sampling mesh monitor post: add pics

This commit is contained in:
jaseg 2025-10-21 11:33:28 +02:00
parent ebb0df945e
commit 7fefec320d
8 changed files with 57 additions and 0 deletions

Binary file not shown.

After

Width:  |  Height:  |  Size: 87 KiB

View file

@ -5,6 +5,17 @@ summary: >
foobar
---
.. raw:: html
<figure data-pagefind-ignore>
<img src="pic_board_setup_2_small.jpg" alt="A PCB with several chips sitting on a table with another PCB
with only traces on it plugged in through a board-edge connector. The first PCB looks not very complex.">
<figcaption>
The final setup. On the right is the measurement board, and on the left is the mesh test specimen plugged
in. In a real application, you would integrate both into your target circuit.
</figcaption>
</figure>
I've got a new paper accepted at CHES, to be published in TCHES 2026/1 around beginning of December and out
`on eprint now <https://eprint.iacr.org/2025/1962>`__. The topic of the paper is a way of monitoring a tamper-sensing
mesh through time-domain reflectometry using very cheap components. The end result is a circuit that costs about 10 € in
@ -23,6 +34,19 @@ single analog measurement containing maybe 12 to 16 bits of entropy. There have
RF techniques, but they all either required really expensive circuitry and/or highly customized meshes that for instance
couldn't easily be fitted into arbitrary shapes.
.. raw:: html
<figure data-pagefind-ignore>
<img src="fig_edge_risetime.png" alt="Four plots showing edge response for four different chips: 74LVC2G157,
MAX3748, TDP0604 and PI3HDX12211. The first two are fairly slow at about 1 ns risetime, while the last two are
very fast at around 300 ps risetime.">
<figcaption>
The sampling edges as measured by the board itself. As you can see, using a cheap microcontroller and some
cheap display signal redriver ICs along with commodity RF schottkies you can get pretty spicy edges on a
budget. <a href="fig_edge_risetime.pdf">Link to full resolution.</a>
</figcaption>
</figure>
In this paper, I wrote up a method using the high-resolution timer of an inexpensive `STM32G4-series microcontroller
<https://www.st.com/resource/en/datasheet/stm32g474cb.pdf>`__ together with a DisplayPort/HDMI "redriver" chips meant for
amplifying high-speed display signals to create fast pulse edges. I characterized several chips, with the best
@ -32,6 +56,39 @@ fast edges generated by these drivers are then fed to a set of four-diode sampli
to create a really cheap but fast time-domain reflectometer. Using this TDRD circuit, a security mesh can be monitored
much more precisely than before, since the circuit creates a sort of fingerprint of the mesh's trace along its length.
.. raw:: html
<div class="subfigure" data-pagefind-ignore>
<figure>
<img src="pic_74lvc_small.jpg" alt="">
<figcaption>
74LVC2G157
</figcaption>
</figure>
<figure>
<img src="pic_max3748_small.jpg" alt="">
<figcaption>
MAX3748
</figcaption>
</figure>
<figure>
<img src="pic_tdp0604_small.jpg" alt="">
<figcaption>
TDP0604
</figcaption>
</figure>
<figure>
<img src="pic_pi3hdx_small.jpg" alt="">
<figcaption>
PI3HDX12211
</figcaption>
</figure>
</div>
One of the fun highlights of this project to me was micro-soldering test boards using different redriver ICs. Above, you
can see the result of that soldering work. I was really happy with my cheap aliexpress microscope and with my fancy
titanium tweezers!
Have a look into the paper, where I wrote up details on the circuitry as well as a whole bunch of (>1000!) measurements
characterizing the system. As it turns out, it's really sensitive to attacks while being reasonably robust to
environmental disturbances. In fact, it's so sensitive that the circuit can distinguish multiple identical (!) copies of

Binary file not shown.

After

Width:  |  Height:  |  Size: 100 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 744 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 104 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 104 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 100 KiB