The CW305 is NewAE Technology's first FPGA target board. It brings loads of features including a simplified USB interface for talking to the FPGA, an external PLL for adjusting frequency response, a programmable VCC-INT supply, and diode protection for use in fault injection environments. Also available with a special BGA socket, giving you the ability to perform tests on multiple FPGA devices - perfect for checking Physically Unclonable Functions (PUFs) under the exact same environmental conditions across multiple FPGAs.
This board requires an external oscilloscope or capture box for performing the power measurement. If you are looking for a complete toolchain, purchase the CW305 along with the ChipWhisperer 2-Part version. This will provide you with a complete toolchain for experimentation on FPGA targets.
More details are given below for each, and full documentation is still forthcoming.
This board uses NewAE Technology Inc's custom USB interface firmware. This firmware gives you a simple data/address bus, which you can read/write to the FPGA. The USB chip also controls FPGA configuration (which for the 7A35T device takes just under 2 seconds), the PLL, and the VCC-INT regulator. This makes it easy to script complex jobs like performing measurements at different frequencies or voltages, or reconfiguring the FPGA after a fault attempt to avoid issues with SRAM corruption.
The CDCE906 PLL means you can easily output frequencies from about 5-160 MHz (a larger range is possible but may require more care). The PLL is programmed over USB, and 3 output channels are provided (each which can be set to a different frequency). 2 route to the FPGA and 1 routes to a SMA connector. This allows you to synchronize external devices or boards to the oscillator driving your FPGA design.
Three switching regulators are provided - two fixed for VCC-AUX and VCC-IO, along with a VCC-INT supply which can be programmed over the range of 0.8V-1.10V (this is a software limit to prevent you from damaging the FPGA, this can be overridden if you need to provide about a 0.65-1.5V range). Optional linear regulators can plug into the VCC-AUX and VCC-IO supplies which provide lower-noise operation (but with a reduced current limit compared to the switching supplies).
External banana connectors make is simply to power the VCC-INT from a low-noise bench supply. This can improve side-channel analysis measurements by reducing noise in the shunt measurement compared to the on-board switching supply.
An on-board DMM measures the VCC-INT supply and provides easy visual feedback so you can confirm settings without needing to attach a meter.
A resistive shunt is provided in the VCC-INT supply, with an optional shunt in the VCC-AUX line. The resistive shunt can be measured using a differential probe on 0.1" spacing, using the SMAs, or using the on-board 20dB LNA. The LNA makes it easier to measure with standard oscilloscopes that don't measure the very small variations you find in power analysis.
This board is designed to facilitate all forms of fault injection. Resitive and diode protection prevents transients on the VCC-IO of the FPGA from affecting the USB interface chip. The USB chip itself provides high-speed FPGA reconfiguration to simplify repetitive fault attacks where you need to reconfigure the FPGA. The USB interface can also monitor the INITB pin of the FPGA, which can be used with the continous CRC verification feature to determine when reconfiguration is required.
The PCB features mounting holes and alignment features for use with an X-Y table (suitable for both EM fault injection and H-Field probes).
The VCC-INT supply can be disconnected from the filtering capacitors to allow using the SMA jacks as a method of inserting voltage faults without fighting the output capacitance of the power supply.
The ChipWhisperer Crowbar fault injection can also be used with this board, which requires either the ChipWhisperer-Lite 2-Part version (CW1173-2PART) or CW1200.
Note this board requires an external tool for actually measuring the power consumption if performing side-channel power analysis. This can be an oscilloscope using a SMA-BNC cable, or our ChipWhisperer Capture platform. If you are looking to get started right away, we suggest pairing this with a ChipWhisperer-Lite 2-Part Version (CW1173-2PART).
Examples are forthcoming. We will be adding them to the ChipWhisperer GIT Repo, and currently have an example of AES-128. This will be expanded to include a few other FPGA implementations of cryptographic protocols.
This board has multiple options you can select. Note that we may have to customize each board depending on your options, so this item may have an additional day or two of processing time.
The part number is formed as follows:
Where the options for each of those are:
|Order Code||FPGA Mounted||Notes|
|7A35||XC7A35T-2FTG256||Suitable for most symmetric cryptographic implementations (i.e., pipelined AES will fit). Must use Vivado toolchain (ISE only supports the XC7A100T).|
|7A100||XC7A100T-2FTG256||Large FPGA with 3x logic resources of 7A35. Suitable for very large crypto implementations. Can use either ISE or Vivado.|
|SOCKET||BGA Socket with heatsink||
No FPGA provided in socket, supports any Artix-7 in FTG256 package. Perfect for comparison between devices, such as for PUFs or template attacks.
The mounted FPGA defines the price. The sockets are by Advanced Interconnect, and due to the precision manufacturing required the socket board is consideredly more expensive than either the 7A35 or 7A100 option.
The socket board does not come with an FPGA. You can order a suitable FPGA from any supplier (Digikey etc.), although you can also ask to have one delivered with your board at an additional cost. The suggested part number is one of the following:
The 7A35T in -3 speed grade seems difficult to find. The suffix of those parts will be either I or C for Industrial or Commercial temperature grades. Frequently distributors will have one but not the other in stock, so it's suggested to simply use whichever you can easily find. Assuming you are using these under labratory conditions there is no need to worry about the temperature range.
You can also fit other 7A devices such as the XC7A15 and XC7A50 in FTG256 packages. However if you keep to the 7A35T or 7A100T, you more closely match our product offerings, and thus can directly use some of the example projects.
|Order Code||Shunt Resistance
Best for performing side-channel analysis in 7A35 device, and voltage glitching in the 7A35/7A100. You get a larger signal swing across this compared to the other options, although if significant current the voltage drop across the shunt will be too much for reliable FPGA operations (i.e, 0.5V dropped @1A).
|0.25||250 mOhm||Good for performing side-channel analysis in 7A35/7A100 device. Still a large voltage swing which the CW-Lite can easily pick up on without much noise, but not as much risk of accidently introducing faults.|
|0.1||100 mOhm||This will be a noisier option, but a good trade-off if doing very large implementations in the 7A100. At higher currents may still be too much voltage drop, and will need the 50 mOhm option. Will likely need external VCC-INT supply.|
|0.0||Shorted||If planning on either using an H-Probe, or you are not using the board for side-channel analysis, this is the most reliable option.|
|X||No VCC-INT Capacitors||The decoupling capacitors on the VCC-INT network are NOT present. This option is required if performing side-channel power analysis using the current shunt. May have reliability issues with larger implementations due to noise on the VCC-INT line.|
|M||VCC-INT Capacitors||The decoupling capacitors on the VCC-INT network are present. Generally if using the board primarily for PUF analysis or fault injection this option is suitable. If you are using an H-Probe this option would also be suitable as you do not required the shunt measurement.|