Key_error "flash"

Embedded Security Glitching
8

Basically, on the target side, you need to:

  1. Have a way for the Python to trigger the CW305 to do the operation you want (in this case the TRNG). For example, for AES running on a microcontroller, the sending of the plaintext triggers the microcontroller to do an AES encryption on that plaintext.
  2. As the operation you’re interested in is starting, the CW305 will need to set a trigger pin high to trigger the glitch module on the ChipWhisperer
  3. Have some sort of feedback to be able to determine glitch success

On the software side you need to do the following:

  1. Connect to the ChipWhisperer (scope = cw.scope()). For a default CW305 configuration, typically calling scope.default_setup() (see readthedocs for what this does) should be sufficient.
  2. Connect to the target. The CW305’s bitstream is stored in volatile memory, so you’ll probably have to program the CW305 on startup: target = cw.target(scope, cw.targets.CW305, bfile='/path/to/bitstream', force=True)
  3. Do some setup on the CW305. Typically the following is sufficient, assuming you only need one clock on FPGA pin N13:
target.vccint_set(1.0) #set target voltage to 1.0V
# Setup only PLL1 to output
target.pll.pll_enable_set(True)
target.pll.pll_outenable_set(False, 0)
target.pll.pll_outenable_set(True, 1)
target.pll.pll_outenable_set(False, 2)

# run PLL1 at 10 MHz:
target.pll.pll_outfreq_set(10E6, 1) 

# 1ms is plenty of idling time
target.clkusbautooff = True
target.clksleeptime = 1
  1. Setup the glitch module:
scope.glitch.clk_src = "target" # set glitch input clock
scope.glitch.output = "glitch_only" # glitch_out = glitch
scope.glitch.trigger_src = "ext_single" # glitch only after scope.arm() called
scope.io.glitch_lp = True

Once you’ve got all the setup done, you need to make a glitch loop. This will look something like:

import chipwhisperer.common.results.glitch as glitch
gc = glitch.GlitchController(groups=["success", "reset", "normal"], parameters=["width", "offset", "ext_offset"])
gc.display_stats()

gc.set_global_step(g_step)
gc.set_range("width", 5, 48)
gc.set_range("offset", -49.8, 49.8)
gc.set_range("ext_offset", 5, 20)

for glitch_setting in gc.glitch_values():
    scope.glitch.offset = glitch_setting[1]
    scope.glitch.width = glitch_setting[0]
    scope.glitch.ext_offset = glitch_setting[2]

    scope.arm() #arm the glitch module

    #---do whatever you need to to get the target to start the desired operation

    ret = scope.capture()
    
    # determine glitch success