Fault injection on Husky with CW308T-XMEGA

Embedded Security Glitching
1

I’m trying to execute the basic Fault 2_1 (glitching on loop) on CW308T-XMEGA with the Husky, but I’m not able to manage it.I already done the lab with the CW lite and everything was fine (not in this setup but similar).

The current UFO setup is thisone:

image
image998×664 107 KB

Also checking with the oscilloscope the glitch seems to be injected (pink is the clock)

image
image762×456 126 KB

I’ve also tried widening the ranges, but I’ve never been able to get a single glitch fixed.

num_tries = 3
gc.set_range("tries", 0, num_tries)

gc.set_range("width", 1850, 2100)
gc.set_range("offset", 2000, 2400)
gc.set_global_step([10]) # reduce to fine tune glitching

gc.set_step("ext_offset", 1)
gc.set_range("ext_offset", 10, 50)

Also using LP and HP.

scope.io.glitch_lp = True
scope.io.glitch_hp = True

When the width exceeds a certain limit they always reset.

image

Any guesses as to why it might not be working properly?

Thank you in advance

2

Hi,

Try increasing the offset range to its full extent. You should keep the width near where it starts to reset. You may also want to try clocking the XMEGA higher, like we do with the Lite.

Alex

3

Hello Alex,

thank for your reply, I took sometime to execute some tests on the hardware. Here the results.

First of all I check the CWLITEXMEGA setup (using the light and the xmega born with the lite).

First check gave me no appreciable results.

cw_lite_new_settings_results
cw_lite_new_settings_results800×600 16.3 KB

Then I noticed that change: update cwlitexmega vglitch ranges · newaetech/chipwhisperer-jupyter@1f9b6d5 · GitHub and tried the old settings.

cw_lite_old_settings_results
cw_lite_old_settings_results810×608 28.9 KB

Then I switched to CWLITE + cw308t-xmega replicating the same configuration, and the results are the same. With the data taken from the old CW the situation is quite the same, with the new data I was unable to get a single working fault.

At this point I switched back to the husky + cw308t-xmega. Using these settings I get it working. Switching to the 32Mhz was the key.

scope.clock.clkgen_freq = 32E6

if SS_VER=='SS_VER_2_1':
    target.baud = 230400*32/7.37
else:
    target.baud = 38400*32/7.37

scope.io.glitch_hp = True
scope.io.glitch_lp = True

gc.set_range("width", 2200, 4000)

gc.set_range("offset", 1000, 3500)
gc.set_global_step([50]) # reduce to fine tune glitching

gc.set_step("ext_offset", 1)
gc.set_range("ext_offset", 25, 31)
scope.glitch.repeat = 10

Here the results:

bokeh_plot (2)
bokeh_plot (2)800×600 23 KB

From what I could see limiting the ranges too much in the tutorials could create a lot of problems. I have no idea why with my hardware the data is so different from the new ones on github.

Thank you.

inode