Measuring a custom target with CWNano

Embedded Security ChipWhisperer Hardware
1

Hello,

I have a CW Nano, and after playing around with the embedded target it has I wanted to try to perform the same attacks on a custom target. To do so, I have de-soldered both SJ5 and SJ6 jumpers as I learned from the datasheet:
image

And now I wish to measure the power consumption on my target dummy Arduino board.

This is how I thought I want to put everything together:

image
image734×513 20.6 KB

I was trying to make it as similar as it can be to the configuration I saw on the datasheet on the embedded target where T_MEAS is placed between the resistor and the target’s VDD.

From what I learned on the theory of doing CPA/DPA/ Any simple power analysis, I thought you’re suppose to measure to power consumption across the resistor. But in this configuration, and also the one in the ChipWhisperer’s target - the measurement is performed across the target itself (between T_MEAS and GND) from what I was able to understand

Is this the right way to do it? Wouldn’t that make my measurement more noisy? Especially when talking about a custom target (now that’s an Arduino, but I will probably test it on other targets)

Thanks in advance

2

Hi,

I wouldn’t recommend just putting a shunt between a battery and the Arduino. You want a setup closer to what you see on that target board, where the shunt resistor is inserted between an onboard voltage regulator and the device’s Vcc pin. Additionally, you’ll need to remove the decoupling capacitors on the Arduino, as these attenuate the info that we’re trying to get. Ideally, you’ll want to run the ChipWhisperer off the target clock, as this will greatly reduce jitter in measurement, but it’s not 100% necessary.

Regarding measuring across the device and measuring across the shunt, they’re effectively the same thing with the ChipWhisperer. This is because the ChipWhisperer is AC-Coupled (a high pass filter), which filters out the unchanging part of the power supply voltage, leaving you with nearly 0V. You can use a differential probe for an actual measurement across the shunt resistor, but, in my opinion, this adds additional complexity to the setup and probably won’t improve your measurements very much, especially with a fairly stable power supply.

Alex