stgloorious / current-probe

Experimental AD8331 amplifier board for measuring transient CPU power consumption

Low-Noise Amplifier for Current Sensing

This is an experimental breakout board for the ultralow noise AD8331 variable-gain amplifier with internal low-noise preamplifier.

• AC-coupled input up to 200 mV
• Adjustable gain amplifier, up to 55 dB
• Galvanically isolated output
• Single 3.3V supply

The input impedance of the amplifier should be around 6k ohms. The probe is designed to be in close proximity (< 10 mm) to the signal source, i.e., such that no shielded cable is required on the input side. Instead, short wires can directly be soldered to the probe. The output is matched to 50 ohms over an isolating signal transformer, which connects to the SMA connector.

The amplifier module is intended to be used as a current probe with an additional shunt resistor. The amplifier is placed near the device under test and amplifies the voltage drop across the measurement resistor. The output signal is digitized by an oscilloscope connected over the SMA connector.

Progress

• Schematics design
• PCB layout
• PCB prototype manufacturing
• In-circuit verification
• Proof-of-concept of power analysis side channel attack

Known Issues

Although there is a notch filter to suppress the parasitic switching frequency of the DC/DC converter, it is still visible at the output.

Motivation

The current probe is designed to measure the transient current consumption of microcontrollers and low-end CPUs in order to use a power consumption side channel, which can be used to leak information about cryptographic operations. An example power trace measured with this current probe can be seen below. Clearly visible are the 10 AES rounds of the AES-128-ECB algorithm running on an STM32 microcontroller.

Such side-channel attacks have been known to exists for many years, and there are even commercial tools available which simplify the research process.

My goal with this DIY low-noise current probe is to have a cost-effective alternative to other specialized tools, as I already own suitable measurements equipment (i.e., an oscilloscope) and do not need access to other attack methods (such as fault injection).

Manufacturing

PCB manufacturing was done in a custom panel with 5 individual PCBs by multi-cb. Assembly was done by hand.

License

current-probe by Stefan Gloor is licensed under CC BY-SA 4.0

This does not include work of third parties, e.g., 3D STEP models.