FI, glitch_only, width specifier

Embedded Security Glitching
1

hi frens,

by choosing “glitch_only” it is possible to inject voltage faults with sub-target-frequency precision.
the behavior is further specified by setting the width range:
gc.set_range(“width”, 5, 48).

can you elaborate, how this affects the width of the injected faults when searching for fault’s parameters?
As an example, lets assume the target clock is specified with 16MHz, i.e. a period of 6.25e-08s.
as approximately ~50 seems to be the ranges maximum, would a width of 1 refer to a 1/50 * 6.25e-08s and a width of 50 to 1*6.25e-08s?

thanks in advance,
comrade

2

Hi Comrade,

50 here is a percentage of the target’s clock, so 50 is 0.5 * 6.25e-8s. If I remember correctly, the minimum step is 100/256 (roughly 0.4%). Keep in mind that this is just how long you’re turning on a mosfet for, not the glitch itself, so small glitches usually won’t be large enough to drop the voltage at the target’s Vcc pin.

Alex