Protocol Interfaces
Security & Privacy
AMD-Xilinx

ChipWhisperer-Husky

The power-analysis and fault-injection tool you can hold in your paw

$82,183 raised

of $1 goal

Funded!

Back this project to help bring it into existence.
Funding ends on Oct 13, 2022 at 04:59 PM PDT.

$549

View Purchasing Options

Recent Updates

You'll be notified about news and stock updates for this project.

ChipWhisperer-Husky is designed as a compact package for working with side-channel power analysis and fault injection. It builds on our experience with ChipWhisperer-Lite and ChipWhisperer-Pro, adding new features like high-speed logic analyzers (to visualize glitches), real-time data streaming for attacking asymmetric algorithms, support for JTAG/SWD programming with an FTDI-compatible mode, and additional I/O expansion pins. ChipWhisperer-Husky is designed to be highly accessible to researchers while preserving our ability to offer long-term support. This means that, while the entire product is not OSHW-certified, the core—including the FPGA logic, microcontroller firmware, and computer code—is open-source, so you can make modifications and add features.

Learning Resources

ChipWhisperer-Husky works with a variety of educational resources we have already built and organized into self-taught "courses". You can see examples of these courses as part of the ChipWhisperer Project. If you need more help, we offer a video series on ChipWhisperer.io, and The Hardware Hacking Handbook has numerous examples that are compatible with ChipWhisperer-Husky.

So what can you do with these resources and a ChipWhisperer-Husky?

Power-Analysis & Fault-Injection Research

ChipWhisperer-Husky is custom designed to perform power analysis & fault injection. It benefits from numerous architecture-level decisions that give you a more stable and reliable experience compared to other off-the-shelf test gear (such as oscilloscopes and function generators). One such feature is synchronous sampling, which means the sample clock of your target device and the sample clock of ChipWhisperer-Husky can be perfectly aligned.

This requires ChipWhisperer-Husky to be able to synchronize to any clock frequency, not just a standard 10 MHz reference like most test gear. We use a PLL chip to provide this feature in ChipWhisperer-Husky. This offers better flexibility than the previous generation, which relied on a PLL block in the FPGA. ChipWhisperer-Husky can of course act like a normal "asynchronous" oscilloscope, instead, allowing you to specify any sample frequency within its range.

The unique design of ChipWhisperer-Husky also lets it generate various glitches, including clock glitches, which may be less than a nanosecond wide:

Generating such a short pulse with a standard function generator would require a unit in the range of 1 GS/s (and an even higher analog bandwidth). Then you’d still need to write all the interface code! And chances that another researcher would have the exact same unit would be low, so you’d struggle to achieve the level of community reproducibility that we designed ChipWhisperer to provide.

Another new feature of ChipWhisperer-Husky is a built-in logic analyzer that you can use to visualize glitches and other digital signals:

Triggering & More

Because it was designed specifically for power analysis & fault injection, ChipWhisperer-Husky has a huge range of triggering mechanisms. These mechanisms run "on the hardware" in the FPGA and allow you to trigger on things like:

Level / Edge: Trigger on digital rising or falling edge or when passing a specific analog value. This is the normal triggering mechanism you’ll find in every oscilloscope. To see how it works, have a look at the open-source Verilog core.

Analog Waveform: Trigger when matching a specific pattern in the waveform, not just when crossing a threshold. This allows you to trigger on specific code that you previously identified, even without any external digital signal. This feature was previously exclusive to ChipWhisperer-Pro and certain application-specific products such as Riscure icWaves. You can see how it works in the open-source Verilog core.

UART Bytes: Trigger on a specific UART character, which allows you to time things relative to a specific boot message or as part of a protocol. This is part of the core trigger unit linked above.

Edge Count: Trigger on a number of rising edges, which can be useful to trigger on digital protocols for which no specific decoder yet exists. Learn more in the open-source Verilog core.

Arm Trace: ChipWhisperer-Husky understands the Arm trace format, with messages coming from both SWO (serial trace) and parallel trace pins. This advanced feature—which was designed specifically for white-box evaluations in which you have full control of the target—makes it trivial to understand new algorithms and libraries. The triggering feature means you can trigger when the code hits specific Program Counter (PC) values. This is part of our open-source TraceWhisperer core.

FPGA Fun: Not only is the ChipWhisperer-Husky FPGA design fully open, it supports extensive test benches, including Verilator simulation-based test benches, so you can add new modules and features as well.

Flexible Targets for More Fun

ChipWhisperer-Husky ships with two "targets" on which you can run various code, including all of our tutorials. The targets represent typical embedded systems you might be working with when trying to protect against these attacks, and they give you a known starting point so you don’t have to waste time getting the instrumentation setup. Instead, you can jump right into the interesting part of the work: exploring power analysis and fault injection.

The microcontroller-based target is a Microchip SAM4S2A, which has 128 KBytes of FLASH and 64 KBytes of SRAM. It is large enough to run most algorithms you throw at it, including AES, RSA, and ECC.

The other target uses the popular Lattice iCE40 FPGA. We’ve already setup the tutorial to run NEORV32, a soft-core RISC-V processor. This means you can use the iCE40 target as a RISC-V microcontroller target out of the box. You can also run some cryptographic cores on it—an AES core fits, for example—which allows you to perform attacks on hardware-based cryptographic implementations.

If you want more targets, we’ve designed lots over the years. For this Crowd Supply campaign, we’ve added a new, low-cost Artix A35 FPGA target, which is big enough to let you run hardware ECC, and even larger soft-core microcontrollers such as the Arm DesignStart. We’ve also collected a few of our devices that have hardware cryptographic accelerators into one package.

Features & Specifications

Documentation & Source

ChipWhisperer-Husky development is found here:

We have not obtained OSHW certification for ChipWhisperer-Husky. Instead, we have focused on producing a highly accessible hardware platform, which requires that we provide long-term support for users. That, in turn, requires us to know that the tools available on the market were produced by us and subject to our quality-assurance process. This approach has allowed us to grow the company while keeping the educational tutorials and critical design pieces (such as the FPGA and firmware code) fully open source.

Comparisons

ChipWhisperer-Husky is a feature and architecture upgrade to the ChipWhisperer-Lite. It offers features that were previously available only in the more expensive ChipWhisperer-Pro and supports the same innovative "synchronous sampling" technology that underpins our ChipWhisperer capture architecture, which allows you to analyze devices well beyond what its low cost would suggest.

ChipWhisperer-Husky includes a substantially upgraded FPGA. It now uses a 7-series model, which makes it easy to use with modern tools. The FPGA code has been entirely redesigned with the help of our FPGA wizard, J-P, who uses actual test benches (unlike Colin).

You can see a comparison between a few of our existing tools, along with other off-the-shelf equipment here:

ChipWhisperer-HuskyChipWhisperer-LiteChipWhisperer-NanoOscilloscope
Open-SourceSW, FW, FPGA SW,FW,FPGA,PCB SW,FW (no FPGA) No
Software SupportPython3 API, Python + Jupyter Tutorials Python3 API, Python + Jupyter Tutorials Python3 API, Python + Jupyter Tutorials API (if you're lucky), control software
DocumentationTutorials, API, User Guide Tutorials, API, User Guide Tutorials, API, User Guide API only (maybe), user guide
EnclosureYes No No Yes
QA managersCanine Canine Canine Human
ADC
Sample Clock ModeSynchronous or Async Synchronous or Async Synchronous Asynchronous
Sample Clock to Device Clock RatiosArbitrary Fixed Fixed N/A
Sample Clock phase shift adjustmentYes Yes No N/A
Max Sample Rate200¹ MS/s 105¹ MS/s 20¹ MS/s >100 MS/s
Bit Depth12 bits 10 bits 8 bits 8 bits (most common)
Sample Buffer Size100 KSample 24 KSample 80 KSample 16 KSample - 4 GSample
Segmented CaptureYes Beta Feature No Depends on scope
Streaming Mode (Unlimited capture size)Yes No No Depends on scope
Trigger ModeEdge,Level,Pattern,UART,Arm SWO,Arm Trace,Custom FPGA Edge,LevelEdge Edge,Level,sometimes others
I/O
JTAG/SWD SupportYes Yes Partial No
Arm ETM Support (Trace Capture)Yes No No No
USB-Serial SupportYes Yes Yes No
Logic Analyzer ModeYes, 300 MS/s No No Sometimes
Programming Support (Native)STM32Fx, AVR, XMEGA, iCE40, Xilinx FPGA STM32Fx, AVR, XMEGA, iCE40, Xilinx FPGA STM32Fx, AVR, XMEGA None
Programming Support (via OpenOCD)Any supported JTAG/SWD device Any supported JTAG/SWD device Any supported JTAG/SWD device None
Auxiliary Output ConnectorYes Not Mounted No Sometimes
Glitch
Clock OutputYes Yes No No
Voltage OutputYes Yes Partial No
Aux OutputYes Partial No No
Visualizer/MonitorClock+Voltage Voltage Voltage N/A
Glitches per TriggerMultiple Single Single N/A
Cost USD $549 $300 $50 $200 - $5000

¹ Max ADC specification - in practice, max sample rate is 1.1x to 2x this, depending on the environment

Usage of CW308 & Older Targets

ChipWhisperer-Husky uses a new "target" design that plugs in on an edge connector. We call this style the "CW312" (or often written as CW312T, for ‘CW312 Target’). This makes it easier to build targets by avoiding the through-hole soldering the old version required (the new style uses the edge connectors, the old style has the 3 rows of 20-pin male headers)

You can convert between the two using the adapter board, which allows soldering of a "CW308" style target onto an interposer board:

In addition, you might want the CW308 "UFO Board". This was our original base-board (read more about it here), which provides some additional features, including better I/O protection against ESD or aggressive glitching (such as when using EMFI), more power-supply options, and better filtering. Due to supply-chain challenges we’ve delayed the replacement of the CW308, and instead use it alongside the "CW313" board that ships with ChipWhisperer-Husky:

All of the ChipWhisperer capture solutions use the same 20-pin connection pinout. This means you can sub ChipWhisperer-Husky into existing kits or tutorials with little effort.

Currently, more targets are available in the CW308 style than the CW312 style. The "CW312" board—the planned replacement for the CW308—doesn’t exist yet. Instead what ships with ChipWhisperer-Husky is the CW313 "interposer", which includes several headers but a more limited set of active components (only voltage regulators & LEDs).

Component Sourcing

We all know that component sourcing is not easy these days, which might make you wonder why we are launching a new tool right now. We’ve been working hard to ensure the ChipWhisperer-Husky has a relatively agile design. To that end, we have secured future deliveries of core components (such as FPGAs and microcontrollers) for at least 400 units. We’ve even done some small runs to ensure we can deliver orders as fast as possible.

NOTE: Once we run out of our pre-stocked parts, we may find ourselves looking at a very long lag. ChipWhisperer-Husky’s core FPGA is currently facing lead times of at least a year. We do have orders in, but they will take some time to arrive. Estimated delivery timelines for crowdfunding backers are based on our existing inventory. We may fulfill orders in multiple batches, and you can expect that some deliveries will likely occur sooner than others. (In particular, the first 20 to 40 backers might receive their boards early thanks to our existing stock of assembled boards.)

We’ll have more updates as the campaign progresses.

Manufacturing Plan

ChipWhisperer-Husky will be manufactured by long-term PCBA partners with whom we’ve worked for many years (including to deliver PhyWhisperer-USB). Most of the final testing and packaging will be done on-site in our production facilities here, which have slowly grown over the years and now look rather like a legitimate office:

Our Assistant (to the) QA Manager, Bergen, who you first met in the PhyWhisperer-USB campaign, has been keeping a close watch on everything to ensure the QA Manager (Luna) isn’t fully overloaded.

Luna, our QA Manager, and Bergen, Assistant (to the) QA Manager.

Fulfillment & Logistics

NewAE Technology Inc. has been selling hardware on the interwebs for the past eight years, so we’re no stranger to the hassles of logistics. Fulfillment will be handled by Crowd Supply and Mouser, who have plenty of experience delivering products all over the world.

ChipWhisperer-Husky will be subject to CE testing to ensure distribution in European markets. We’ve done such tests on other products, including ChipWhisperer-Lite, so we do not foresee any major issues. We anticipate the need to make at most a few minor board tweaks.

NOTE: The hardware cryptographic target pack will likely be subject to export restriction due to it’s inclusion of hardware cryptographic accelerators. If you order this product, you might need to provide additional information to receive it! ChipWhisperer-Husky itself does not include any such restricted technology, and we’ve been careful to avoid including hardware-based cryptographic targets that might trigger such restrictions on other products.

WARNING: See the note in Component Sourcing. We expect to have variable delivery times due to batching the production process. The specified estimates apply to the first batches.

Risks & Challenges

Supply-chain delays and chip shortages have been a global concern over the past couple of years. This campaign was originally planned for a fall 2021 launch but was delayed to ensure the solidity of our supply chain. The good news is, we’ve already manufactured an initial run of ChipWhisperer-Husky boards, and we’ve had numerous beta and R&D units out in the field for the past 18 months. In addition, thanks to our supplier relationships and to the cash-flow generated by our previous products, we have:

Finally, we have taken full advantage of recent delays to complete all of the "planned" features for ChipWhisperer-Husky. The risk risk of "R&D problems" is even lower than usual, and the product you receive will be fully feature-complete!


ChipWhisperer-Husky is part of AMD Xilinx FPGA Playground!

In the Press

Hackster News

"The Canadian-based security research company NewAE Technology is announcing their latest side-channel attack tool, the ChipWhisperer-Husky."

Geeky Gadgets

"Developers, engineers and hobbyists may be interested in a new compact device specifically designed for experimenting with side-channel power analysis and fault injection."

CNX Software

"[The] device delivers a more stable and reliable experience compared to other off-the-shelf test gear such as oscilloscopes and function generators thanks to features such as synchronous sampling..."


Ask a Question

Produced by NewAE Technology Inc in Halifax, NS, Canada.

Sold and shipped by Crowd Supply.

ChipWhisperer-Husky Starter Kit

Run most of the ChipWhisperer tutorials, including power analysis, clock glitching, and voltage glitching. Includes ChipWhisperer-Husky unit, CW313 target base-board, iCE40 (small FPGA) target, SAM4S (Arm processor) target, USB cables, SMA cables, 20-pin straight-through and breakout cables

$549 Free Worldwide Shipping

Hardware Crypto Target Pack

A selection of targets with hardware cryptographic features, which allow you to perform more advanced power-analysis attacks, includes SAM4L, SAM11L, EFR32MG32A, and MK82F. Targets are in both CW308 and CW312 form factors.

$75 Free Worldwide Shipping

CW308 STM32F Socket Target

A TQFP64 socket that fits most STM32F0/1/2/3/4 microcontrollers (along with GigaDevice compatable pinouts). Great for performing research on multiple devices and testing how resiliant templates are.

$140 Free Worldwide Shipping

CW312 Adapter / Breakout Pack

5x CW312 Breakout/Adapter PCBs

$15 Free Worldwide Shipping

CW312 Artix (A35) Target Board

Artix A35 FPGA target, allows implementation of larger cryptographic cores than fit in the small iCE40 target.

$125 Free Worldwide Shipping

CW308 UFO Target Board

From the Crowd Supply Basics project.

The CW308 puts all the standard requirements onto one board (such as power supplies, oscillators, filters) allowing you to make super-simple hardware-hacking target boards.

$240 $8 US Shipping / $18 Worldwide

The Hardware Hacking Handbook

From the Crowd Supply Basics project.

Learn how to break embedded security with hardware attacks with this 512-page No Starch Press book by Colin O'Flynn and Jasper van Woudenberg. You will receive the printed book and free access to the PDF, Mobi, and ePub digital versions.

$49 $8 US Shipping / $18 Worldwide

About the Team

NewAE Technology Inc

Halifax, NS, Canada  ·  newae.com

NewAE developed the ChipWhisperer, the first open-source tool for side-channel power analysis and fault injection. They have shipped over 2000 of their low-cost boards & now offer a wide range of products to help embedded designers evaluate and develop embedded hardware security solutions.

See Also

Subscribe to the Crowd Supply newsletter, highlighting the latest creators and projects