Glitching on ESP32 and shunt resistor

Embedded Security Glitching
1

Hi,

I’m working on a research project about fault injection on the ESP32, but I’m getting some unexpected results that I’d like to discuss with you.

The board I’m using is the following: GitHub - raelize/TAoFI-Target, essentially an ESP32 with some additional conveniences. I don’t think there’s any significant difference compared to the standard CW target.

Here are the main setups I’m working with:

  • In all the scenarios I’ve tested, I provide 3.3V from a stable source for all VDDs, except for the ones where I perform the glitching.
  • For glitching, I use an RK6006 with different voltages (2.12V/1.8V/2.52V) depending on the tests.
  • All capacitors on both VDD_CPU and VDD_RTC have been removed.

The test cases are as follows:

  • TEST 1 - Glitching on VDD_CPU without shunt resistor

test2_cpu
test2_cpu666×642 20.7 KB

  • TEST 2 - Glitching on VDD_CPU with a 10-ohm shunt resistor

test2_cpu_res
test2_cpu_res666×642 21.4 KB

  • TEST 3 - Glitching on both VDD_RTC + VDD_CPU without shunt resistor

test1_rtc_cpu
test1_rtc_cpu666×642 20.5 KB

  • TEST 4 - Glitching on both VDD_RTC + VDD_CPU with a 10-ohm shunt resistor

test1_rtc_cpu_res
test1_rtc_cpu_res666×642 21.3 KB

In Test 1, I barely get any faults, faults are very rare. However, in Test 2, I’m able to generate faults relatively easily.

In Test 3, I can induce faults without much trouble, and in Test 4, I’m able to glitch without issues, but with much more fine-tuned results. For example, I can flip a single bit of an instruction, something I can’t achieve in Test 3.

Can anyone explain why I’m getting such different results between the situations with or without the resistor? Is it generally better to always use a resistor in general?

What is the logic behind why it’s better to use the resistor? I was expecting better results without the resistor.

Thank you in advance

inode

2

I’ll add some information gathered during additional tests. Yellow is the glitch output, while cyan is the measurement on the power line.

Glitch withtout SHUNT resistor starting from 2.52v

SDS00001
SDS00001800×480 9.86 KB

Glitch WITH SHUNT resistor starting from 2.52v

SDS00002
SDS00002800×480 9.58 KB

Glitch withtout SHUNT resistor starting from 3.3v

SDS00004
SDS00004800×480 10.2 KB

Glitch WITH SHUNT resistor starting from 3.3v

SDS00003
SDS00003800×480 9.72 KB

From the graphs, it seems that without the shunt resistor, the voltage can’t drop to 0.0v, but I don’t understand the ‘theoretical’ reason behind this behavior.

3

You’re trying to short out a power supply, so things like the resistance of the path to the transistor, the Rds on of the transistor, etc. have a big effect here. By adding a resistor in series with the power supply, you’re making it a lot easier for the glitch transistor to drop the voltage. It’s important to note that you’re getting a lot more ringing when you release the glitch without the resistor as well.