Speck-Analysis-checkpoint.ipynb 123 KB
Speck Analysis Notebook
The following block initializes the chipwhisperer, as always
import chipwhisperer as cw
import time# Path to the Speck .hex file for reflashing
PATH="/home/juan/documents/master-aits/subjects/implementation_attacks_and_countermeasures/praktikum/speck_cpa_cw/cw_firmware/simple-speck-CWLITEARM.hex"scope.dis()[0;31m---------------------------------------------------------------------------[0m [0;31mNameError[0m Traceback (most recent call last) [0;32m/tmp/ipykernel_851327/1933793010.py[0m in [0;36m<module>[0;34m[0m [0;32m----> 1[0;31m [0mscope[0m[0;34m.[0m[0mdis[0m[0;34m([0m[0;34m)[0m[0;34m[0m[0;34m[0m[0m [0m [0;31mNameError[0m: name 'scope' is not defined
def flash(scope, prog):
cw.program_target(scope, prog, PATH)
def reset_target(scope):
scope.io.nrst = 'low'
time.sleep(0.05)
scope.io.nrst = 'high_z'
time.sleep(0.05)
try:
if not scope.connectStatus:
scope.con()
except NameError:
scope = cw.scope()
try:
target = cw.target(scope)
except IOError:
print("INFO: Caught exception on reconnecting to target - attempting to reconnect to scope first.")
print("INFO: This is a work-around when USB has died without Python knowing. Ignore errors above this line.")
scope = cw.scope()
target = cw.target(scope)
print("INFO: Found ChipWhisperer😍")
prog = cw.programmers.STM32FProgrammer
time.sleep(0.05)
scope.default_setup()[0;31m---------------------------------------------------------------------------[0m [0;31mNameError[0m Traceback (most recent call last) [0;32m/tmp/ipykernel_851327/2459641658.py[0m in [0;36m<module>[0;34m[0m [1;32m 10[0m [0;32mtry[0m[0;34m:[0m[0;34m[0m[0;34m[0m[0m [0;32m---> 11[0;31m [0;32mif[0m [0;32mnot[0m [0mscope[0m[0;34m.[0m[0mconnectStatus[0m[0;34m:[0m[0;34m[0m[0;34m[0m[0m [0m[1;32m 12[0m [0mscope[0m[0;34m.[0m[0mcon[0m[0;34m([0m[0;34m)[0m[0;34m[0m[0;34m[0m[0m [0;31mNameError[0m: name 'scope' is not defined During handling of the above exception, another exception occurred: [0;31mNameError[0m Traceback (most recent call last) [0;32m/tmp/ipykernel_851327/2459641658.py[0m in [0;36m<module>[0;34m[0m [1;32m 12[0m [0mscope[0m[0;34m.[0m[0mcon[0m[0;34m([0m[0;34m)[0m[0;34m[0m[0;34m[0m[0m [1;32m 13[0m [0;32mexcept[0m [0mNameError[0m[0;34m:[0m[0;34m[0m[0;34m[0m[0m [0;32m---> 14[0;31m [0mscope[0m [0;34m=[0m [0mcw[0m[0;34m.[0m[0mscope[0m[0;34m([0m[0;34m)[0m[0;34m[0m[0;34m[0m[0m [0m[1;32m 15[0m [0;34m[0m[0m [1;32m 16[0m [0;32mtry[0m[0;34m:[0m[0;34m[0m[0;34m[0m[0m [0;31mNameError[0m: name 'cw' is not defined
Reset the target if required:
reset_target(scope)Reflash the target if required:
flash(scope, prog)Detected known STMF32: STM32F302xB(C)/303xB(C) Extended erase (0x44), this can take ten seconds or more Attempting to program 5827 bytes at 0x8000000 STM32F Programming flash... STM32F Reading flash... Verified flash OK, 5827 bytes
Set an encryption key:
# 32 bytes of encryption key
encryption_key = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
if len(encryption_key) == 32:
target.simpleserial_write("s", encryption_key)
target.simpleserial_read("o", 32)Get the encryption key:
target.simpleserial_write("k", b'\x00'*16)
print(target.simpleserial_read("o", 32))CWbytearray(b'00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f')
Encrypt a 16-byte block:
pt = b"\x70\x6f\x6f\x6e\x65\x72\x2e\x20\x49\x6e\x20\x74\x68\x6f\x73\x65"
target.simpleserial_write("e", pt)
print(target.simpleserial_read("c", 16))CWbytearray(b'43 8f 18 9c 8d b4 ee 4e 3e f5 c0 05 04 01 09 41')
Plot the power consumption of the encryption step:
def trace_encryption():
global scope, target
pt = b"\x70\x6f\x6f\x6e\x65\x72\x2e\x20\x49\x6e\x20\x74\x68\x6f\x73\x65"
return cw.capture_trace(scope, target, pt, b"e")reset_target(scope)
pt = trace_encryption()[0;31m---------------------------------------------------------------------------[0m [0;31mOSError[0m Traceback (most recent call last) [0;32m/tmp/ipykernel_833812/1292385230.py[0m in [0;36m<module>[0;34m[0m [1;32m 1[0m [0mreset_target[0m[0;34m([0m[0mscope[0m[0;34m)[0m[0;34m[0m[0;34m[0m[0m [0;32m----> 2[0;31m [0mpt[0m [0;34m=[0m [0mtrace_encryption[0m[0;34m([0m[0;34m)[0m[0;34m[0m[0;34m[0m[0m [0m [0;32m/tmp/ipykernel_833812/2495386390.py[0m in [0;36mtrace_encryption[0;34m()[0m [1;32m 2[0m [0;32mglobal[0m [0mscope[0m[0;34m,[0m [0mtarget[0m[0;34m[0m[0;34m[0m[0m [1;32m 3[0m [0mpt[0m [0;34m=[0m [0;34mb"\x70\x6f\x6f\x6e\x65\x72\x2e\x20\x49\x6e\x20\x74\x68\x6f\x73\x65"[0m[0;34m[0m[0;34m[0m[0m [0;32m----> 4[0;31m [0;32mreturn[0m [0mcw[0m[0;34m.[0m[0mcapture_trace[0m[0;34m([0m[0mscope[0m[0;34m,[0m [0mtarget[0m[0;34m,[0m [0mpt[0m[0;34m,[0m [0;34mb"e"[0m[0;34m)[0m[0;34m[0m[0;34m[0m[0m [0m [0;32m~/.local/lib/python3.9/site-packages/chipwhisperer/__init__.py[0m in [0;36mcapture_trace[0;34m(scope, target, plaintext, key, ack)[0m [1;32m 331[0m [0mtarget[0m[0;34m.[0m[0mset_key[0m[0;34m([0m[0mkey[0m[0;34m,[0m [0mack[0m[0;34m=[0m[0mack[0m[0;34m)[0m[0;34m[0m[0;34m[0m[0m [1;32m 332[0m [0;34m[0m[0m [0;32m--> 333[0;31m [0mscope[0m[0;34m.[0m[0marm[0m[0;34m([0m[0;34m)[0m[0;34m[0m[0;34m[0m[0m [0m[1;32m 334[0m [0;34m[0m[0m [1;32m 335[0m [0;32mif[0m [0mplaintext[0m[0;34m:[0m[0;34m[0m[0;34m[0m[0m [0;32m~/.local/lib/python3.9/site-packages/chipwhisperer/capture/scopes/OpenADC.py[0m in [0;36marm[0;34m(self)[0m [1;32m 334[0m """ [1;32m 335[0m [0;32mif[0m [0mself[0m[0;34m.[0m[0mconnectStatus[0m [0;32mis[0m [0;32mFalse[0m[0;34m:[0m[0;34m[0m[0;34m[0m[0m [0;32m--> 336[0;31m [0;32mraise[0m [0mOSError[0m[0;34m([0m[0;34m"Scope is not connected. Connect it first..."[0m[0;34m)[0m[0;34m[0m[0;34m[0m[0m [0m[1;32m 337[0m [0;31m# with DelayedKeyboardInterrupt():[0m[0;34m[0m[0;34m[0m[0;34m[0m[0m [1;32m 338[0m [0;32mtry[0m[0;34m:[0m[0;34m[0m[0;34m[0m[0m [0;31mOSError[0m: Scope is not connected. Connect it first...
%matplotlib notebook
import matplotlib.pylab as plt
plt.figure()
plt.plot(pt.wave, "r")
plt.show()
scope.dis()