VCC glitch attack on STM32F0 target board

Embedded Security ChipWhisperer Hardware
1

Hello,

I tried the tutorial : https://github.com/newaetech/chipwhisperer-jupyter/blob/dd4b42baa33f901052b96a626525c64f4e88b66c/Fault_2-Introduction_to_Vcc_Glitch_Attacks.ipynb

with the STM32F0 board.

I spent 4 days playing with the parameters :

width_range = Range(28, 30, 0.4)
offset_range = Range(-25, -18, 0.4)
ext_range = range(1000, 1005)
repeat = 1 # tried with 5 - 10

I am not able to have any good glitch. Only the glitch pin of my chipwhisperer is connected on the target board. I was wondering if someone was successful with this board ? Do you have any strategy to figure out the width / offset / ext_range ?

Sometimes the jupyter script stops without any feedback, the progress bar is red and I can’t figure out what is the problem.

Also when I am trying to brute-force large range of Width / offset/ ext_range , I am not able to retrieve the complete “glitches” arrays. The data seems partial… ( only the last ext_range - 1004 - is included in the array ).

Thank you for your help.

2

Hello,

After brute forcing a lot of ranges and trying different parameters. I finally found out that the best thing to do was to use the scope.io.glitch_lp instead of the scope.io.glitch_hp.

There are the good glitches:
// width, offset, successes/samples, crashes/samples, line
[19.53125, -18.75, 1.0, 0.0, 400, [‘1285184 200 200 2\n’, ‘1285184 200 200 4\n’, ‘1285184 200 200 6\n’, ‘1285184 200 200 8\n’, ‘1285184 200 200 10\n’]]
[19.53125, -18.75, 1.0, 0.0, 440, [‘1416256 200 200 401\n’, ‘1154112 200 200 403\n’, ‘1416256 200 200 405\n’, ‘1416256 200 200 407\n’, ‘1416256 200 200 409\n’]]
[19.53125, -18.75, 1.0, 0.0, 445, [‘40001 200 200 451\n’, ‘40001 200 200 453\n’, ‘40001 200 200 455\n’, ‘40001 200 200 457\n’, ‘40017 200 200 459\n’]]
[19.53125, -18.75, 1.0, 0.0, 480, [‘1547328 200 200 807\n’, ‘1547328 200 200 809\n’, ‘1547328 200 200 811\n’, ‘1547328 200 200 813\n’, ‘1547328 200 200 815\n’]]

Do you know why the scope.io.glitch_lp has better results on the STM32F0 compare to scope.io.glitch_hp ?

Thank you.

1 Like
3

Hi ksz!

The VCC glitch is very hard and understanding what have exactly works is complicated. It depends from much parameters and S-parameters of MOSFET transistor is important too.

Best regards,
Nik.