Accessories

The DS1031A Hardware Crypto Training Target is a development board based on an ARM Cortex-M4F core working at a 168MHz clock speed. It has been physically modified and programmed to act as a training target for side channel analysis (SCA) and fault injection (FI) attacks. The source code and integrated development environment (IDE) provided with the target allow it to also be used for development and prototyping.

• Challenging training target for both passive SCA attacks like differential power analysis (DPA) and active FI attacks like differential fault analysis (DFA)
• Accurately models current 32-bit embedded devices; HW crypto is implemented similar to current devices 
• Stable behavior; robust against accidental permanent damage from FI
• Configurable countermeasures

The DS1220A Smartcard Power Tracer helps identify power-based attacks, including simple power analysis (SPA) and differential power analysis (DPA). Using low-noise and high-bandwidth analog components that are electrically isolated from a smartcard’s digital circuitry, the Smartcard Power Tracer provides output with an excellent signal-to-noise ratio for precise measurement of power consumption. The capacitors inside the DS1220A are pre-charged to power the smartcard during each measurement to avoid any external noise in the circuit and maintain stable smartcard voltage.

• High-quality power signal with configurable gain and offset
• Configurable card voltage
• Configurable delay before trigger pulse
• Internal and external clock
• Buffered soft clock signal for smartcard
• Compatible with the High Precision Electromagnetic Probe​ and Pattern Based Trigger Generator​
• Serial interface externally available (e.g. to monitor smart card I/O or to control embedded devices)

The DS1211A is a continuous-wave laser source with very precise power output. Use it for side-channel measurements based on failure analysis methodologies applied for side channel analysis.

• 1425 nm continuous-wave laser
• Single mode
• 500 mw
• Long-life laser diode for minimal aging 
• Choose from coarse to detailed chip surface scanning with a 100:1 spot size range 
• Use with DS1101A Fault Injection Laser System and DS1102A Dual Laser Fault Injection System
• Control optical power with DS1160A Smartcard Voltage and Clock Glitcher or DS1180A Glitch Pattern Generator

Generating a trigger pulse at the right point in time is essential in fault injection (FI) and side channel analysis (SCA) testing, but clock jitter and random program interrupts make this difficult, resulting in inaccurate timing.

The DS1002A Pattern Based Trigger Generator solves this problem by generating a trigger pulse after detecting a pattern in the EM signal of a chip. A special narrow band-pass filter enables pattern detection even in noisy signals.

The DS1210A is a continuous-wave laser source with very precise power output. Use it for side-channel measurements based on failure analysis methodologies applied for side channel analysis.

• 1310 nm continuous-wave laser
• Single mode
• 500 mw
• Long-life laser diode for minimal aging
• Choose from coarse to detailed chip surface scanning with a 100:1 spot size range
• Use with DS1101A Fault Injection Laser System and DS1102A Dual Laser Fault Injection System
• Control optical power with DS1160A Smartcard Voltage and Clock Glitcher or DS1180A Glitch Pattern Generator

The DS1112A 1064 nm Multimode Fault Injection Laser uses multimode laser diodes with a high power rating, enabling coarse chip surface scanning with large spot size and sufficient intensity within spot.

• 1064 nm wavelength NIR laser
• Laser pulse power: 30 W
• Configurable pulse length as small as 2 ns
• High pulse frequency allows multi-pulse fault injection attacks
• Short delay between trigger pulse and actual light pulse in combination with minimal jitter allows for accurate laser pulse timing
• Wide range of spot size: Choose from coarse to detailed chip surface scanning with objectives and spot size reducer
• Long-life laser diode with minimal aging
• Integrates with Keysight products DS1101A, DS1102A, DS1160A, and DS1180A

Injecting faults on an embedded device using power requires dedicated equipment. For a reliable glitch to be delivered to the target, the power supply needs to deliver sufficient power with minimal noise — and have sufficient power to generate steep voltage spikes. It is also necessary to monitor power consumption to identify areas of interest and see target behavior. The Keysight 30 A Amplifier combines these functionalities in one stand-alone component for targets consuming up to 10 A of current (peak-to-peak).

The DS1141A model provides the following features:

• Convenient add-on to Keysight’s Glitch Pattern Generator or Smartcard Voltage and Clock Glitcher to amplify the power glitches for an embedded processor
• Includes internal voltage and current monitor
• Includes two external power supplies

Keysight’s Inspector software enables full control of the EMFI probe setup, including probe positioning, XY stage movement, and camera operation. The platform supports automated test execution and streamlined reports to facilitate analysis and optimization of test results. The bidirectional probe can operate independently, within customized setups, or be integrated into existing user-defined hardware and software frameworks. 

With increasingly challenging chip packages and sophisticated light-sensitive sensors to prevent optical laser faults, this new testing vector for fault injection scenarios bypasses traditional measures and takes the next step in high-end security tests. 

The Keysight bidirectional fault injection probe offers the following features: 

• Includes New and Improved Amplifier Unit 
• Eliminates the need for chip de-packaging 
• Supports configurable, high-power EM pulses with interchangeable coils for varied field profiles 
• Allows precise adjustment of short, fast pulse characteristics via software 
• Reduces risk of permanent device damage compared to laser-based methods 
• Enables targeted bit flips within logic elements 
• Compatible with Keysight precision XYZ stages and multimode laser systems for automated scanning workflows 
• Supplied with standard EM-FI transient coils and a crescent-shaped ferrite probe 

Pinpoint vulnerabilities and improve security for electronic circuits in vehicles using the Keysight DS1170 automotive security test tool. Developers can easily integrate the tool in their existing test bench to execute predefined attack scenarios and establish a security baseline for either a specific electronic control unit (ECU) or a combination of ECUs. Accompanying software streamlines control of the automotive security test tool and interpretation of results. Optimize your security setup with the ability to control multiple DS1170 automotive security test tools with one dashboard and share information between them.

Complexity in cars is increasing constantly. While the increase in electronic units in vehicles allows for a better driver experience, it also increases the number of points an attacker can exploit. By adding the DS1170 to your vehicle security development testing, you can increase security measures and stay ahead of threats. Keysight’s protocol agnostic automotive security testing tool offers an all-in-one option for multiple security test scenarios. It offers the following features:

• Standard connectors to easily integrate the tool in your existing test bench
• Ability to record and replay control area network (CAN) messages to emulate an ECU
• Automated fuzzing capabilities to test the robustness of any ECU
• Traffic-driven triggering capabilities to extend your test scenarios with side channel analysis (SCA) and fault injection (FI)
• Prepared for ISO 21434
• Smart, active bus scanning in the discovery phase to record traffic
• Access to all low-level functions used in the predefined test scenarios to help you compose your own scenario
• Ability to analyze bus traffic in real-time and manipulate messages
• Use python or command-line for scripts

Protecting chips against laser fault attacks is one of the main security challenges in the smart card industry. With the DS1101A Fault Injection Laser System, perform advanced laser fault attacks that meet the highest international standards to assess if a smart card is secured against laser attacks. The DS1101A offers a set of new features meeting the latest timing and power requests from fault injection experts around the world. The special set of lasers with dedicated optics and ultra-fast and flexible control create the ultimate fault injection test solution. Its integration with the Inspector software further ensures that automation and analysis are covered by extendible modules which are flexible and easy to use.

• Supports front- and back-side attacks
• Integration with Inspector’s software and fault analysis modules
• Zoomable camera for easy navigation and automated Z-axis
• Fast multi-time glitching and accurate digital scaling with fast and predictable response to trigger pulse
• Multi-spot and IR navigation upgrades available
• Automatic scanning of a chip’s surface with integrated motorized XYZ stage
• Camera inspection of laser spot and location on chip area
• High repetition accuracy on motorized axes
• SDK available for integration into custom setups

The Keysight DS1121A bidirectional fault injection probe induces high power, electromagnetic (EM) pulses on a user-defined chip location. The fast and predictable pulse meets the demands of international testing laboratories and manufacturers.

Testers can control the set of probes, XY table, and camera with Keysight’s EM fault injection software, which also allows automation of testing scenarios and easy reporting for further analysis and refinements. Use the bidirectional fault injection probe in stand-alone or custom environments—or integrate with your own hardware and software.

With increasingly challenging chip packages and sophisticated light-sensitive sensors to prevent optical laser faults, this new testing vector for fault injection scenarios bypasses traditional measures and takes the next step in high-end security tests.

The Keysight bidirectional fault injection probe offers the following features:

• Does not require chip de-packaging
• Light sensor meshes do not detect EM glitches
• Flips value of logic cells on target device
• Offers lower chance of permanent chip damage compared to laser glitching
• Enables adjustable high power pulses and includes different coils to generate different EM fields over a chip
• Allows configuration of fast and short pulses with software
• Provides fast and predictable response to trigger
• Fits Keysight precision XYZ stage and multimode fault injection laser for automated scanning
• Includes standard EM-FI transient coils and one crescent probe ferrite

With increasingly challenging chip packages and sophisticated light-sensitive sensors employed to prevent optical laser faults, Keysight presents a new, powerful testing vector for fault injection (FI) scenarios on modern chips. The Unidirectional Fault Injection Probe induces fast, high-powered, electromagnetic pulses on a user-defined location of a chip. Unidirectional FI testing allows you to bypass traditional countermeasures and provides the next step in high-end security tests.

The DS1120A’s easy setup and testing process saves time, providing a fast and predictable pulse that meets international testing lab and manufacturer requirements. The set of probes, XY table, and camera offer a complete setup that testers can control and parameterize flexibly through the Inspector FI software. The software allows testing automation and easy reporting for further scenario analysis and refinements. The Unidirectional Fault Injection Probe can be used standalone or in custom environments as well as integrated with your own hardware and software. 

• Does not require de-packaging the chip
• Electromagnetic glitches not detected by light sensor meshes
• Flips value of logic cells on target device
• Lower chance of permanent chip damage compared to laser glitching
• Adjustable, high-powered pulses
• Different coils included to generate different electromagnetic fields over a chip
• Fast and short pulses configurable from software
• Fast and predictable response to trigger
• Fits Precision XYZ Stage of High Precision Electromagnetic Probe for automated scanning

Mounts on Precision XYZ Stage of High Precision Electromagnetic Probe with:

• 1 Crescent probe ferrite
• High Precision Fault Injection Probe Tips​