Gear / Fault injection / ChipWhisperer

ChipWhisperer

A synchronized side-channel and glitch platform. Capture power traces for CPA, or trigger a voltage/clock glitch to skip a check.

CORE KIT 250–350€ Fault injection

What it does

The ChipWhisperer is a capture rig built for two related jobs: power/EM side-channel analysis and voltage/clock fault injection. It synchronizes to the target over a trigger line, records aligned power traces across a shunt resistor for CPA key recovery, and on the glitch side briefly disturbs the supply or clock at a precise offset to corrupt one instruction, turning a signature check or a password compare into a free pass.

Use cases

Recover an AES key with CPA

Capture thousands of aligned power traces of the same operation and correlate them against a leakage model of the S-box output.

Glitch past a signature check

Sweep the glitch offset and width until a boot that should fail instead drops into a debug shell.

Profile a routine's timing

Trigger on an I/O event and measure how execution time shifts with input, a first pass before reaching for full CPA.

How you use it

Driven from Python: arm the scope, run the target operation, capture the trace, repeat, then attack the trace set:

scope = cw.scope()
target = cw.target(scope)
scope.arm()
target.simpleserial_write('p', plaintext)   # trigger the target op
trace = scope.get_last_trace()               # aligned power trace
# repeat over many plaintexts, then run cw.analyzer's CPA attack on the trace set

Wiring

Power is measured across a shunt in the target's supply line; the trigger line tells the scope when to start capturing or when to fire a glitch. The glitch line is only wired for active fault injection, not passive power analysis.

Variants & pitfalls

Over-glitching can brick the target. Fault injection is destructive-adjacent: aggressive voltage/clock parameters can damage the part, not just misbehave it. Sweep conservatively and expect a probabilistic hit rate, not a clean one-shot.

Alignment makes or breaks CPA. A misaligned or under-averaged trace set hides a key that a clean, well-triggered capture reveals in minutes.