Accessories

The 1.5 A Glitch Amplifier is designed to make your fault injection tests applicable to a wide range of embedded targets. Easily connect the 1.5 A Glitch Amplifier to the Spider or VC Glitcher to produce sharp and accurate glitches on the target and to an oscilloscope to measure and view the glitches that you generate.

Designed to drive the input pin of an embedded processor, the 1.5 A Glitch Amplifier has virtually 0 Ω output impedance. The DS1140A can operate as a single power supply between 0 and 4 volts (V). This voltage is set in Inspector and controlled via the Spider or VC Glitcher.

The 1.5 A Glitch Amplifier has an amplification factor of two. For example, when setting a continuous voltage level of 2 V and a glitch peak voltage of 3 V, the voltage levels between the Spider or VC Glitcher and the 1.5 A Glitch Amplifier are 1 and 1.5 V, respectively. Consequently, the voltage levels between DS1140A and an embedded processor are respectively 2 and 3 V.

• Increased glitch success rate due to sharper glitches
• Integrated current and power monitor
• Amplifies glitches produced by the Spider or VC Glitcher up to 1.5 A peak-to-peak
• Allows glitching embedded devices such as FPGAs and SOCs
• Easy connection to your target via one of the three output connectors that Glitch Amplifier II offers
• Easy to position closely above your target
• Includes Glitch Amplifier Needle
• Optional 3D positioner (for Glitch Amplifier Needle)
• Can be used in combination with EM probe station baseplate. Glitch Amplifier II exactly fits the baseplate’s grid.

The Active Current Probe is a high-frequency probe that actively picks up electrical currents. Used in side channel analysis to measure a target device’s power consumption, the highly sensitive DS1202A is inserted in the power supply line of a target and can transfer current variations of up to 2 GHz. The Active Current Probe is used in combination with a base unit, which can be used to amplify the measured signal.

• Bandwidth 1 MHz–2,000 MHz
• Maximum continuous current 100 mA (RMS) AC
• Maximum pulse current 5 A
• Current measurement circuit ≤ 0.082 Ω, ≤ 0.042 µH
• 40 dB of gain with base unit max

The DS1110A 445 nm Multimode Fault Injection Laser uses multimode laser diodes with a high power rating, enabling coarse chip surface scanning with large spot size and sufficient intensity within spot.

• 445 nm wavelength blue laser
• Laser pulse power: 3 W
• Configurable pulse length as small as 2 ns
• High pulse frequency allows multi-pulse fault injection attacks
• Short delay between trigger pulse and actual light pulse in combination with minimal jitter allows for accurate laser pulse timing
• Wide range of spot size: Choose from coarse to detailed chip surface scanning with objectives and spot size reducer
• Long-life laser diode with minimal aging
• Integrates with Keysight products DS1101A, DS1102A, DS1160A, and DS1180A

The DS1010A Precision XYZ Stage is the default XYZ stage for various Keysight hardware components which need accurate positioning above the device under test.

• Three high-precision stages with a small step size, small backlash, and small yaw
• Surface-ground steel carriage and high-precision screw pitch
• Base frame allows maximum flexibility for mounting device under test, from small smart cards to large printed circuit boards with significant height
• Frame holds XYZ stages in a fixed position during load and temperature changes

Protecting chips against laser fault attacks is one of the main security challenges in the smart card industry. With the DS1101A Fault Injection Laser System, perform advanced laser fault attacks that meet the highest international standards to assess if a smart card is secured against laser attacks. The DS1101A offers a set of new features meeting the latest timing and power requests from fault injection experts around the world. The special set of lasers with dedicated optics and ultra-fast and flexible control create the ultimate fault injection test solution. Its integration with the Inspector software further ensures that automation and analysis are covered by extendible modules which are flexible and easy to use.

• Supports front- and back-side attacks
• Integration with Inspector’s software and fault analysis modules
• Zoomable camera for easy navigation and automated Z-axis
• Fast multi-time glitching and accurate digital scaling with fast and predictable response to trigger pulse
• Multi-spot and IR navigation upgrades available
• Automatic scanning of a chip’s surface with integrated motorized XYZ stage
• Camera inspection of laser spot and location on chip area
• High repetition accuracy on motorized axes
• SDK available for integration into custom setups

Test your device’s resistance to modified clock signal attacks. Clock glitching is a technique where the supplied clock of a target device is temporarily modified to different clock cycles, causing the behavior of the device to deviate from its normal behavior. This deviation can lead to vulnerabilities and exploits.

The DS1150A Clock Glitcher operates by supplying the normal clock signal as well as the modified clock signal to the target device, enabling you to test if your devices are resistant to attackers that use modified clock signals to compromise their security.

• Includes two internal clock generators that can be configured independently
• Switch between the normal clock and the glitch clock based on a trigger signal
• Clock signal between 1 KHz and 300 MHz; voltage level between -1 V and +4 V
• Glitch clock has three clock modes: configurable digital output, random digital output, and random analog output
• Flexible analog frontend allows easy interfacing with various target types
• Reference signal measures the generated clock signal
• Includes Piñata target with the clock signal exposed

The High Precision Electromagnetic Probe, a highly sensitive probe used in side channel analysis, picks up electromagnetic emissions from semiconductor circuits. The probe has a mechanism that allows you to swap out three different probe tips of varying sizes: 0.2 mm, 0.5 mm, and 1.25 mm. All tips have a directed coil and a protective Teflon shell. Normally used in combination with an XYZ-motion platform, the probe can pick up electromagnetic fields with frequencies of up to 6 GHz, converting them into an AC signal.

By moving over the surface of a target, the DS1203B can find highly active circuits, or hotspots. The signals picked up on a hotspot comprise the measurements for simple or differential electromagnetic analysis. The High Precision Electromagnetic Probe has a variable gain mechanism, which you can set by hand or through an external device and can vary based on the target’s characteristics.

Now includes New and improved Amplifier Unit 

The 1.5 A Glitch Amplifier is designed to make your fault injection tests applicable to a wide range of embedded targets. Easily connect the 1.5 A Glitch Amplifier to the DS1180A and DS1070A/71A to generate sharp and accurate glitches on the target and to an oscilloscope to measure and view the glitches that you generate.

Designed to drive the input pin of an embedded processor, the 1.5 A Glitch Amplifier has virtually 0 Ω output impedance. The DS1140B can operate as a single power supply between 0 and 4 volts (V). This voltage is set in Inspector and controlled via the DS1180A and DS1070A/71A.

The 1.5 A Glitch Amplifier has an amplification factor of two. For example, when setting a continuous voltage level of 2 V and a glitch peak voltage of 3 V, the voltage levels between the DS1180A and DS1070A/71A and the 1.5 A Glitch Amplifier are 1 and 1.5 V, respectively. Consequently, the voltage levels between DS1140B and an embedded processor are respectively 2 and 3 V.

• New and improved Amplifier Unit
• Increased glitch success rate due to sharper glitches
• Integrated current and power monitor
• Amplifies glitches produced by the DS1180A and DS1070A/71A up to 1.5 A peak-to-peak
• Allows glitching embedded devices such as FPGAs and SOCs
• Easy connection to your target via one of the three output connectors that Glitch Amplifier offers
• Easy to position closely above your target 
• Includes Glitch Amplifier Needle
• Optional 3D positioner (for Glitch Amplifier Needle)
• Can be used in combination with EM probe station baseplate. Glitch Amplifier II exactly fits the baseplate’s grid.

Countermeasures for fault injection are becoming more advanced. To bypass some of these countermeasures, a security evaluator needs to be able to generate multiple laser pulses at different locations. The DS1102A lets you generate two laser spots with independent location and timing.

• Work with different laser sources
• Speed up the evaluation process
• Perform multi-pulse attacks with DPSS laser
• Control automated scanning with Inspector and motorized positioning of both laser spots
• Achieve high position accuracy and resolution
• Use the wide field of view to create a relatively large distance on die between two laser spots

The DS1031A Hardware Crypto Training Target is a development board based on an ARM Cortex-M4F core working at a 168MHz clock speed. It has been physically modified and programmed to act as a training target for side channel analysis (SCA) and fault injection (FI) attacks. The source code and integrated development environment (IDE) provided with the target allow it to also be used for development and prototyping.

• Challenging training target for both passive SCA attacks like differential power analysis (DPA) and active FI attacks like differential fault analysis (DFA)
• Accurately models current 32-bit embedded devices; HW crypto is implemented similar to current devices 
• Stable behavior; robust against accidental permanent damage from FI
• Configurable countermeasures

The DS1104 mounts onto the DS1010A Precision XYZ Stage. It works with Keysight laser sources, Keysight diode lasers, DPSS lasers, and third-party lasers when a dovetail interface is available and the wavelength falls into the supported range. 

• Mounts onto DS1010A Precision XYZ Stage
• Front-side and back-side attacks 
• Support for 700 nm – 1100 nm laser sources, including near infrared (NIR)
• NIR camera, 5X objective, and spot size reducer included