High_z TIO4 drops voltage on the trigger line

Embedded Security Side Channel Power Analysis
1

Hi.
I faced with the problem…
The TIO4 set to ‘high_z’ (on CW Husky) and connected to the target’s trigger line drops voltage from 3.3V to 0.5V (on the trigger line). This makes impossible to run the SCA attack as both 0.5V as well as 0V are interpreted as ‘low’ logic level on the trigger line.
I use a custom board and I am not sure whether it is normal behavior. At least, I didn’t notice this on the standard target boards.
Are there any ideas to fix it?

3

More details. Connected TIO4 to the trigger line just drops voltage to 0V and trigger never happens.
It resembles behavior of the pulled down TIO4. But I double checked, the TIO4 has ‘high_z’ state.

4

No it’s not normal - with any NewAE target you would see TIO4 at 3.3V. It sounds like your target isn’t driving TIO4.

CW-Husky (and Lite, Pro) has an internal pull down on TIO4. So if your target isn’t driving TIO4, Husky will read it low.

I would disconnect the TIO4 line between Husky and your target, so that you can verify what your target is driving TIO4 to when Husky’s pull-down is taken out of the picture.

5

Yes, I verified this already. It works fine when TIO4 is disconnected from the target board.
Below is the picture. I added noticable delay 10 ms when AES is performed so that to see clean trigger. When I connect TIO4 to the trigger line, the trigger immediately goes to 0V and never appears.

trigger_without_tio4
trigger_without_tio41300×950 7.13 KB

6

The script I use to collect the traces:

import chipwhisperer as cw                                                                                                                                                                                  
import time
from tqdm import tqdm
 
scope = cw.scope()
target = cw.target(scope, cw.targets.SimpleSerial2)
target.baud = 115200
 
time.sleep(0.05)
scope.default_setup()
 
scope.gain.db = 38
 
scope.adc.samples = 2000
scope.adc.offset = 0
scope.adc.basic_mode = "rising_edge"
 
scope.clock.clkgen_freq = 24000000
scope.clock.adc_mul = 7

project = cw.create_project("traces/HW_AES.cwp", overwrite=True)
 
ktp = cw.ktp.Basic()
N = 20000
 
for i in tqdm(range(N)):
    key, text = ktp.next()
    trace = cw.capture_trace(scope, target, text, key)
    if trace is None:
        continue
    project.traces.append(trace)

print(scope.adc.trig_count)
project.save()

scope.dis()
target.dis()
7

You could try using TIO3 instead – Husky doesn’t pull it down (or, any of the USERIO pins, if that’s more convenient).

1 Like
8

Thanks a lot!
I added the string scope.trigger.triggers=‘tio3’.
And it works now.
BTW, what is the reason of this behavior with default TIO4? I understood that it is because it is internally pulled down. As we saw the trigger line should drive the TIO4 line.
Also I checked the target board on the CW Lite. It works there. But when I attach oscilloscope probe x1, it stops working. Switching probe to x10, drives the TIO4 line again.

9

Glad to hear it.
We have the pull down on TIO4 on all our scopes to avoid inadvertent triggering.
If the presence of a probe on the TIO4 line (i.e. extra load) affects whether the target is able to overcome the pull down, that’s a sign that TIO4 isn’t being driven very strongly.
CW-Lite and Husky may have somewhat different pull-down strengths because they’re different FPGAs.