Skip to content

Overview & Comparison

Overview

ChipWhisperer is a platform that makes researching and testing embedded side channel attacks simple, easy, replicable, and convient. In particular, ChipWhisperer focuses on power analysis and voltage/clock glitching.

This page compares the features of the four available capture side hardware devices: the ChipWhisperer-Husky, the CW1200 ChipWhisperer-Pro (CWPro), the CW1173 ChipWhisperer-Lite (CWLite), and the CW1101 ChipWhisperer-Nano (CWNano). As a quick overview

  • All four are capable of power analysis and glitching
    • The ChipWhisperer Nano cannot clock glitch, but can voltage glitch
  • The ChipWhisperer Nano is the lowest cost option, but has many limitations compared to the Husky, Lite and Pro. These limit what attacks can be performed using it, especially against non-NewAE targets.
  • The ChipWhisperer-Lite and ChipWhisperer-Pro share the same basic specifications, but the Pro has additional features
    • These additional features, such as IO and Analog triggering, are espcially useful when researching attacks against non-NewAE targets, such as development boards. It also has SMA connectors for trigger input and output, allowing for easy interfacing with lab equipment.
  • All four capture devices can perform power analysis synchronous to the target's clock
    • This helps attacks succeed at much lower sampling frequencies than a conventional oscilloscope
  • The Husky has better analog capabilities than the Lite or Pro, allowing attacks on more targets, as well as ones running at higher frequencies
  • The Husky's glitch resolution is independent of the target clock, allowing for more accurate and reliable glitches

Analog Capture and Clock

Feature ChipWhisperer-Husky ChipWhisperer-Pro ChipWhisperer-Lite ChipWhipserer-Nano
ADC Specs 12-bit 200MS/s 10-bit 105MS/s 10-bit 105MS/s 8-bit 20MS/s
ADC Clock Source PLL Generated (Integer Multiple of Int/Ext Clock) Internally generated (x1 or x4), external input (x1 or x4) Internally generated (x1 or x4), external input (x1 or x4) Internally generated, external input
Analog Input AC-Coupled Differential, adjustable -6.5dB to 55dB low noise gain AC-Coupled, adjustable low-noise gain from -6.5dB to 55dB AC-Coupled, adjustable low-noise gain from -6.5dB to 55dB AC-Coupled, fixed gain of 20dB
Sample Buffer Size >80 000 samples 98 119 samples 24 573 samples 50 000 samples
ADC Decimation Yes Yes Yes No
ADC Offset Adjustment Yes [0, 2^32) Yes, [0, 2^32) Yes, [0, 2^32) No
ADC Trigger Rising-edge, Falling-edge, High, Low Rising-edge, Falling-edge, High, Low Rising-edge, Falling-edge, High, Low Rising-edge
Presampling Yes Yes Yes No
Phase Adjustment Yes Yes, 5ns increments Yes, 5ns increments No
Capture Streaming Yes (>20MS/s max) Yes (10MS/s max) No No
Clock Generation Range 10-350MHz 5-200MHz 5-200MHz 60MHz, divisible by 2, 4, 8, or 16
Clock Output Regular, with glitch inserted, glitch only Regular, with glitch inserted, glitch only Regular, with glitch inserted, glitch only Regular

Triggering

Feature ChipWhisperer-Husky ChipWhisperer-Pro ChipWhisperer-Lite ChipWhipserer-Nano
Modules Basic, Analog Pattern, Analog Threshold, UART, Edge Count, Arm Trace Basic, Analog, SPI, UART Basic Basic
Analog Trigger Sum of Absolute Difference (192 Samples), Analog Level Sum of Absolute Difference (128 samples) N/A N/A
Basic Trigger Inputs TIO 1-4, nRST, SMB TIO 1-4, nRST, SMA TIO 1-4, nRST TIO 4
Basic Trigger Combination One of OR, AND, NAND One of OR, AND, NAND One of OR, AND, NAND N/A

IO

Feature ChipWhisperer-Husky ChipWhisperer-Pro ChipWhisperer-Lite ChipWhipserer-Nano
GPIO Voltage 3.3V 3.3V 3.3V 3.3V
Logic Outputs TIO 1-4, nRST, PDIC, PDID, User IO D0-7 TIO 1-4, nRST, PDIC, PDID TIO 1-4, nRST, PDIC, PDID TIO 1-4, nRST, PDIC, PDID
Logic Inputs TIO 1-4, User IO D0-7 TIO 1-4 TIO 1-4 N/A
UART Serial TIO 1-4 assignment TIO 1-4 assignment TIO 1-4 assignment Fixed TIO 1 and TIO 2
Clock Fixed, HS2 output, HS1 Input Fixed, HS2 output, HS1 input Fixed, HS2 output, HS1 input Fixed, HS2 output, HS1 input
Basic Trigger Inputs TIO 1-4, nRST, SMB, User IO D0-7 TIO 1-4, nRST, SMA TIO 1-4, nRST TIO 4
Basic Trigger Combination One of OR, AND, NAND One of OR, AND, NAND One of OR, AND, NAND N/A
Trigger Out Yes Yes No No
Programmers STM32F UART, XMEGA PDI, AVR ISP, SWD/JTAG (via OpenOCD), SAMBA (AtSAM) STM32F UART, XMEGA PDI, AVR ISP, SWD/JTAG (via OpenOCD), SAMBA (AtSAM) STM32F UART, XMEGA PDI , AVR ISP, SWD/JTAG (via OpenOCD), SAMBA (AtSAM) STM32F UART, SWD/JTAG (via OpenOCD), SAMBA (AtSAM)
Power rails 3.3V 5V, 3.3V 3.3V 3.3V
User IO Pins 8 Data pins, JTAG, SWD, Arm Trace, Generic, Logic Analyzer N/A N/A N/A

Glitch

Feature ChipWhisperer-Husky ChipWhisperer-Pro ChipWhisperer-Lite ChipWhipserer-Nano
Voltage Glitching YES Yes Yes Yes
Clock Glitching YES Yes Yes No
Glitch Outputs Clock-XOR, Clock-OR, Glitch-Only, Enable-Only Clock-XOR, Clock-OR, Glitch-Only, Enable-Only Clock-XOR, Clock-OR, Glitch-Only, Enable-Only Glitch-Only
Glitch Width Based on Internal PLL (600-1200MHz), 100% (enable-only) 0-49.8% of a clock cycle, 100% (enable-only) 0-49.8% of a clock cycle, 100% Time increments between [0, 2^32)
Glitch Width Increments Based on Internal PLL (600-1200MHz) 0.4% of a clock cycle 0.4% of a clock cycle ~8.3ns
Glitch Offset Based on Internal PLL (600-1200MHz) 0-49.8% of a clock cycle, 100% (enable-only) 0-49.8% of a clock cycle, 100% Time increments between [0, 2^32), high jitter
Glitch Offset Increments Based on Internal Pll (600-1200MHz) 0.4% of a clock cycle 0.4% of a clock cycle ~8.3ns, high jitter
Glitch Cycle Offset [0, 2^32) [0, 2^32) [0, 2^32) N/A
Glitch Cycle Repeat [0, 8192] [0, 8192] [0, 8192] N/A
Voltage Glitch Type High-power, low-power crowbar High-power, low-power crowbar High-power, low-power crowbar Low-power crowbar
Voltage Glitch Pulse Current 20A 20A 20A 4A

ChipWhisperer-Pro features over ChipWhisperer-Lite

  • Additional trigger modules - Analog waveform and UART/SPI
  • 10MS/s streaming mode, allowing almost unlimited sample size
  • SMA connectors for trigger input/output
  • Much larger sample buffer (98k samples on Pro vs. 24k samples on Lite )
  • Waterproof case
  • LCD Screen
  • Labled status LEDs
  • 5V available on 20pin connector

ChipWhisperer-Husky features over ChipWhisperer-Lite

  • Faster ADC (200MS/s on Husky vs. 105MS/s on Lite) with greater bit depth (12-bits on Husky vs. 10-bits on Lite)
  • >20MS/s streaming mode allowing almost unlimited sample size
  • Much larger sample buffer (>80k samples on Husky vs. 24k samples on Lite)
  • Differential ADC input
  • Additional trigger modules - Analog waveform, Analog Level, UART, Edge count, Arm Trace
  • SMB connectors for trigger/glitch output, clock input/output
  • Multiple programmable glitches
  • Tracewhisperer Support
  • Glitch resolution independent of target clock
  • 20-pin User IO header with 8 data pins
    • Data pins can be used as GPIOs, for JTAG/SWD, Arm Trace, or as Logic Analyzer inputs