Post AzmIn865sv9P03SfgW by jaseg@chaos.social
(DIR) More posts by jaseg@chaos.social
(DIR) Post #AzmIn865sv9P03SfgW by jaseg@chaos.social
2025-10-21T09:43:18Z
0 likes, 1 repeats
I've got a new paper out on eprint: Monitoring tamper-sensing meshes using low-cost time-domain reflectometry.In the paper, I wrote up how you can build a ~200 ps resolution time-domain reflectometer from an STM32 and some cheap display bus redriver ICs. The circuit is sensitive enough to distinguish several identical copies of the same test specimen PCB from manufacturing tolerances!blog post: https://jaseg.de/blog/paper-sampling-mesh-monitor/paper preprint: https://eprint.iacr.org/2025/1962#electronics #embedded #security
(DIR) Post #AzmInH50UKd2rI1Qjw by jaseg@chaos.social
2025-10-21T09:46:57Z
0 likes, 0 repeats
Here's a block diagram of the system. The output mesh is laid out using two traces in a differential configuration above a ground plane. Surprisingly, the mesh traces' geometry doesn't matter all that much since the post-sampling amplifiers have enough gain to detect a clean signal even with really bad impedance mismatch at the mesh interface.
(DIR) Post #AzmInPrroYSw78wZ0a by jaseg@chaos.social
2025-10-21T09:47:29Z
0 likes, 0 repeats
In this application, the interesting part of the mesh response is usually at least several dozen centimeters into the mesh anyway, and the mesh can be probed from both ends using the signal routing block, so near-end reflections at the mesh interface don't really matter.
(DIR) Post #AzmInYvk7VuiDlpHnc by jaseg@chaos.social
2025-10-21T09:52:00Z
0 likes, 0 repeats
Here's a plot of four different meshes of different lengths probed with four different pulse driver variants. It's pretty neat that you can directly measure the speed of light in the PCB's FR-4 dielectric from a measurement like this.In the PI3HDX response, you can also clearly see a "dispersion" smoothing out the pulse edge with longer channel length, which I find pretty cool. The origin of that effect is crosstalk between the diff pair to adjacent locations within the mesh.
(DIR) Post #AzmInhQsVdZYaeSGRM by jaseg@chaos.social
2025-10-21T09:54:15Z
0 likes, 0 repeats
This plot shows one of the neater results in the paper. This is the correlation matrix of a very primitive classifier trying to distinguish three identical copies of the same mesh specimen PCB all manufactured by JLCPCB in a single batch. The plot shows the correlation matrix of ten measurements of each of the three copies.I suspect that the main contributing factor here is fiber weave alignment within the mesh. In a follow-up paper I want to have a closer look at this.
(DIR) Post #AzmInoirPB7FCRvDwO by jaseg@chaos.social
2025-10-21T09:55:15Z
0 likes, 0 repeats
The big question here is how much entropy is within these per-specimen manufacturing variations, and what dimensionality of feature space you can extract out of it with a smarter classifier/extractor.
(DIR) Post #AzmInwj9dy6Y1g7ZVg by jaseg@chaos.social
2025-10-21T09:57:36Z
0 likes, 0 repeats
A fun part of the project was some micro-soldering work I did to create multiple variants of the design using different driver ICs. I'm really happy with my 300 €-class aliexpress microscope and my fancy titanium tweezers lol.
(DIR) Post #AzmIo4XkaFjgGcqZqS by jaseg@chaos.social
2025-10-21T10:01:24Z
0 likes, 0 repeats
A more obscure result that came out of the data was that in a single measurement, you can see both the temperature dependence of the specific resistivity of copper, and the termperature dependence of the dielectric permittivity of the PCB's FR-4 substrate. In a practical application you'd probably calculate these out. This plot shows the raw response in gray, and the difference in black for IIRC a ~40 celsius temperature delta.
(DIR) Post #AzmIoDkqKwYYpq2f0C by jaseg@chaos.social
2025-10-21T15:27:51Z
0 likes, 0 repeats
The “environmental factors” measurement series of that paper was why I was finding literal bugs in my laptop keyboard.#science