I have been struggling the last weeks with attempts to perform an attack at a different kind of target then the usually provided UFO targets. I use a Chipwhisperer lite to perfrom the attack.
This is my target: Arrow/Everest/Polarfire devboard
The FPGA is configured as a RISC-V architecture and features some memories and JTAG + UART communications. The PMOD outputs has been configured to match IO1-4 for TX, RX and Trigger purposes. The clock is set as 25MHz at the Target and clock source is externalx4 to push the ADC to 1MS/s and manage the Nyquist x2 criteria.
I have been measuring across the 0 Ohm resistor right of the buttons. This is supposed to go directly from the voltage regulator to the core voltage.
The RISC-V is currently running a simple one-time pad operation between key and plaintext (using volatile to prevent optimizations) and right now I am trying to perform a CPA attack such as the course 4. The power hypothesis is then plain Hammingweight from the pt XOR k.
However, I only get around 50% of the bits correctly guessed and I think it could be from poor triggering and noise from the LTM4649EY#PBF. I take around 50 traces and filter the noise from the stepdown regulator by using correlation and a high pass filter, the traces have some huge disturbances from the regulator that after correlation and averaging looks better, but the rate of success is the same as guessing.
Previous I have tested to measure on a Pullup/Pulldown point close to the FPGA and there I had the same issue of noise from the regulators and it is further away from the computational voltage.
Would be happy with all hints and pointers, since this is my master thesis and I am horrible stuck and behind schedule wise.