Some questions about glitch pulse waveform for VCC-glitch

Embedded Security ChipWhisperer Hardware
1

Hi

I use SW-Lite

  1. Is it possible to turn on both channels with a glitch at the same time? Like this:

    def glitch_on(scope):
    scope.io.glitch_hp = True
    scope.io.glitch_lp = True
    def glitch_off(scope):
    scope.io.glitch_hp = False
    scope.io.glitch_lp = False

Is it safe for hardware?

  1. With some combinations width-offset SW stops working until reset. Is there a rule of param’s choice?

  2. How does the pulse width relate to the target’s clock period? At least approximately?
    I was able to succes at a target’s frequency of 8 MHz.
    clkgen_freq = 72000000.0
    glitch.width - 48.0 or 48.4
    repeat - 7
    offsets - brutforced

But with 24 MHz so far unsuccessfully. I can not select parameters yet.

Advise something on the selection of the pulse width please.

Thanks

2

Hi,

  1. Yup, it’s possible.
  2. You shouldn’t see the ChipWhisperer itself stop working by glitching. What you’re probably seeing is that either the target has crashed, or the glitch is continuously being asserted (a known issue, try turning the glitch io off and on again). There’s definitely some width and offset settings that cause it to happen more often, but we don’t really have a good map for that as of yet.
  3. Glitch width and offset are a percentage of the clock’s period. That being said, voltage glitching with repeat > 1 won’t behave the same at lower and higher frequency since the rate of new glitches being inserted is different (even at 24MHz, the voltage rail probably won’t recover fully before the next glitch is inserted).

Alex

3

Hi

  1. Mixing two channels was successful. But glitch_hp becomes invisible at high scope.clock.clkgen_freq (>30MHz). Are there slower transistors?

  2. I see that the CW does not respond to the script until I execute Setup_Generic.ipynb. Rarely I had to disconnect CW from USB to restore. The target may work at this time. I control it with logic analizer. If I can organize the data, I will definitely share it

4
  1. We haven’t done much testing on this particular situation, but in my experience the LP glitch tends to be a bit sharper and have less ringing, so it wouldn’t surprise me if the the high power glitch becomes less relevant at higher frequencies.
  2. Interesting. We’ve seen some USB oddities when glitching when inside the VM, so it might be related to this.

Alex