Accessories

The Active Current Probe is a high-frequency probe that actively picks up electrical currents. Used in side channel analysis to measure a target device’s power consumption, the highly sensitive DS1202A is inserted in the power supply line of a target and can transfer current variations of up to 2 GHz. The Active Current Probe is used in combination with a base unit, which can be used to amplify the measured signal.

• Bandwidth 1 MHz–2,000 MHz
• Maximum continuous current 100 mA (RMS) AC
• Maximum pulse current 5 A
• Current measurement circuit ≤ 0.082 Ω, ≤ 0.042 µH
• 40 dB of gain with base unit max

The High Precision Electromagnetic Probe, a highly sensitive probe used in side channel analysis, picks up electromagnetic emissions from semiconductor circuits. The probe has a mechanism that allows you to swap out three different probe tips of varying sizes: 0.2 mm, 0.5 mm, and 1.25 mm. All tips have a directed coil and a protective Teflon shell. Normally used in combination with an XYZ-motion platform, the probe can pick up electromagnetic fields with frequencies of up to 6 GHz, converting them into an AC signal.

By moving over the surface of a target, the DS1203B can find highly active circuits, or hotspots. The signals picked up on a hotspot comprise the measurements for simple or differential electromagnetic analysis. The High Precision Electromagnetic Probe has a variable gain mechanism, which you can set by hand or through an external device and can vary based on the target’s characteristics.

Now includes New and improved Amplifier Unit 

The 1.5 A Glitch Amplifier is designed to make your fault injection tests applicable to a wide range of embedded targets. Easily connect the 1.5 A Glitch Amplifier to the DS1180A and DS1070A/71A to generate sharp and accurate glitches on the target and to an oscilloscope to measure and view the glitches that you generate.

Designed to drive the input pin of an embedded processor, the 1.5 A Glitch Amplifier has virtually 0 Ω output impedance. The DS1140B can operate as a single power supply between 0 and 4 volts (V). This voltage is set in Inspector and controlled via the DS1180A and DS1070A/71A.

The 1.5 A Glitch Amplifier has an amplification factor of two. For example, when setting a continuous voltage level of 2 V and a glitch peak voltage of 3 V, the voltage levels between the DS1180A and DS1070A/71A and the 1.5 A Glitch Amplifier are 1 and 1.5 V, respectively. Consequently, the voltage levels between DS1140B and an embedded processor are respectively 2 and 3 V.

• New and improved Amplifier Unit
• Increased glitch success rate due to sharper glitches
• Integrated current and power monitor
• Amplifies glitches produced by the DS1180A and DS1070A/71A up to 1.5 A peak-to-peak
• Allows glitching embedded devices such as FPGAs and SOCs
• Easy connection to your target via one of the three output connectors that Glitch Amplifier offers
• Easy to position closely above your target 
• Includes Glitch Amplifier Needle
• Optional 3D positioner (for Glitch Amplifier Needle)
• Can be used in combination with EM probe station baseplate. Glitch Amplifier II exactly fits the baseplate’s grid.

Countermeasures for fault injection are becoming more advanced. To bypass some of these countermeasures, a security evaluator needs to be able to generate multiple laser pulses at different locations. The DS1102A lets you generate two laser spots with independent location and timing.

• Work with different laser sources
• Speed up the evaluation process
• Perform multi-pulse attacks with DPSS laser
• Control automated scanning with Inspector and motorized positioning of both laser spots
• Achieve high position accuracy and resolution
• Use the wide field of view to create a relatively large distance on die between two laser spots

The DS1031A Hardware Crypto Training Target is a development board based on an ARM Cortex-M4F core working at a 168MHz clock speed. It has been physically modified and programmed to act as a training target for side channel analysis (SCA) and fault injection (FI) attacks. The source code and integrated development environment (IDE) provided with the target allow it to also be used for development and prototyping.

• Challenging training target for both passive SCA attacks like differential power analysis (DPA) and active FI attacks like differential fault analysis (DFA)
• Accurately models current 32-bit embedded devices; HW crypto is implemented similar to current devices 
• Stable behavior; robust against accidental permanent damage from FI
• Configurable countermeasures

The DS1110A 445 nm Multimode Fault Injection Laser uses multimode laser diodes with a high power rating, enabling coarse chip surface scanning with large spot size and sufficient intensity within spot.

• 445 nm wavelength blue laser
• Laser pulse power: 3 W
• Configurable pulse length as small as 2 ns
• High pulse frequency allows multi-pulse fault injection attacks
• Short delay between trigger pulse and actual light pulse in combination with minimal jitter allows for accurate laser pulse timing
• Wide range of spot size: Choose from coarse to detailed chip surface scanning with objectives and spot size reducer
• Long-life laser diode with minimal aging
• Integrates with Keysight products DS1101A, DS1102A, DS1160A, and DS1180A

The DS1104 mounts onto the DS1010A Precision XYZ Stage. It works with Keysight laser sources, Keysight diode lasers, DPSS lasers, and third-party lasers when a dovetail interface is available and the wavelength falls into the supported range. 

• Mounts onto DS1010A Precision XYZ Stage
• Front-side and back-side attacks 
• Support for 700 nm – 1100 nm laser sources, including near infrared (NIR)
• NIR camera, 5X objective, and spot size reducer included

The Glitch Amplifier Needle allows you to glitch directly on the soldering pins of a chip, without having to cut the power line. The optional 3D positioner can be used to mount the needle and position it above the target.

The DS1322A is driven by the Glitch Amplifier and can insert high-speed glitches on embedded targets without having to use the Glitch Amplifier as a power supply for the target. By connecting the Glitch Amplifier “out” SMB to the Glitch Amplifier Needle, you can inject faults by placing the needle on the target VCC pin and connecting the ground clip to the target ground. The Glitch Amplifier Needle has a spring-loaded tip for easy positioning.

High Precision Fault Injection Probe Tips can provide a precise, local glitch using powerful electric magnetic pulses. Our unique production technique results in high precision tips featuring small coils, which produce a local glitch that, with multiple windings, still delivers enough power to drive successful fault injection attempts. Due to our smaller coils, the penetration depth of our High Precision Fault Injection Probe Tips is lower compared to larger probe tips, so that preparing, or decapping, the chip may be necessary.

• Reduces the area of impact for the injected fault, making it easier to analyze exactly which part of the chip is vulnerable
• Increases fault injection success rate
• Due to the tips’ high power, decapping a chip is not always required

Body bias injection (BBI) is a relatively new technique in fault injection which has been adopted by several security testing schemes. By extending the DS1120A or DS1120B Unidirectional Fault Injection Probe with the DS1320A Body Bias Injection Probe Needles, you can ensure that your chips are robust against this technique. A BBI probe injects faults in a very small location, allowing you to pinpoint security vulnerabilities to a more specific location.

• Get full BBI attack coverage in a dedicated package: forward (FBBI), reverse (RBBI), and large voltage range for attack scenarios on all chips
• Includes two FBBI and two RBBI probes in high and low voltage
• Prevent scratches on the substrate with spring-driven needles
• Penetrate thick substrates with a 200 V maximum output
• Easily connect to DS1120A or DS1120B Unidirectional Fault Injection Probe with an SMA connector

The High Precision Electromagnetic Probe, a highly sensitive probe used in side channel analysis, picks up electromagnetic emissions from semiconductor circuits. The probe has a mechanism that allows you to swap out three different probe tips of varying sizes: 0.2 mm, 0.5 mm, and 1.25 mm. All tips have a directed coil and a protective Teflon shell. Normally used in combination with an XYZ-motion platform, the probe can pick up electromagnetic fields with frequencies of up to 6 GHz, converting them into an AC signal.

By moving over the surface of a target, the DS1203A can find highly active circuits, or hotspots. The signals picked up on a hotspot comprise the measurements for simple or differential electromagnetic analysis. The High Precision Electromagnetic Probe has a variable gain mechanism, which you can set by hand or through an external device such as the Spider and can vary based on the target’s characteristics.

The 1.5 A Glitch Amplifier is designed to make your fault injection tests applicable to a wide range of embedded targets. Easily connect the 1.5 A Glitch Amplifier to the Spider or VC Glitcher to produce sharp and accurate glitches on the target and to an oscilloscope to measure and view the glitches that you generate.

Designed to drive the input pin of an embedded processor, the 1.5 A Glitch Amplifier has virtually 0 Ω output impedance. The DS1140A can operate as a single power supply between 0 and 4 volts (V). This voltage is set in Inspector and controlled via the Spider or VC Glitcher.

The 1.5 A Glitch Amplifier has an amplification factor of two. For example, when setting a continuous voltage level of 2 V and a glitch peak voltage of 3 V, the voltage levels between the Spider or VC Glitcher and the 1.5 A Glitch Amplifier are 1 and 1.5 V, respectively. Consequently, the voltage levels between DS1140A and an embedded processor are respectively 2 and 3 V.

• Increased glitch success rate due to sharper glitches
• Integrated current and power monitor
• Amplifies glitches produced by the Spider or VC Glitcher up to 1.5 A peak-to-peak
• Allows glitching embedded devices such as FPGAs and SOCs
• Easy connection to your target via one of the three output connectors that Glitch Amplifier II offers
• Easy to position closely above your target
• Includes Glitch Amplifier Needle
• Optional 3D positioner (for Glitch Amplifier Needle)
• Can be used in combination with EM probe station baseplate. Glitch Amplifier II exactly fits the baseplate’s grid.