I’ve a Arty S7 board, which has the core power available across a shunt resistor. We’ve custom crypto cores we’ve designed and what to monitor the current to investigate security. They work at 100 to 150 MHz (clock). My question, is which, if any, chipwhisper can handle such a high sample rate and the required bandwidth?
It isn’t clear, as the specs differ based on the sampling method circuitry, streaming and sample buffering.
The ChipWhisperer Husky should be most suitable for you. It has sampling rate (adc_rate) up to 200 Msamples/s.
It is very desirable to use the same clock for the target board and for the ChipWhisperer to have perfect power trace syncronization.
If Arty S7 cannot use external clock, you have to provide the CW by the Arty S7 clock.
To get a more reliable attack you have also multiply by 2 incoming (to CW) clock.
The ChipWhisperer Husky is definitely much better than the standard CW Lite. I guess the CW Lite will not fit to your task.
Thank you for replying. This would give only 2 samples per clock though at 100MHz. Surely, one needs a higher resolution to observe individual clock cycles. Or, am I missing something…
I tried to sample with double sample rate related to the system clock and it worked for me to recover the HW AES key. But 1:1 misses some important information on ADC of the power traces.
1 Like
Our AES FPGA demos use 4 samples per clock, but they work at 1 sample per clock as well.
Our ECC FPGA attacks all use 1 sample per clock.
Synchronous sampling is the key! This paper explores it in detail: https://eprint.iacr.org/2013/294.pdf
2 Likes
BTW, do you have plans to add attack/s against HW RSA on an FPGA?
No plans at the moment. We would need a good/interesting RSA implementation, and ideally an attack that teaches something beyond what our current ECC attacks teach. Contributions are always welcome 
1 Like
Should be some RSA IP cores on OpenCores, if the target is FPGAs.