I’m trying to collect 10000 decrypting traces with my own keys and ciphertexts. Here are my settings:
SCOPETYPE = 'OPENADC'
PLATFORM = 'CW308_STM32F3'
CRYPTO_TARGET='NONE'
SS_VER = 'SS_VER_1_1'
and
import chipwhisperer as cw
scope.clock.adc_src="clkgen_x1"
scope.adc.basic_mode="rising_edge"
scope.adc.samples=65
Here are my capturing codes:
from tqdm.notebook import tnrange
import numpy as np
traces = []
for i in tnrange(10000, desc='Capturing traces'):
ks = np.random.randint(0, 65536, dtype = np.uint16)
ks = ints_to_bytearray(ks, 1) # uint16 to bytearray
ciphertext = bytearray(c[i]) # c[i] is a list
trace = cw.capture_trace(scope, target, ciphertext, ks)
if trace is None:
continue
traces.append(trace.wave)
traces = np.array(traces)
While capturing, I found that once it came to the 580th trace, “Target did not ack” would occur, capturing stopped, and the capturing codes couldn’t work unless I reconnected scope. Just like following pictures:
At beginning, I thought that maybe the 580th ciphertext has some wrong. So I tried capturing from the 100th ciphertext and key, and the problem still existed:
So the problem is: after capturing 580 traces, error
Warning: Device failed to ack will occur. What would be the reason of this problem? Thanks!
`
If it always stalls on the 580th trace, then the obvious question is: what is c[580]? Does it have a different size than c[0] to c[579]?
After checking, I’m sure that the shapes are same:
And, it doesn’t mean this problem only occurs at
c[580]. For example, if I start capturing from
c[100], then the problem will occur at
c[680]. The problem always occured when 580 traces have been captured.
Instead of re-connecting the scope when the error occurs, what happens if you reset only the target? Are you then able to capture another set of 580 traces until the error occurs again?
If so, that suggests an issue with your target firmware.
I routinely use ChipWhisperer to capture >> 580 traces with no issues.
Thanks! reset_target() solved this question successfully!
I found reset_target() in Lab 2_1A as following:
def reset_target(scope):
if PLATFORM == "CW303" or PLATFORM == "CWLITEXMEGA":
scope.io.pdic = 'low'
time.sleep(0.1)
scope.io.pdic = 'high_z' #XMEGA doesn't like pdic driven high
time.sleep(0.1) #xmega needs more startup time
elif "neorv32" in PLATFORM.lower():
raise IOError("Default iCE40 neorv32 build does not have external reset - reprogram device to reset")
elif PLATFORM == "CW308_SAM4S":
scope.io.nrst = 'low'
time.sleep(0.25)
scope.io.nrst = 'high_z'
time.sleep(0.25)
else:
scope.io.nrst = 'low'
time.sleep(0.05)
scope.io.nrst = 'high_z'
time.sleep(0.05)
After checking the scope.io in document Scope API, I thought that the reset_target() function acted like a “switch”, it just “turn off capturing function”, then “turn on capturing function”. Is it right?
I also care about the capturing speed. I found that the capturing speed is 500 items per 35 seconds, about 14.29it/s. Is it a normal capturing speed? Are there any ways to speed up capturing? Thanks.
No, reset_target() does what it says: it resets the target; it turns it off and back on again. As I said it looks like there is an issue with your firmware that causes it to stop responding properly after 580 captures. Resetting the target is a band-aid solution. Now that you know that this is happening, the proper solution would be to debug your firmware to figure out the root cause and fix it.
Capture speed depends on lots of factors: the duration of the target operation, the length of the commands and responses that get sent/received for each capture, and the number of power samples that get collected. 14 iterations/s is not an unexpected number.
I’ve already explained how to speed up captures on your other thread.
