0

I am trying to reproduce the side-channel power analysis attack described in this paper: https://pdfs.semanticscholar.org/7946/a8ee82658e2ffb017270331f220a55f5ace6.pdf for educational purposes.

The attack (on the HCS3xx family of chips) requires measuring the power consumption (i.e. current) that the chip is using in order to reveal its cryptographic key.

In the paper, they describe their setup as attaching a shunt resistor in the ground path and using a digital oscilloscope (with a sampling rate greater than 1MHz) to measure the voltage drop across this resistor.

I have reproduced this setup to the best of my abilities (pictured in the schematic below), but the problem is I don't have an oscilloscope.

schematic

simulate this circuit – Schematic created using CircuitLab

Therefore, I've decided to use an Arduino Uno I have lying around as a poor man's oscilloscope.

Besides the fact that the Arduino ADC has a much lower sampling rate (~77KHz vs. the ideal 20MHz described in the paper), I have been having an issue getting a reliable voltage reading across the shunt.

While trying to use the full 10-bit ADC, and producing samples as (ADCH << 8) | ADCL in my ADC ISR, I do not get any samples that are greater than 0.

However, when I left-align the ADC to only use 8-bit precision (with ADMUX |= 1 << ADLAR and read with just ADCH, I get non-zero values but none with a value greater than one.

Could it be that the amount of power that the chip consumes is so small that the Arduino does not have enough precision to read it? Or could it be that my shunt has too large of a resistance and is causing a reduced current throughout the circuit?

1

In the graphs they've got 2.5mA tops, so you've got about 2mV on that 1.2R shunt resistor.

And Uno's default ADC reference is 5V divided into 1024 steps each of them roughly 5mV. That's more than peak value of measured voltage.

And with such small sampling frequency you won't be even able to spot fast changes as you'll be measuring much slower that it needs to be.

ADC step precision can be better by using internal 1V1 reference, but it's still way too big step. And there is no other option on UNO. The Mega on the other side has also possibility to configure diferential ADC inputs and with 1x, 20x or 200x gain. But it's not supported by Arduino core, so you'll have to do it directly. However it won't help much if it's sampling too slow.

  • Oh I totally neglected to look at the y axis on that graph. That's very helpful. I figured that the sampling rate would be too slow but I thought that I might be able to delay starting the measurements and basically interleave multiple power traces. Probably wouldn't have worked though considering the changing counter. – genghiskhan Dec 28 '19 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.