Overview & Comparison
Overview
ChipWhisperer is a platform that makes researching and testing embedded side channel attacks simple, easy, replicable, and convient. In particular, ChipWhisperer focuses on power analysis and voltage/clock glitching.
This page compares the features of the three available capture side hardware devices: the CW1200 ChipWhisperer-Pro (CWPro), the CW1173 ChipWhisperer-Lite (CWLite), and the CW1101 ChipWhisperer-Nano (CWNano). As a quick overview
- All three are capable of power analysis and glitching
- The ChipWhisperer Nano cannot clock glitch, but can voltage glitch
- The ChipWhisperer Nano is the lowest cost option, but has many limitations compared the ChipWhisperer-Lite and ChipWhisperer-Pro. These limit what attacks can be performed using it, especially against non-NewAE targets.
- The ChipWhisperer-Lite and ChipWhisperer-Pro share the same basic specifications, but the Pro has additional features
- These additional features, such as IO and Analog triggering, are espcially useful when researching attacks against non-NewAE targets, such as development boards. It also has SMA connectors for trigger input and output, allowing for easy interfacing with lab equipment.
- All three capture devices can perform power analysis synchronous to the target's clock
- This helps attacks succeed at much lower sampling frequencies than a conventional oscilloscope
Analog Capture and Clock
Feature |
ChipWhisperer-Pro |
ChipWhisperer-Lite |
ChipWhipserer-Nano |
ADC Specs |
10-bit 105MS/s |
10-bit 105MS/s |
8-bit 20MS/s |
ADC Clock Source |
Internally generated (x1 or x4), external input (x1 or x4) |
Internally generated (x1 or x4), external input (x1 or x4) |
Internally generated, external input |
Analog Input |
AC-Coupled, adjustable low-noise gain from -6.5dB to 55dB |
AC-Coupled, adjustable low-noise gain from -6.5dB to 55dB |
AC-Coupled, fixed gain of 20dB |
Sample Buffer Size |
98 119 samples |
24 573 samples |
50 000 samples |
ADC Decimation |
Yes |
Yes |
No |
ADC Offset Adjustment |
Yes, [0, 2^32) |
Yes, [0, 2^32) |
No |
ADC Trigger |
Rising-edge, Falling-edge, High, Low |
Rising-edge, Falling-edge, High, Low |
Rising-edge |
Presampling |
Yes |
Yes |
No |
Phase Adjustment |
Yes, 5ns increments |
Yes, 5ns increments |
No |
Capture Streaming |
Yes (10MS/s max) |
No |
No |
Clock Generation Range |
5-200MHz |
5-200MHz |
60MHz, divisible by 2, 4, 8, or 16 |
Clock Output |
Regular, with glitch inserted, glitch only |
Regular, with glitch inserted, glitch only |
Regular |
Triggering
Feature |
ChipWhisperer-Pro |
ChipWhisperer-Lite |
ChipWhipserer-Nano |
Modules |
Basic, Analog, SPI, UART |
Basic |
Basic |
Analog Trigger |
Sum of Absolute Difference (128 samples) |
N/A |
N/A |
Basic Trigger Inputs |
TIO 1-4, nRST, SMA |
TIO 1-4, nRST |
TIO 4 |
Basic Trigger Combination |
One of OR, AND, NAND |
One of OR, AND, NAND |
N/A |
IO
Feature |
ChipWhisperer-Pro |
ChipWhisperer-Lite |
ChipWhipserer-Nano |
GPIO Voltage |
3.3V |
3.3V |
3.3V |
Logic Outputs |
TIO 1-4, nRST, PDIC, PDID |
TIO 1-4, nRST, PDIC, PDID |
TIO 1-4, nRST, PDIC, PDID |
Logic Inputs |
TIO 1-4 |
TIO 1-4 |
N/A |
UART Serial |
TIO 1-4 assignment |
TIO 1-4 assignment |
Fixed TIO 1 and TIO 2 |
Clock |
Fixed, HS2 output, HS1 Input |
Fixed, HS2 output, HS1 input |
Fixed, HS2 output, HS1 input |
Basic Trigger Inputs |
TIO 1-4, nRST, SMA |
TIO 1-4, nRST |
TIO 4 |
Basic Trigger Combination |
One of OR, AND, NAND |
One of OR, AND, NAND |
N/A |
Trigger Out |
Yes |
No |
No |
Programmers |
STM32F UART, Atmel PDI (for XMEGA), Atmel ISP (for AVR) |
STM32F UART, Atmel PDI (for XMEGA), Atmel ISP (for AVR) |
STM32F UART |
Power rails |
5V, 3.3V |
3.3V |
3.3V |
Glitch
Feature |
ChipWhisperer-Pro |
ChipWhisperer-Lite |
ChipWhipserer-Nano |
Voltage Glitching |
Yes |
Yes |
Yes |
Clock Glitching |
Yes |
Yes |
No |
Glitch Outputs |
Clock-XOR, Clock-OR, Glitch-Only, Enable-Only |
Clock-XOR, Clock-OR, Glitch-Only, Enable-Only |
Glitch-Only |
Glitch Width |
0-49.8% of a clock cycle, 100% (enable-only) |
0-49.8% of a clock cycle, 100% |
Time increments between [0, 2^32) |
Glitch Width Increments |
0.4% of a clock cycle |
0.4% of a clock cycle |
~8.3ns |
Glitch Offset |
0-49.8% of a clock cycle, 100% (enable-only) |
0-49.8% of a clock cycle, 100% |
Time increments between [0, 2^32), high jitter |
Glitch Offset Increments |
0.4% of a clock cycle |
0.4% of a clock cycle |
~8.3ns, high jitter |
Glitch Cycle Offset |
[0, 2^32) |
[0, 2^32) |
N/A |
Glitch Cycle Repeat |
[0, 8192] |
[0, 8192] |
N/A |
Voltage Glitch Type |
High-power, low-power crowbar |
High-power, low-power crowbar |
Low-power crowbar |
Voltage Glitch Pulse Current |
20A |
20A |
4A |
ChipWhisperer-Pro features over ChipWhisperer-Lite
- Additional trigger modules - Analog waveform and UART/SPI
- 10MS/s streaming mode, allowing almost unlimited sample size
- SMA connectors for trigger input/output
- Much larger sample buffer (24k samples on Lite vs 98k samples on Pro)
- Waterproof case
- LCD Screen
- Labled status LEDs
- 5V available on 20pin connector