ChipWhisperer Documentation

The Level 2 Starter Kit (SCAPACK-L2) is an expansion of the Level 1 pack designed for working with external targets. It provides the necessary hardware to perform power analysis and fault injection attacks on devices outside of the included UFO targets.

Key capabilities include:

• External Target Support: Uses an advanced breakout board for level-shifting (when working with non-3.3V I/O) and additional breakout points.
• EM Measurement: Includes a probe kit for using an EM probe to measure power without the need to insert shunt resistors.
• Differential Probing: Includes a differential probe to simplify the use of off-board shunts.

The ChipWhisperer-Husky Starter Kit is the successor to the CW1173 ChipWhisperer-Lite. It is designed as a complete package for side-channel analysis and hardware security research, including the ChipWhisperer-Husky platform and multiple target microcontrollers.

Key Hardware Components included:

• ChipWhisperer-Husky: The main platform.
• Targets: Includes a CW312T-ICE40 and a CW312T-SAM4S.
• Cables & Connectivity: 20-pin breakout and IDC ribbon cables, SMA/BNC/MCX cables, USB-c cable, and a USBC-A adapter.
• Adapters: CW308 to CW312 adapter/breakout boards.

The CW313 is a 20-pin to Card Edge (CW312 style) breakout/adapter board designed as a cost-optimized alternative to the CW308 UFO board.

Supported Features

• Power supplies (1.2V, 1.8V, 3.3V).
• Pin headers for signal scoping.
• 20-pin JTAG header.
• Reset pushbutton.
• JTAG routing from ChipWhisperer to target (via JP3 and OpenOCD).
• ETM trace signal access (via HDR2).
• nRSTOUT to trigger input routing (via JP2).

Missing Features (compared to CW308)

• No XTAL socket & driver circuit.
• No clamping diodes on all I/O lines.
• No 2.5V regulator or adjustable regulator.
• No DC barrel jack input.

The ChipWhisperer-Nano is a low-cost platform designed for side-channel power analysis in training and educational environments. It uses synchronous sampling to enable real power analysis of algorithms and devices.

Key features include:

• Built-in Target: STM32F303F4P6 (16kB FLASH, 4kB SRAM).
• Built-in Bootloader: Allows for target board updates without external equipment.
• Use Case: Suitable for many ChipWhisperer tutorials and demos, though it contains a smaller subset of features compared to the ChipWhisperer-Lite or -Pro models.

The firmware/mcu/crypto/mbedtls/ directory contains a copy of the mbed TLS 2.5.1 library. This library is used for cryptographic operations within the ChipWhisperer firmware.

Key characteristics:

• It is a 'virgin' build, meaning the source files in the library and include folders have not been modified from the original mbed TLS distribution.
• Configuration is managed externally via the Makefile.mbedtls located in the parent directory rather than through local modifications to the mbed TLS source files.

micro-ecc is a small and fast implementation of ECDH (Elliptic Curve Diffie-Hellman) and ECDSA (Elliptic Curve Digital Signature Algorithm) designed for 8-bit, 32-bit, and 64-bit processors.

Key features include:

• Resistance to known side-channel attacks.
• Written in C with optional GCC inline assembly for AVR, ARM, and Thumb platforms.
• No dynamic memory allocation.
• Small code size.
• Support for 5 standard curves: secp160r1, secp192r1, secp224r1, secp256r1, and secp256k1.
• BSD 2-clause license.

The CW1200 (ChipWhisperer-Pro) is a high-end capture hardware device designed for laboratory use. It is an upgraded version of the ChipWhisperer Lite, featuring a larger FPGA which enables advanced capabilities such as:

• Larger sample buffers
• Streaming-mode captures
• Additional trigger methods
• A touchscreen interface

Note: The CW1200 is discontinued. Users looking for current hardware should consider the ChipWhisperer-Husky starter kit instead.

ChipWhisperer is an open-source toolchain designed for hardware security research. It is composed of three primary layers:

• Hardware: Consists of a capture board and a target board. Schematics and PCB layouts for the ChipWhisperer-Lite capture board and various target boards are available.
• Firmware: Includes a USB controller (C) and an FPGA for high-speed captures (Verilog) for the capture board, as well as firmware examples for various target devices.
• Software: Provides a Python API for interacting with ChipWhisperer hardware (ChipWhisperer Capture) and a Python API for processing power traces (ChipWhisperer Analyzer).

The SCAPACK-L1 is a starter pack designed for side-channel power analysis and fault injection attacks. It combines a capture board with a versatile target platform to facilitate security research.

Core Components:

• ChipWhisperer-Lite Capture board: The primary hardware used for capturing power traces and controlling the target.
• CW308-UFO Target board: A versatile platform that supports various microcontrollers and FPGAs.

Included Targets:

• 1x 8-bit XMEGA microcontroller
• 2x 32-bit STM32 Arm microcontrollers (STM32F3 and STM32F0)
• 1x Blank CW308 STM32F board
• 1x Blank CW308 prototyping board

The CW308 platform is open source and documented, allowing users to design and integrate their own custom PCB targets.

The ChipWhisperer CW310 'Bergen Board' is an advanced evaluation platform for FPGA-based security SoC, RoT, or HSM designs. It features a programmable microcontroller that manages FPGA configuration, thermal monitoring, fan control, core voltage adjustment, and clock frequency via an on-board PLL.

Key hardware features include:

• Memory: DDR3 and SRAM.
• Storage: 2x QSPI sockets (one 1.8V fixed, one adjustable).
• Connectivity: Standard JTAG headers, USB with PHY, PMOD headers, and spare I/O headers (0.05" IDC).
• Security Analysis: Multi-stage filtering for VCC-INT, inductive shunt for power measurements, on-board LNA, and SMA connectors for voltage fault injection.

The ChipWhisperer-Lite is an open-source hardware platform designed for side-channel power analysis and glitching attacks. It serves as a middle ground between the high-end ChipWhisperer-Pro and the entry-level ChipWhisperer-Nano.

There are four primary hardware configurations available depending on your target requirements:

• ChipWhisperer-Lite 1-Part: Includes a CW303 XMEGA target on a single board. Comes with a micro-USB cable.
• ChipWhisperer-Lite 32-bit 1-Part: Includes a CW303 Arm target on a single board. Comes with a micro-USB cable.
• ChipWhisperer-Lite 2-Part: Uses a separate target (CW303 XMEGA). Does not come as a single board. Includes a micro-USB cable, 20-pin cable, and SMA cables.
• ChipWhisperer-Lite Standalone: Capture hardware only (no target). Includes a micro-USB cable, 20-pin cable, and SMA cables.