SCA101 (HARDWARE) course captures don't make sense with CW1173

Embedded Security Example Traces
1

Hello,

I have a CWLITE with XMEGA target, I was able to complete all the setting up hardware tutorials and simple serial setup courses.

However, I have some questions regarding the first power analysis jupyter notebook course: SCA101.

TLDR: I run the captures, and graph the results, and I see this:

Doing 20 additions:

imagen
imagen1625×1003 128 KB

Doing a for loop with 20 iterations:

imagen
imagen1793×971 132 KB

I am new to Power Analysis, so I don’t know if these readings make sense. However, what I see is that they are very different, compared to the samples included in the no-hardware versions of the course, which look like this when I graph them:
imagen

I am using the code included in the notebooks.

My questions:

  • Are the two first traces looking normal? Am I capturing power signals correctly?

  • What should the “IDLE” time of the CPU that the notebook mention look like? (See figure one, where the notebook says: “You shouldn’t see much happening here before the target starts idling”)

  • Why are my traces not visibly similar to the example ones?

  • What is the unit of the Y axis? Current?

Thank you

2

No, I’d say your ChipWhisperer isn’t hooked up correctly. Are you using a CWLite + CW308? If so, did you connect the measure port to J17 on the CW308?

The Y axis is a value proportional to current.

Alex

1 Like
3

I am using a ChipWhisperer-Lite Classic 8-bit ATXMEGA128D4 target (which according to the box is the cw1173). This one is directly connected to the target board and can program it (i.e.: I don’t have any SMA, my target is NOT the CW308, it’s the board that is on the same board as the CW itself, separated by a section that can be broken up to separate the two boards).

I’ve tested with the multimeter and the measure / glitch lines from the target board to the main board seem to be connected correctly.

imagen

I don’t believe that it’s necessary to connect any additional hardware, connector or cable, to measure the power consumption of the target, is that right?

4

Now I’m getting traces that look like this:

image
image1528×784 125 KB

However, if I flash the simpleserial-base-lab2 firmware for the target again, and re-instantiate the scope, then I’m back at getting traces like the ones I show on the first post. What is going on? Could this be a hardware failure on my CW?

5

Yeah, your setup should be fine. Would you mind uploading a top-down picture of your Lite, so that I can do a visual inspection of the board? It could be that something got damaged during shipping.

Alex

6

Of course, here there are

photo_5960772531168327706_y
photo_5960772531168327706_y960×1280 202 KB

photo_5960772531168327705_y
photo_5960772531168327705_y1280×960 152 KB

photo_5960772531168327704_y
photo_5960772531168327704_y1280×960 132 KB

photo_5960772531168327703_y
photo_5960772531168327703_y960×1280 89.8 KB

photo_5960772531168327702_y
photo_5960772531168327702_y960×1280 229 KB

Thank you a lot.

7

Thanks for uploading the photos. I don’t see anything jumping out at me, but I could be missing something. Out of curiosity, can you run the following and report the output:

import chipwhisperer as cw
import time
scope = cw.scope()
scope.default_setup()
time.sleep(1)
print(scope)

I just want to make sure it’s not a simple fix. Otherwise, we’re happy to either swap with a new unit, or take it back and repair it.

Alex

8

Hi Alex,

Here’s the output of that code:

cwlite Device
sn         = 442031204c5032433330393134323031
fw_version = 
    major = 0
    minor = 64
    debug = 0
gain = 
    mode = high
    gain = 30
    db   = 24.8359375
adc = 
    state          = False
    basic_mode     = rising_edge
    timeout        = 2
    offset         = 0
    presamples     = 0
    samples        = 5000
    decimate       = 1
    trig_count     = 16023690
    fifo_fill_mode = normal
clock = 
    adc_src       = clkgen_x4
    adc_phase     = 0
    adc_freq      = 29538459
    adc_rate      = 29538459.0
    adc_locked    = True
    freq_ctr      = 0
    freq_ctr_src  = extclk
    clkgen_src    = system
    extclk_freq   = 10000000
    clkgen_mul    = 2
    clkgen_div    = 26
    clkgen_freq   = 7384615.384615385
    clkgen_locked = True
trigger = 
    triggers = tio4
    module   = basic
io = 
    tio1         = serial_rx
    tio2         = serial_tx
    tio3         = high_z
    tio4         = high_z
    pdid         = high_z
    pdic         = high_z
    nrst         = high_z
    glitch_hp    = False
    glitch_lp    = False
    extclk_src   = hs1
    hs2          = clkgen
    target_pwr   = True
    tio_states   = (1, 1, 0, 0)
    cdc_settings = bytearray(b'\x00\x00\x00\x00')
glitch = 
    clk_src     = target
    width       = 10.15625
    width_fine  = 0
    offset      = 10.15625
    offset_fine = 0
    trigger_src = manual
    arm_timing  = after_scope
    ext_offset  = 0
    repeat      = 1
    output      = clock_xor

Thank you

9

Yeah, everything looks fine there. Can you send an email to support@newae.com so that we can get a new device delivered?