Triggering ChipShouter With Husky Causes Clock Glitch

Embedded Security ChipWhisperer Hardware
1

Hello,

I am having an issue with the my trigger for the ChipShouter. I have included a diagram of the signals from my oscilloscope below. I want to glitch a microcontroller. I use an IO pin as a trigger (shown by the green signal D0) which I set high before executing a few instructions and then low again after. I also measure the internal clock from the MCU (shown in red, D1). Both of the signals were measured with digital channels on my oscilloscope. I am using a Husky as a trigger for my ChipShouter; the “Trigger/Glitch Out (3.3V)” output connected to the ChipShouter’s trigger input. I have the parameters for the Husky and the ChipShouter in images below. When the measurement in the diagram was taken, the ChipShouter was placed far away from the chip, so that the EM field would not affect it. I did this to test my setup to see if everything was working as expected without faults in the MCU. Unfortunately, sometimes my trigger and clock signals become zero for short periods of time (as shown in the diagram). I have taken lots of measurements with different voltages and trigger lengths. This does not happen on all measurements but it does sometimes. This is a problem because the effect it has on the clock is essentially a clock glitch. However, I want to test only the effect of EMFI on the MCU and not a clock glitch that is coming from some other place within the setup. I have tried out many different parameters and have not been able to get rid of this effect. Have you noticed this issue? Do you have any suggestions on how to fix it?

I hope I have provided all necessary information. Please let me know if anything is unclear. Thanks in advance for any help.

Here is a diagram of the signals measured with the scope. I C1 is HS2 signal from the Husky measured from the “Aux In/Out (3.3V)” output and the oscilloscope is set to 50 Ohms when I measured it. C2 is the signal from the ChipShouter (the channel was set to 1 megaohm).

image
image1920×672 56.5 KB

These are the parameters on the Husky:

image
image1328×1139 174 KB

These are the parameters for the ChipShouter:

image
image738×439 43.5 KB

2

So the D1 clock is generated by the target, not by Husky, correct? And somehow CS is inducing a glitch on that target clock even though it’s far away? (how far?)
You say this happens “sometimes” - how often?

3

Correct, the clock in the diagram is coming from the MCU. The MCU clock is currently not attached to the Husky at all.

The ChipShouter is about half a meter away from the MCU. It is next to the MCU not above it. The tip is pointing away from the MCU. I have also tried covering the ChipShouter with some aluminum foil to completely rule out that the issue is caused by electromagnetic pulses.

I take measurements with the following parameters:
Trigger lengths: 5,10,15,20,25
Voltages: 150,200,250,300,350,400,450,500
This results in 40 measurements. Out of the 40 measurements this issue comes up on average on about 12 of the measurements. I am happy to send you the full set of the plots if this helps.

4

Hello,

The most likely situation here sounds like it could be actually something being transferred in a ground bounce. The enclosure of the ChipSHOUTER is connected to negative, which also connects to the MCX negative. The ChipSHOUTER has rather larger internal fields that can couple to the case and ground signals (or even can couple to signals within the ChipSHOUTER circuitry, sometimes resulting in double-triggers).

It’s very possible you’re seeing some energy transferred in that. If possible to insert a smallish resistor (100 ohm?) in series or capacitor (100pf?) in parallel you could see if it will snub that out. If in series it might need to be in both positive & negative, but just one might be enough.

Hopefully this gives you somewhere to investigate!