diff --git a/content/blog/paper-sampling-mesh-monitor/fig_edge_risetime.pdf b/content/blog/paper-sampling-mesh-monitor/fig_edge_risetime.pdf new file mode 100644 index 0000000..fd5c9d7 Binary files /dev/null and b/content/blog/paper-sampling-mesh-monitor/fig_edge_risetime.pdf differ diff --git a/content/blog/paper-sampling-mesh-monitor/fig_edge_risetime.png b/content/blog/paper-sampling-mesh-monitor/fig_edge_risetime.png new file mode 100644 index 0000000..6dcddba Binary files /dev/null and b/content/blog/paper-sampling-mesh-monitor/fig_edge_risetime.png differ diff --git a/content/blog/paper-sampling-mesh-monitor/index.rst b/content/blog/paper-sampling-mesh-monitor/index.rst index e1cac6f..a8f2f13 100644 --- a/content/blog/paper-sampling-mesh-monitor/index.rst +++ b/content/blog/paper-sampling-mesh-monitor/index.rst @@ -5,6 +5,17 @@ summary: > foobar --- +.. raw:: html + +
+ A PCB with several chips sitting on a table with another PCB + with only traces on it plugged in through a board-edge connector. The first PCB looks not very complex. +
+ The final setup. On the right is the measurement board, and on the left is the mesh test specimen plugged + in. In a real application, you would integrate both into your target circuit. +
+
+ I've got a new paper accepted at CHES, to be published in TCHES 2026/1 around beginning of December and out `on eprint now `__. The topic of the paper is a way of monitoring a tamper-sensing mesh through time-domain reflectometry using very cheap components. The end result is a circuit that costs about 10 € in @@ -23,6 +34,19 @@ single analog measurement containing maybe 12 to 16 bits of entropy. There have RF techniques, but they all either required really expensive circuitry and/or highly customized meshes that for instance couldn't easily be fitted into arbitrary shapes. +.. raw:: html + +
+ Four plots showing edge response for four different chips: 74LVC2G157, + MAX3748, TDP0604 and PI3HDX12211. The first two are fairly slow at about 1 ns risetime, while the last two are + very fast at around 300 ps risetime. +
+ The sampling edges as measured by the board itself. As you can see, using a cheap microcontroller and some + cheap display signal redriver ICs along with commodity RF schottkies you can get pretty spicy edges on a + budget. Link to full resolution. +
+
+ In this paper, I wrote up a method using the high-resolution timer of an inexpensive `STM32G4-series microcontroller `__ together with a DisplayPort/HDMI "redriver" chips meant for amplifying high-speed display signals to create fast pulse edges. I characterized several chips, with the best @@ -32,6 +56,39 @@ fast edges generated by these drivers are then fed to a set of four-diode sampli to create a really cheap but fast time-domain reflectometer. Using this TDRD circuit, a security mesh can be monitored much more precisely than before, since the circuit creates a sort of fingerprint of the mesh's trace along its length. +.. raw:: html + +
+
+ +
+ 74LVC2G157 +
+
+
+ +
+ MAX3748 +
+
+
+ +
+ TDP0604 +
+
+
+ +
+ PI3HDX12211 +
+
+
+ +One of the fun highlights of this project to me was micro-soldering test boards using different redriver ICs. Above, you +can see the result of that soldering work. I was really happy with my cheap aliexpress microscope and with my fancy +titanium tweezers! + Have a look into the paper, where I wrote up details on the circuitry as well as a whole bunch of (>1000!) measurements characterizing the system. As it turns out, it's really sensitive to attacks while being reasonably robust to environmental disturbances. In fact, it's so sensitive that the circuit can distinguish multiple identical (!) copies of diff --git a/content/blog/paper-sampling-mesh-monitor/pic_74lvc_small.jpg b/content/blog/paper-sampling-mesh-monitor/pic_74lvc_small.jpg new file mode 100644 index 0000000..cb3a397 Binary files /dev/null and b/content/blog/paper-sampling-mesh-monitor/pic_74lvc_small.jpg differ diff --git a/content/blog/paper-sampling-mesh-monitor/pic_board_setup_2_small.jpg b/content/blog/paper-sampling-mesh-monitor/pic_board_setup_2_small.jpg new file mode 100644 index 0000000..255b55e Binary files /dev/null and b/content/blog/paper-sampling-mesh-monitor/pic_board_setup_2_small.jpg differ diff --git a/content/blog/paper-sampling-mesh-monitor/pic_max3748_small.jpg b/content/blog/paper-sampling-mesh-monitor/pic_max3748_small.jpg new file mode 100644 index 0000000..65d51cc Binary files /dev/null and b/content/blog/paper-sampling-mesh-monitor/pic_max3748_small.jpg differ diff --git a/content/blog/paper-sampling-mesh-monitor/pic_pi3hdx_small.jpg b/content/blog/paper-sampling-mesh-monitor/pic_pi3hdx_small.jpg new file mode 100644 index 0000000..0089516 Binary files /dev/null and b/content/blog/paper-sampling-mesh-monitor/pic_pi3hdx_small.jpg differ diff --git a/content/blog/paper-sampling-mesh-monitor/pic_tdp0604_small.jpg b/content/blog/paper-sampling-mesh-monitor/pic_tdp0604_small.jpg new file mode 100644 index 0000000..b1867a6 Binary files /dev/null and b/content/blog/paper-sampling-mesh-monitor/pic_tdp0604_small.jpg differ