s pretty interesting so far, so I’ve decided to just post what I have for others to enjoy.
In particular, I think some will find the rigol-fastrec tooling I’ve put together to be quite useful for this sort of work. (without spending big bucks on higher end capture devices.)
From the blog post:
We used a near-field EM probe to recover an AES-128 key while the Silicon Labs EFR32MG12’s
CRYPTO0hardware accelerator performed decryption. The setup uses a Rigol MHO98 oscilloscope, a NewAE probe and amplifier, and a hobby CNC for positioning. Surprisingly, we couldn’t find any existing published work on this specific CPU! The MG12 is a Series 1 EFR32 SoC and explicitly does not implement DPA countermeasures. As such, this vulnerability is more-or-less “by design”.We couldn’t quite get all 16 bytes reliably from correlation power analysis (CPA) alone. Even after tuning the capture and analysis, there was always one byte left to brute-force. In the run below, CPA recovered 15 bytes of the round-10 key. Searching the remaining byte and checking against a captured plaintext/ciphertext pair finished the job.
Most of the work went into getting usable traces. We started with software AES, spent about a month trying deep-learning approaches, then came back to CPA with better probe positioning and much more averaging. Raelize’s Breaking HW-AES with Electromagnetic Analysis was the main reference. Their ESP32 work provided a useful starting point for both the position scan and the averaging strategy.
For these tests, we used a development board and firmware that lets us choose inputs, repeat operations, and trigger the scope with a GPIO. The package is intact. We used a known key to find a probe position and useful sample points, then tested recovery on a separate capture with a randomly selected key. That’s a convenient setup to work with, and those conditions matter when considering whether the result applies to a real device.
In the process of this research, I’ve created a package to enhance the remote&bulk capture rate on my Rigol scope. (this is the aforementioned rigol-fastrec package)
It likely works for other MHO900 series scopes, but I don’t have any to test with, so ymmv. I’d love to hear from you if you try. (or feel free to submit a PR or issue on the GH repo.)
Use a Rigol MHO900-series oscilloscope as a fast streaming ADC. It drives the scope’s WaveRecord (“fast record”, segmented 1M-wfm/s) memory and pulls frames back through a Frida-injected agent, with averaging, channel deinterleave, and sample cropping all done on the scope.
Using this package was how I achieved 1.35B raw waveform captures in a little over 28 hours. I see there are a couple other options (e.g., after poking around the eevblog forum) for speed improvements on this scope. I haven’t tried any others, so don’t know how they compare. I’ve done extensive testing with this, and have a fairly well fleshed out test suite that uses the AWG to confirm fidelity of the captured data. (Including automated comparison of data extracted via the scope’s proper WaveRecord CSV export.)
It’s mostly been in bulk capture campaigns, but I did add streaming support as well. With the on-scope averaging, I didn’t bother using a usb ethernet adapter, but it is a pretty good option if you need to increase raw capture rates.
I took the approach of mostly bypassing SCPI, rather than improving the efficiency of SCPI readback.
Enjoy! PRs and feedback welcome! (both for rigol-fastrec and for the EFR32MG12 SCA research)