2 ms·
When you look at a power trace of a whole AES operation, it's usually quite obvious when it starts and stops - you can see a pattern that repeats for each round
by Retr0id 3y ago
When you look at a power trace of a whole AES operation, it's usually quite obvious when it starts and stops - you can see a pattern that repeats for each round. If you acquire a slightly larger window, you can align your traces after you've captured them (by shifting them until the average difference is small). This is quite doable but it is a whole extra step, so a trigger pin is always preferable.
The ChipWhisperer Husky has an "analog pattern" trigger mode[1], which can help with this sort of thing.
[1] https://rtfm.newae.com/Capture/ChipWhisperer-Husky/ https://rtfm.newae.com/Capture/ChipWhisperer-Husky/
- jacquesm 3y agoDoes that still hold if you have no idea what's running on the device? Or does that just help to narrow down the blocks of samples to test to a small enough section that you can brute force the remainder?
- Retr0id 3y agoI'd say for it to be practical, you'd need to know the rough time window (within seconds) that the device is doing cryptography within. For example, if it's got an encrypted bootloader, you can reliably expect it to start decrypting stuff shortly after power on.
- jacquesm 3y agoI can see how auto correlation might work on the signal traces if you have enough of them.