Accessories

The High Precision Electromagnetic Probe, a highly sensitive probe used in side channel analysis, picks up electromagnetic emissions from semiconductor circuits. The probe has a mechanism that allows you to swap out three different probe tips of varying sizes: 0.2 mm, 0.5 mm, and 1.25 mm. All tips have a directed coil and a protective Teflon shell. Normally used in combination with an XYZ-motion platform, the probe can pick up electromagnetic fields with frequencies of up to 6 GHz, converting them into an AC signal.

By moving over the surface of a target, the DS1203B can find highly active circuits, or hotspots. The signals picked up on a hotspot comprise the measurements for simple or differential electromagnetic analysis. The High Precision Electromagnetic Probe has a variable gain mechanism, which you can set by hand or through an external device and can vary based on the target’s characteristics.

Now includes New and improved Amplifier Unit 

The 1.5 A Glitch Amplifier is designed to make your fault injection tests applicable to a wide range of embedded targets. Easily connect the 1.5 A Glitch Amplifier to the DS1180A and DS1070A/71A to generate sharp and accurate glitches on the target and to an oscilloscope to measure and view the glitches that you generate.

Designed to drive the input pin of an embedded processor, the 1.5 A Glitch Amplifier has virtually 0 Ω output impedance. The DS1140B can operate as a single power supply between 0 and 4 volts (V). This voltage is set in Inspector and controlled via the DS1180A and DS1070A/71A.

The 1.5 A Glitch Amplifier has an amplification factor of two. For example, when setting a continuous voltage level of 2 V and a glitch peak voltage of 3 V, the voltage levels between the DS1180A and DS1070A/71A and the 1.5 A Glitch Amplifier are 1 and 1.5 V, respectively. Consequently, the voltage levels between DS1140B and an embedded processor are respectively 2 and 3 V.

• New and improved Amplifier Unit
• Increased glitch success rate due to sharper glitches
• Integrated current and power monitor
• Amplifies glitches produced by the DS1180A and DS1070A/71A up to 1.5 A peak-to-peak
• Allows glitching embedded devices such as FPGAs and SOCs
• Easy connection to your target via one of the three output connectors that Glitch Amplifier offers
• Easy to position closely above your target 
• Includes Glitch Amplifier Needle
• Optional 3D positioner (for Glitch Amplifier Needle)
• Can be used in combination with EM probe station baseplate. Glitch Amplifier II exactly fits the baseplate’s grid.

The DS1031A Hardware Crypto Training Target is a development board based on an ARM Cortex-M4F core working at a 168MHz clock speed. It has been physically modified and programmed to act as a training target for side channel analysis (SCA) and fault injection (FI) attacks. The source code and integrated development environment (IDE) provided with the target allow it to also be used for development and prototyping.

• Challenging training target for both passive SCA attacks like differential power analysis (DPA) and active FI attacks like differential fault analysis (DFA)
• Accurately models current 32-bit embedded devices; HW crypto is implemented similar to current devices 
• Stable behavior; robust against accidental permanent damage from FI
• Configurable countermeasures

The DS1110A 445 nm Multimode Fault Injection Laser uses multimode laser diodes with a high power rating, enabling coarse chip surface scanning with large spot size and sufficient intensity within spot.

• 445 nm wavelength blue laser
• Laser pulse power: 3 W
• Configurable pulse length as small as 2 ns
• High pulse frequency allows multi-pulse fault injection attacks
• Short delay between trigger pulse and actual light pulse in combination with minimal jitter allows for accurate laser pulse timing
• Wide range of spot size: Choose from coarse to detailed chip surface scanning with objectives and spot size reducer
• Long-life laser diode with minimal aging
• Integrates with Keysight products DS1101A, DS1102A, DS1160A, and DS1180A

The DS1104 mounts onto the DS1010A Precision XYZ Stage. It works with Keysight laser sources, Keysight diode lasers, DPSS lasers, and third-party lasers when a dovetail interface is available and the wavelength falls into the supported range. 

• Mounts onto DS1010A Precision XYZ Stage
• Front-side and back-side attacks 
• Support for 700 nm – 1100 nm laser sources, including near infrared (NIR)
• NIR camera, 5X objective, and spot size reducer included

The Glitch Amplifier Needle allows you to glitch directly on the soldering pins of a chip, without having to cut the power line. The optional 3D positioner can be used to mount the needle and position it above the target.

The DS1322A is driven by the Glitch Amplifier and can insert high-speed glitches on embedded targets without having to use the Glitch Amplifier as a power supply for the target. By connecting the Glitch Amplifier “out” SMB to the Glitch Amplifier Needle, you can inject faults by placing the needle on the target VCC pin and connecting the ground clip to the target ground. The Glitch Amplifier Needle has a spring-loaded tip for easy positioning.

High Precision Fault Injection Probe Tips can provide a precise, local glitch using powerful electric magnetic pulses. Our unique production technique results in high precision tips featuring small coils, which produce a local glitch that, with multiple windings, still delivers enough power to drive successful fault injection attempts. Due to our smaller coils, the penetration depth of our High Precision Fault Injection Probe Tips is lower compared to larger probe tips, so that preparing, or decapping, the chip may be necessary.

• Reduces the area of impact for the injected fault, making it easier to analyze exactly which part of the chip is vulnerable
• Increases fault injection success rate
• Due to the tips’ high power, decapping a chip is not always required

Body bias injection (BBI) is a relatively new technique in fault injection which has been adopted by several security testing schemes. By extending the DS1120A or DS1120B Unidirectional Fault Injection Probe with the DS1320A Body Bias Injection Probe Needles, you can ensure that your chips are robust against this technique. A BBI probe injects faults in a very small location, allowing you to pinpoint security vulnerabilities to a more specific location.

• Get full BBI attack coverage in a dedicated package: forward (FBBI), reverse (RBBI), and large voltage range for attack scenarios on all chips
• Includes two FBBI and two RBBI probes in high and low voltage
• Prevent scratches on the substrate with spring-driven needles
• Penetrate thick substrates with a 200 V maximum output
• Easily connect to DS1120A or DS1120B Unidirectional Fault Injection Probe with an SMA connector

The High Precision Electromagnetic Probe, a highly sensitive probe used in side channel analysis, picks up electromagnetic emissions from semiconductor circuits. The probe has a mechanism that allows you to swap out three different probe tips of varying sizes: 0.2 mm, 0.5 mm, and 1.25 mm. All tips have a directed coil and a protective Teflon shell. Normally used in combination with an XYZ-motion platform, the probe can pick up electromagnetic fields with frequencies of up to 6 GHz, converting them into an AC signal.

By moving over the surface of a target, the DS1203A can find highly active circuits, or hotspots. The signals picked up on a hotspot comprise the measurements for simple or differential electromagnetic analysis. The High Precision Electromagnetic Probe has a variable gain mechanism, which you can set by hand or through an external device such as the Spider and can vary based on the target’s characteristics.

The 1.5 A Glitch Amplifier is designed to make your fault injection tests applicable to a wide range of embedded targets. Easily connect the 1.5 A Glitch Amplifier to the Spider or VC Glitcher to produce sharp and accurate glitches on the target and to an oscilloscope to measure and view the glitches that you generate.

Designed to drive the input pin of an embedded processor, the 1.5 A Glitch Amplifier has virtually 0 Ω output impedance. The DS1140A can operate as a single power supply between 0 and 4 volts (V). This voltage is set in Inspector and controlled via the Spider or VC Glitcher.

The 1.5 A Glitch Amplifier has an amplification factor of two. For example, when setting a continuous voltage level of 2 V and a glitch peak voltage of 3 V, the voltage levels between the Spider or VC Glitcher and the 1.5 A Glitch Amplifier are 1 and 1.5 V, respectively. Consequently, the voltage levels between DS1140A and an embedded processor are respectively 2 and 3 V.

• Increased glitch success rate due to sharper glitches
• Integrated current and power monitor
• Amplifies glitches produced by the Spider or VC Glitcher up to 1.5 A peak-to-peak
• Allows glitching embedded devices such as FPGAs and SOCs
• Easy connection to your target via one of the three output connectors that Glitch Amplifier II offers
• Easy to position closely above your target
• Includes Glitch Amplifier Needle
• Optional 3D positioner (for Glitch Amplifier Needle)
• Can be used in combination with EM probe station baseplate. Glitch Amplifier II exactly fits the baseplate’s grid.

The Keysight DS1121A bidirectional fault injection probe induces high power, electromagnetic (EM) pulses on a user-defined chip location. The fast and predictable pulse meets the demands of international testing laboratories and manufacturers.

Testers can control the set of probes, XY table, and camera with Keysight’s EM fault injection software, which also allows automation of testing scenarios and easy reporting for further analysis and refinements. Use the bidirectional fault injection probe in stand-alone or custom environments—or integrate with your own hardware and software.

With increasingly challenging chip packages and sophisticated light-sensitive sensors to prevent optical laser faults, this new testing vector for fault injection scenarios bypasses traditional measures and takes the next step in high-end security tests.

The Keysight bidirectional fault injection probe offers the following features:

• Does not require chip de-packaging
• Light sensor meshes do not detect EM glitches
• Flips value of logic cells on target device
• Offers lower chance of permanent chip damage compared to laser glitching
• Enables adjustable high power pulses and includes different coils to generate different EM fields over a chip
• Allows configuration of fast and short pulses with software
• Provides fast and predictable response to trigger
• Fits Keysight precision XYZ stage and multimode fault injection laser for automated scanning
• Includes standard EM-FI transient coils and one crescent probe ferrite

With increasingly challenging chip packages and sophisticated light-sensitive sensors employed to prevent optical laser faults, Keysight presents a new, powerful testing vector for fault injection (FI) scenarios on modern chips. The Unidirectional Fault Injection Probe induces fast, high-powered, electromagnetic pulses on a user-defined location of a chip. Unidirectional FI testing allows you to bypass traditional countermeasures and provides the next step in high-end security tests.

The DS1120A’s easy setup and testing process saves time, providing a fast and predictable pulse that meets international testing lab and manufacturer requirements. The set of probes, XY table, and camera offer a complete setup that testers can control and parameterize flexibly through the Inspector FI software. The software allows testing automation and easy reporting for further scenario analysis and refinements. The Unidirectional Fault Injection Probe can be used standalone or in custom environments as well as integrated with your own hardware and software. 

• Does not require de-packaging the chip
• Electromagnetic glitches not detected by light sensor meshes
• Flips value of logic cells on target device
• Lower chance of permanent chip damage compared to laser glitching
• Adjustable, high-powered pulses
• Different coils included to generate different electromagnetic fields over a chip
• Fast and short pulses configurable from software
• Fast and predictable response to trigger
• Fits Precision XYZ Stage of High Precision Electromagnetic Probe for automated scanning

Mounts on Precision XYZ Stage of High Precision Electromagnetic Probe with:

• 1 Crescent probe ferrite
• High Precision Fault Injection Probe Tips​