Fault Attack Fundamentals Part-1: Clock and Voltage Glitching with ChipWhisperer Husky

Abstract

Fault injection attacks represent a critical class of physical security threats against embedded systems and cryptographic implementations. This tutorial provides a comprehensive introduction to glitch-based fault injection techniques using the ChipWhisperer Husky platform. We present systematic coverage of both clock glitching and voltage glitching methodologies, detailing their theoretical foundations, parameter configurations, and practical implementation considerations. This work serves as a foundational resource for researchers and practitioners in the field of hardware security, providing detailed specifications of controllable parameters and their effects on fault injection success rates.

Table of Contents

1. Clock Glitch
2. Voltage Glitch
3. Understanding Glitch Parameters
4. Implementation Methodology and API Configuration

Clock Glitch

Theoretical Foundation of Clock Glitching

Clock glitching represents a temporal fault injection methodology that exploits the critical timing dependencies inherent in synchronous digital systems. This technique induces transient perturbations in the target device’s clock signal, resulting in violations of setup and hold time requirements that can manifest as computational errors, instruction skipping, or security mechanism bypasses.

The underlying principle leverages the fact that digital circuits require stable clock edges to ensure proper data propagation through sequential logic elements. When the clock signal experiences abnormal transitions or timing violations, the combinational logic may not have sufficient time to settle, leading to metastable states or incorrect data latching.

The ChipWhisperer Husky platform implements clock glitching through precise manipulation of Mixed-Mode Clock Manager (MMCM) phase relationships, enabling fine-grained control over glitch timing and duration. The fault manifestation depends on several factors:

• Temporal precision: The exact phase relationship between the glitch and the target instruction execution
• Glitch amplitude: The degree of timing violation introduced
• Target architecture sensitivity: Processor-specific responses to timing anomalies
• Environmental conditions: Temperature, voltage, and process variations affecting timing margins

Parameter Specification and Control Interface

The ChipWhisperer Husky platform provides comprehensive control over clock glitching parameters through its Python API. The following table presents all controllable parameters available for clock glitch configuration, detailing their API endpoints, data types, operational ranges, and functional descriptions.

Voltage Glitch

Theoretical Foundation of Voltage Glitching

Voltage glitching constitutes a power-domain fault injection methodology that exploits the fundamental dependency of CMOS logic on adequate supply voltage levels for reliable operation. This technique induces transient undervoltage conditions that can compromise the noise margins of digital circuits, leading to logic errors and computational faults.

The physical mechanism underlying voltage glitching relates to the voltage-dependent switching characteristics of CMOS transistors. When the supply voltage falls below the minimum operating threshold (V_DD,min), several failure modes may manifest:

• Reduced drive strength: Insufficient current to charge/discharge node capacitances within the clock period
• Threshold voltage violations: Logic levels falling below switching thresholds
• Propagation delay increases: Extended signal transition times causing timing violations
• Memory cell instability: SRAM and latch corruption due to insufficient retention voltage

The ChipWhisperer Husky implements voltage glitching through a crowbar circuit architecture utilizing both low-power and high-power MOSFET switches. This dual-stage design enables precise control over fault amplitude while maintaining compatibility with various target power domains.

Crowbar Circuit Analysis: The fault injection mechanism operates by temporarily short-circuiting the target’s supply voltage through controlled MOSFET activation. The fault amplitude depends on:

• Target power supply impedance
• Crowbar MOSFET on-resistance
• Decoupling capacitor characteristics
• Load current requirements during fault injection

Parameter Specification and Control Interface

The voltage glitch parameter configuration utilizes the same timing control framework as clock glitching, with additional power-domain specific controls. The following table details all available voltage glitching parameters for the ChipWhisperer Husky platform.

Understanding Glitch Parameters

Core Timing Parameters

All glitch types share these fundamental timing parameters:

System-Level Configuration Parameters

The following parameters define the experimental environment and platform configuration that affects both clock and voltage glitching methodologies:

Implementation Methodology and API Configuration

This section presents the systematic approach to configuring the ChipWhisperer Husky platform for fault injection experiments. The implementation follows established protocols for embedded systems security research and provides reproducible experimental setups.

Clock Glitch Configuration Protocol

The following implementation demonstrates the systematic configuration of clock glitching parameters according to established research methodologies:

# Enable glitch module (REQUIRED for Husky)
scope.glitch.enabled = True

# Clock source for glitch generation
scope.glitch.clk_src = "pll"  # Use PLL for Husky

# How glitch modifies clock
scope.glitch.output = "clock_xor"  # XOR glitch with clock

# Trigger source
scope.glitch.trigger_src = "ext_single"  # Wait for firmware trigger

# Route glitch to target
scope.io.hs2 = "glitch"

# Disable ADC errors during glitching
scope.adc.lo_gain_errors_disabled = True
scope.adc.clip_errors_disabled = True

# Core glitch parameters
scope.glitch.width = 2000       # Phase shift steps (0-4592)
scope.glitch.offset = 2000      # Phase shift steps (0-4592)
scope.glitch.ext_offset = 10    # Clock cycles after trigger
scope.glitch.repeat = 5         # Number of glitch pulses

# Get available phase shift range
max_steps = scope.glitch.phase_shift_steps  # Returns 4592 for Husky

Voltage Glitch Configuration Protocol

The voltage glitching implementation requires careful consideration of target power characteristics and crowbar circuit parameters:

# Quick setup method
scope.vglitch_setup('both', default_setup=False)  # 'lp', 'hp', or 'both'

# Or manual setup
scope.glitch.enabled = True
scope.glitch.clk_src = "pll"
scope.glitch.output = "glitch_only"  # For voltage glitching
scope.glitch.trigger_src = "ext_single"
scope.io.glitch_hp = True  # High-power MOSFET
scope.io.glitch_lp = True  # Low-power MOSFET

# Same timing parameters as clock glitching
scope.glitch.width = 2000
scope.glitch.offset = 2000
scope.glitch.ext_offset = 10
scope.glitch.repeat = 5

# Reset voltage glitch state if needed
scope.io.vglitch_reset()

Experimental Validation and Implementation Framework

To facilitate reproducible research and provide a standardized implementation baseline, we have developed a comprehensive parameter validation framework for the ChipWhisperer Husky platform. This framework enables systematic evaluation of fault injection parameters and serves as a foundation for advanced security research.

Reference Implementation: ChipWhisperer Husky Parameter Testing Framework

The validation framework encompasses:

• Platform initialization protocols: Standardized setup procedures for consistent experimental conditions
• Parameter space exploration: Systematic methods for evaluating fault injection parameter effectiveness
• Fault characterization tools: Metrics and analysis capabilities for assessing attack success rates
• Diagnostic and verification procedures: Quality assurance mechanisms for experimental integrity

This implementation serves as a foundational resource for the hardware security research community, providing validated methodologies for fault injection experimentation and analysis.

Expected Test Output

When the experimental setup is properly configured and the testing framework executes successfully, the system should generate the following comprehensive parameter verification output:

============================================================
PARAMETER VERIFICATION TABLE
============================================================

| Parameter | API Path | Status | Value/Notes |
|-----------|----------|--------|-------------|
| Width                     | scope.glitch.width             | [PASS] | Original: 0                    |
| Offset                    | scope.glitch.offset            | [PASS] | Original: 0                    |
| Ext_Offset                | scope.glitch.ext_offset        | [PASS] | Original: 0                    |
| Repeat                    | scope.glitch.repeat            | [PASS] | Original: 1                    |
| Clock Source              | scope.glitch.clk_src           | [PASS] | Original: pll                  |
| Output Mode               | scope.glitch.output            | [PASS] | Original: clock_xor            |
| Trigger Source            | scope.glitch.trigger_src       | [PASS] | Original: manual               |
| Clock Frequency           | scope.clock.clkgen_freq        | [PASS] | Original: 7363636.363636363    |
| Phase Shift Steps         | scope.glitch.phase_shift_steps | [PASS] | 4592                           |
| Glitch Enabled            | scope.glitch.enabled           | [PASS] | Original: True                 |
| HS2 Output                | scope.io.hs2                   | [PASS] | Original: clkgen               |
| Arm                       | scope.arm()                    | [PASS] | Method OK                      |
| vglitch_setup (lp)        | scope.vglitch_setup('lp')      | [PASS] | Method OK                      |
| vglitch_setup (hp)        | scope.vglitch_setup('hp')      | [PASS] | Method OK                      |
| vglitch_setup (both)      | scope.vglitch_setup('both')    | [PASS] | Method OK                      |
| LP MOSFET                 | scope.io.glitch_lp             | [PASS] | Original: True                 |
| HP MOSFET                 | scope.io.glitch_hp             | [PASS] | Original: True                 |
| Output Mode (Voltage)     | scope.glitch.output            | [PASS] | Original: glitch_only          |
| vglitch_reset             | scope.io.vglitch_reset()       | [PASS] | Method OK                      |
| ADC Samples               | scope.adc.samples              | [PASS] | Original: 5000                 |
| ADC Timeout               | scope.adc.timeout              | [PASS] | Original: 2                    |
| Trigger Module            | scope.trigger.module           | [PASS] | Original: basic                |
| Target Reset              | scope.io.nrst                  | [PASS] | Original: high_z               |
| ADC Trig Count            | scope.adc.trig_count           | [PASS] | 0                              |
| ADC State                 | scope.adc.state                | [PASS] | False                          |
| ADC Lo Gain Errors Disabl | scope.adc.lo_gain_errors_disab | [PASS] | Original: True                 |
| ADC Clip Errors Disabled  | scope.adc.clip_errors_disabled | [PASS] | Original: True                 |
| Baud Rate                 | target.baud                    | [PASS] | Original: 230400               |
| In Waiting                | target.in_waiting()            | [PASS] | 0                              |
| Clkgen Source             | scope.clock.clkgen_src         | [PASS] | Original: system               |
| ADC Mul                   | scope.clock.adc_mul            | [PASS] | Original: 3                    |
| PLL Locked                | scope.clock.pll.pll_locked     | [PASS] | True                           |
| Glitch MMCM Locked        | scope.glitch.mmcm_locked       | [PASS] | True                           |
| ADC Frequency             | scope.clock.adc_freq           | [PASS] | 22095238.095238093             |
| Scope Name                | scope.getName()                | [PASS] | Unknown                        |

This verification table confirms proper initialization and accessibility of all critical system parameters, providing confidence in the experimental setup before proceeding with fault injection experiments.

References

• ChipWhisperer Husky Documentation
• Fault101 Course Materials
• NewAE Forum Discussions
• Experimental results from SAM4S target testing