Article

Poor Man's ChipTweaker

We Have (Low-Budget) Ways of Making You Talk

Hardware Security Modules (HSMs) are electronic devices using various hardware protection schemes against unauthorized reading of the secret data they hold. They usually perform actions like encryption or digital signing but may perform other tasks as well. Bank cards or access cards are typical examples of HSMs. They must keep PINs and private keys secret as long as possible in case the card is stolen or lost. Furthermore, many general-purpose MCUs also sport some memory-protection features intended to protect against illegal copying of proprietary firmware. The Poor Man’s ChipTweaker presented here is a tool to learn the basics of non-invasive attacks against HSMs. With it you can try to unlock a memory-protected microcontroller.

This is a MEMBER ONLY article. You need a subscription to read this article.

Benefits of a subscription

Access to Elektor archive and 5,000+ Gerber files
Receive up to 8 magazines per year (digital and/or paper)
10% discount in the Elektor store

View the offers
Available from €4.95 per month.

What is Elektor Exclusive?

Materials

Luka Matic, “Tamper-Evident Box”, Elektor 5/ 2020

ChipWhisperers from NewAE Technology Inc.

Sergei P. Skorobogatov, “Copy Protection in Modern Microcontrollers”

Downloads for this article at Elektor Labs

S. Mangard, E. Oswald, T. Popp, Power Analysis Attacks: Revealing the Secrets of Smart Cards, Springer, 2007

Component list

Component List

[Illustration 210462-009-94]

[Illustration 210462-010-94]

Resistors

R1,R29,R35 = 680 Ω
R2,R34 = 47 kΩ
R3,R5,R6,R7,R9,R23,R25,R33,R38 = 10 kΩ
R4,R8,R13 = 100 kΩ
R10 = 1.5 kΩ
R11,R12,R17,R22,R24,R26,R27,R32,R36 = 1 kΩ
R14,R28,R30 = 4.7 kΩ
R15 = 330 Ω
R16,R19 = 33 kΩ
R18 = 2.2 kΩ
R20* = 22 Ω*
R21* = 10 kΩ*
R31,R37 = 100 Ω
R39,R40 = 3.3 kΩ
P1,P2,P3,P5 = Potentiometer, 5 kΩ, vertical
P4 = Potentiometer, 10 kΩ,vertical
P6 = Potentiometer, 500 Ω, vertical
P7 = Potentiometer, 2 kΩ, vertical
P8,P9 = Potentiometer, 25 kΩ,vertical

Capacitors

C1 = 100 µF 16V, 3.5 mm pitch
C2 = 10 µF 16V, 2.5 mm pitch
C3,C4,C7,C8,C9,C10,C11,C12,C20,C26,C28,C29 = 100 nF, 5 mm pitch
C5,C6,C17,C22,C25 = 22 pF, 2.5 mm pitch
C13,C24 = 100 pF, 2.5 mm pitch
C14* = 10 nF, 5 mm pitch*
C27 = 10 nF, 5 mm pitch
C15*,C16* = 22 pF, 5 mm pitch*
C18* = 33 pF, 5 mm pitch*
C19* = 100 pF, 5 mm pitch*
C21 = 220 pF, 2.5 mm pitch
C23 = 1 µF, 5 mm pitch

Inductors

L1 = 10 µH

Semiconductors

D1,D2,D3,D4,D5,D13,D14,D20,D21 = 1N4148
D11* = 1N4148*
D6,D7,D8,D9,D10,D15,D16,D17,D18,D19 = BAT85
D12* = BAT85*
IC1 = LM358
IC2 = 74HC00
IC3 = 74HC14
IC4 = LMV761, SOIC8
IC5 = 7805, TO220
IC6* = ATmega8A-PU*
LED1,LED2 = LED, 3 mm, green
LED3 = LED, 3 mm, yellow
LED4 = LED, 3 mm, red
T1 = BC141, TO39
T2 = BC557C
T3,T4,T5,T8,T9 = PN2369, TO92
T6 = BC547C
T7 = 2N2369, TO18

Miscellaneous

JP1-JP13,JP15 = 2-way pinheader, 2.54 mm pitch
JP14,S3,S4 = 3-way pinheader, 2.54 mm pitch
K1 = 8-way pinheader, 2.54 mm pitch
K2 = 14-way pinheader, 2.54 mm pitch
K3 = 4-way pinheader, 2.54 mm pitch
K4,K5 = 2-row 6-way pinheader, 2.54 mm pitch
K6 = Barrel jack
S5 = Slide switch (C&K JS202011CQN)
X1* = Crystal 8 MHz*

* mount with socket for easy experimenting