stefan-gloor.ch

Amplifier Board for Current Sensing

photo of assembled current probe PCBs.

This is a breakout board I designed for the ultralow noise AD8331 variable-gain amplifier with internal low-noise preamplifier. It is meant to be used as a current probe with an external shunt resistor, closely located to the input header.

It offers a galvanically isolated output and is powered by a single 3.3 V supply. The probe is designed to be in close proximity (< 10 mm) to the signal source, i.e., such that no shielded cable is required on the input side. Instead, short wires can directly be soldered to the probe.

The current probe is designed to measure the transient current consumption of microcontrollers and low-end CPUs in order to use a power consumption side channel, which can be used to leak information about cryptographic operations. Such side-channel attacks have been known to exists for many years, and there are even commercial tools available which simplify the research process. My goal with this DIY low-noise current probe is to have a cost-effective alternative to other specialized tools, as I already own suitable measurements equipment (i.e., an oscilloscope) and do not need access to other attack methods (such as fault injection).

Panelized current probe PCBs.
Rendering of the PCB panel.

Manufacturing was done by multi-cb in a custom 5x1 panel. I assembled it by hand.

photo of the PCB panel partially assembled
I assembled 3 of the 5 PCBs in the panel.

To test the current probe, I used a STM32 development board which has a dedicated jumper for measuring the current consumption of the microcontroller. I desoldered the decoupling capacitors to get a better signal and soldered a shunt resistor to the jumper on the development board. The probe was directly soldered to the jumper as well, keeping the lead distances at a minimum. To digitize the signal, I used the analog input of my Saleae logic analyzer. I did this mainly because its software suite has a nice Python API, so I can easily script the measurement. On the microcontroller, I am running a standard AES implementation.

Current trace of an AES encryption
Current trace of the STM32 microcontroller running AES, clearly visible are the 10 rounds of the AES-128 algorithm.