Traces not complete

Sousou · July 19, 2020, 7:10pm

Hello all,
I want to trace a code that uses uint64_t variables and is a little bit complex (it is about integer sampling).
I was able to have traces but they are very long more than 24000 samples and still the trace is not complete. I mean here by complete, that I did not trace the whole execution of the code.
Anyone has an idea how to fix this. I tried to optimize my code in a way to use smaller variables when possible.
But this did not solve the issue.
I want the complete traces …
Please, help!
Best

Alex_Dewar · July 20, 2020, 3:19pm

Hi,

Some ideas for how to capture longer traces:

If you haven’t already, make sure that you’re using “clkgen_x1” for your ADC clock instead of “clkgen_x4”
If you’re able to control the input data, you can try capturing multiple traces with different ADC offsets and the same input, then combining the traces
You can increase scope.adc.decimate, which will only record one sample in every scope.adc.decimate. If you set this to 10, you’ll only record one in every 10 samples. I’d recommend trying this step last.

Alex

Sousou · July 24, 2020, 6:13pm

Hi Alex,
Thank you for your answer.
I added these two code lines:

self._scope.clock.adc_src = ‘clkgen_x1’
self._scope.adc.decimate = 40

By varying the adc.decimate to 20 the first dense spikes get longer, which totally makes sense.
I assumed now that the trace is a complete one. Should I ignore the other spikes?
Is it normal to have these spikes , why they appear in my trace?
Best,
Sou

Alex_Dewar · July 27, 2020, 10:54am

Hi Sou,

If I had to guess, I’d say those spikes are noise of some sort. That being said, your trace looks very weak. What’s your gain set at? If it’s currently low, I’d recommend increasing it a bit. Also, what value of shunt resistor are you using? Increasing that should also give you some better measurements.

Alex

Sousou · July 27, 2020, 1:29pm

Hi Alex,
Thank you for the reply.
I am currently using 34 for gain(no purpose for that), is it enough? How the gain affect the quality of the traces?
I am using the shunt resistors in the CWLITE. I did not add any. pin2&3 indicate SHUNTL and SHUNTH.

See below how my cw looks like.

Best,
Sou

Alex_Dewar · July 27, 2020, 3:07pm

Hi Sou,

I’d recommend increasing your gain (preferably via scope.adc.db, since that’s independent of the high/low gain setting). The Lite has a 10-bit ADC, meaning the minimum step on that graph is ~0.001, so you’re probably only getting ~10 different values for your measurement.

The noise you’re seeing in your trace is probably from the internal regulator in the F4. The ChipWhisperer attempts to overpower it, but the voltage might not be high enough. You can improve your measurement by feeding a slightly higher voltage in with the adjustable regulator, which is on the other side of the filt pin. Be a bit careful here, as you can damage the target if the voltage you feed in is too high.

See https://wiki.newae.com/Targets_with_Internal_Regulators for more information.

Alex

31415 · August 3, 2020, 3:05pm

Did you short J16 on purpose? I never tried such setting.

Does you STM32 work? Because all LEDs are off, normally two are on.

Sousou · August 3, 2020, 3:22pm

No I did not that on purpose.
I had traces, but Not all LED are off? led 11,10 and 8, 5 are on

Am I missing something?!

31415 · August 3, 2020, 3:53pm

Could you test without jumper on J16? Does it change anything?

STM32F3 target uses LED1,2,3 as simple status LEDs.
From my experience if all are off, something is wrong with power for CPU.

Sousou · August 3, 2020, 4:15pm

The traces without the jumper look like this:

However, after changing the value of he gain and by having the jumper on j16 I had the following traces:

The LEDs 1,2 and 3 are off for both cases.

Alex_Dewar · August 4, 2020, 10:54am

Good catch, 3,

Yeah, having J16 shorted there would definitely ruin your measurements. We’re measuring current into the microcontroller via the voltage drop across a shunt resistor (across SHUNTH and SHUNTL), so shorting those two mostly removes your ability to calculate current.

As for why the LEDs are off, the STM32F4 HAL doesn’t actually configure the LED pins, so they’re still the default high impedance. If you want to use the LEDs, you should be able to include stm32f4xx_hal_gpio.h and use similar code to the trigger setup:

void trigger_setup(void)
{
	GPIO_InitTypeDef GpioInit;
	GpioInit.Pin       = GPIO_PIN_12;
	GpioInit.Mode      = GPIO_MODE_OUTPUT_PP;
	GpioInit.Pull      = GPIO_NOPULL;
	GpioInit.Speed     = GPIO_SPEED_FREQ_HIGH;
	HAL_GPIO_Init(GPIOA, &GpioInit);
}

void trigger_high(void)
{
	HAL_GPIO_WritePin(GPIOA, GPIO_PIN_12, SET);
}

void trigger_low(void)
{
	HAL_GPIO_WritePin(GPIOA, GPIO_PIN_12, RESET);
}

(LEDs are active low here though)

Alex

Sousou · August 5, 2020, 2:36pm

Hi Alex,
Thank you for your reply.
I do not need LEDs in my code.
After removing the jumper, I had these dense traces. Do they look correct?

Alex_Dewar · August 5, 2020, 2:38pm

Hi Sou,

Those definitely look a lot better. You’ll want to turn the gain down a bit, since you’re clipping on the top now.

Alex

luffy · July 13, 2021, 9:21am

Hi Alex,

I have several questions about the problem–get longer trace.

Is it correct that using “clkgen_x1” or setting a higher “scope.adc.decimate” will reduce accuracy and increase the difficulty to recover secret keys?
Can Chipwhisperer Pro help us to get more samples in high frequency?
If I get the power information by a advanced oscilloscope, then would I solve this problem without any other new problem?
Best,
luffy

Alex_Dewar · July 13, 2021, 3:28pm

Reducing sampling does make key recovery more difficult, but it affects it much less than you would think: https://eprint.iacr.org/2013/294.pdf

As you can see from figure 1 in that paper, it’s much more important to have a low noise measurement setup and to use an ADC clock that is synchronized with the target. An advanced oscilloscope will typically perform much worse than something like a ChipWhisperer, even though it is sampling at a much higher frequency.

Regarding the Pro, it does have a streaming mode, but that is limited to 10MS/s.

Alex

luffy · July 14, 2021, 9:04am

Hi Alex,

Thanks a lot for your reply.
As you said before, when I collect power traces by an oscilloscope, I get a result that looks worse.

Now my scenario is :
By ChipWhisperer Lite with parameter setting is “clkgen_x1”， I get the trace like this

but this is only a small part of the POI, a complete trace need more than 25000 samples .Because of the randomness, I can’t do that by combining several traces which have same input and different trigger.

Then what is the best way to accomplish the goal in your opinion?

Best,
luffy

Alex_Dewar · July 14, 2021, 4:58pm

Hi Luffy,

If you do require the full trace, then you’ll need to decimate the signal.

Alex

luffy · July 16, 2021, 2:34am

I’ll try it, Thanks!