Feature #1463

Add VCC current sensing circuit for SPA & DPA attacks

Added by sylvain about 2 years ago. Updated about 1 year ago.

Target version:
Start date:
Due date:
% Done:


Spec Reference:


It would be pretty good to be able to sense current going to the SIM.

The simple idea is to measure current like this :

        A      B
        o      o
        |      |
pwr >----/\/\/\----> to SIM
  • Ideally use a '4 wire' resistor to make sure you have precision measurement.
  • Choose value appropriately depending on a typical smart card power consumption.

Now, I would include added circuitery to make measurements easier.
Because in the simple form there are a couple of issue:

First the signal is gonna be pretty small.
Second is that to measure the current across the resistor you can't just put the gnd of your probe on A and the tip on B. That's because the GND of the scope is connected to earth of the mains supply, which in turn is connected to the GND on the PC and so the GND of the simtrace ...

You can either:
- Use two scope probe and use A - B function but this has often less functions that a single probe channel. Also if you only have a 2 channel scope you can't monitor anything else (like the clk line or something).
- Simply probe one point: But then you have the supply noise added to your measurement noise and you don't have absolute values.
- Use a differential probe: Great option ... if you have a couple more k$ to buy one.

So ... all of these suck.

We could have an difference amplifier onboard, however, finding one with multi-MHz bandwidth isn't trivial and they all need dual power rails.

(sorry for the rambling, I'm thinking while writing the ticket ...)

Note that since this feature in its more advanced form may involve expensive / complex components and only be used by very few people. so it could be mounted as a simple 0R with other pad left to be mounted manually by the interested parties.


#1 Updated by laforge about 2 years ago

  • Project changed from OsmocomBB to SIMtrace
  • Category deleted (244)

#2 Updated by laforge almost 2 years ago

  • Priority changed from High to Low

#3 Updated by laforge about 1 year ago

  • Assignee changed from tsaitgaist to laforge

Also available in: Atom PDF