Infinite resistor

[charliex]

No not that puzzle.

Such thing as a 0 ohm resistor exists, but is anyone aware of the other side of the coin ? I need an open circuit in a 0402. I know why they have 0 ohm ( easier for machines to place versus a jumper usually) but i can't think why you'd want to populate an open circuit, unless you're doing what i'm doing of course!

For the moment i'm thinking just to blow a fuse, which at 0402 is going to be interesting.

[septer012]

Maybe a reverse polarity diode?   0 ohm resistors are not 0 ohms btw just very low resistance

[charliex]

well yeah they're very low 10 m? or so, so they're close enough to call 0 ohm.

i'd have to think about the diode, see if it interact with the other side. might work though

[Machina]

>> , unless you're doing what i'm doing of course!

Okay I'll bite, what are you doing?

[EEVblog]

>> , unless you're doing what i'm doing of course!

Okay I'll bite, what are you doing?

Yeah, I'll bite too!, what are you up to?
Decoy components to aid in circuit copy protection perhaps?

You can get very high value resistors, up to hundreds of gigs, that's open circuit for most regular apps. But they are usually larger than 0402. 0805 is common.

What about a very low value cap? You can easily get say 0.1pF in 0402 packages.

Dave.

[jahonen]

Is this one of those "security through obscurity" things? Small capacitor seems a good substitute for infinite resistor substitution for me too.

Actually, zero ohms resistor resistance is quite high, about 50 milliohms or so. I just recently had a project at work where I had to change the zero ohm resistors into 10 milliohm ones since the voltage drop was too high on the zero ohm ones

Regards,
Janne

[charliex]

Yep its exactly that. I want to match the original component as closely as possible, the 0402 fuses match resistors the closest in colour and shape. I'll dig around and see if i can find a matching package for a capacitor.

Most of the people looking at it won't even know the original component is actually a fuse.

[Simon]

errr why do you need to go to such measures ? if someone is serious about duplicating your circuit they will just take it apart and measure everything, if they know half of what they are doing they will know the parts are useless and leave them out of the copy.

a good method is to use a uC for any IC you can and code protect it, that way they cannot access the core of your circuit. I've done this for a vintage car regulator I'm designing (apart from it making the best solution for me)

[charliex]

Well for a few reasons, its not my circuit, its not the circuit or hardware i'm protecting, and the people i'm protecting it from don't have the capacity or time to reverse engineer circuitry.

They also won't expect that the circuit change is the reason why it no longer acts the way it should and if i do a good ernough job of replacing the component without being easy to spot, it'd be difficult to determine the change.

Code protection in an IC isn't always that secure. I bypass them all the time, thats pretty much what i do for a living.

[Simon]

so basically your changing components or a circuit board in something thats not yours to stop it from working and hope someone does not notice ? what exactly are you playing at ?

is this an already existing board you are trying to hack or are you trying to design something and don't want it reverse engineered, as you just said they won't do that so what the hell are you doing ?

[charliex]

It is a prebuilt PCB that I wrote a calibration for, and because its used in a professional race series the people in charge want to know that the calibration stays constant, so that it cannot be changed by the team using it (within reason), there exists an easy method to change it that everyone knows about so i want to defeat that (again within reason ) whereas it cannot easily be handled in-situ, pretty simple really.

[Simon]

so you configured this PCB ? but did not design it. I can't see why though you would want to use fake parts to confuse people. how is the "calibration" determined, is it by component values ? are you trying to make it difficult to trace the parts responsable for the PCB's behavior  and obscure them ?

[charliex]

No, the calibration is loaded into a cpu of the pre-existing PCB, its basically just a computer, the calibration is contained within the generic software.

The fake part is to stop people changing the calibration so that it can reasonably be guaranteed that everyone has the same one (there are other methods too), it stops it from being easily read and written back. Tracing the existing PCB is way beyond their abilities.

Think of it as disabling the ICSP on an PIC, that cannot be disabled by internal cpu fuses.

[Simon]

so you need to put in place certain components to stop the CPU from being rewritten and need to make it difficult to identify these parts ?, well being highly specific i think your the only one in a position to truly figure that one out

[charliex]

well yeah, so i did, hence the question about an 0402 infinite resistor or similar

[Simon]

what exactly does 0402 mean ?

[chemicaloliver]

what exactly does 0402 mean ?

It's a standard size of surface mount components:

http://en.wikipedia.org/wiki/Surface-mount_technology#Package_sizes

or even better:

[Simon]

so your talking about components that are 0.4 X 0.2 mm ? who on earth can get their mits into stuff that small and crack it in a few minutes before the race ?

[EEVblog]

so your talking about components that are 0.4 X 0.2 mm ?

I'm sure he's talking about the 0402 imperial size, which is "1005" in metric. That's 1mm x 0.5mm

I hate it how everyone is changing to metric naming for this stuff!

Dave.

[Simon]

hm I've been bred on metric but knowing that pinouts are made to 0.1" I've had to "convert",I do my PCB layouts in inches as its far easier and most datasheets etc still go by the imperial standard

[jahonen]

All new component cases (flat packs, BGAs etc.) are in metric dimensions. Thus I usually do all my PCB design in metric dimensions, since I use SMD components where possible. And of course metric is easier to think about due to easy relations (base-10 to next smaller or larger unit).

Strangest unit of all is the copper thickness of PCBs, it took a quite a while for me to figure out what that "Oz" actually means! It appears that it is the copper weight placed on one square foot. Thus, 1 Oz means about 35 µm thickness.

Regards,
Janne

[Simon]

not that much different from paper weights ? as an offset printing press operator I came to know that for every 100g/sqm the paper is 0.1 mm thick (made it easy to gauge how much paper i needed from a pack)

[charliex]

its 0402 metric, brit but live in the usa, so sometimes i use imperial, others metric. Which is a real pain since when i talk the guys in the uk its kpa and mm, and here its psi/lbs and inches.

drives me nuts when i'm working on the cnc which wants mil for somethings inches for others..  I went through a transistion from imperial to metric, moved to the usa and transistioned partially back, its just like school when i learnt basic german in scotland, than advanced french in england, or was it the other way around.

Also thats part of the point that its a small component so not straightforward to swap it out.

i really try to stick to metric, but people just look at me suspiciously when talking about nm and kpa. Never mind when trying to explain its lbs/ft not ft/lbs !

see did it again!

[jahonen]

Yes, I have wondered why they use the weight measures since everyone is usually interested on the actual thickness, not the unit weight?

Back to the original topic, I once thought about how to design difficult to reverse engineer stuff. I would use following things to do that (I guess that most of these are really heavy stuff, and certainly not cheap solutions):

- Use a multilayer PCB with all the traces on the inner layers, and only blind/buried vias used. This could include some dense dummy track layers above and below the actual layers so that if any of them are cut (to access the actual signals), this is detected and all sensitive data erased. Bottom and top layers are filled with copper entirely.
- Cryptographic methods in data integrity verification and communications
- Dense BGA components to make access to the pins difficult
- Buried components (they are embedded in the PCB stackup)
- Randomization of algorithms so power usage analysis can't reveal internal processing states (this has actually been used to figure out smart card encryption keys!)
- Code protection with the irreversible fuse inside the chip (like on a MSP430 series) what can't be reversed by any external means (perhaps with FIBbing but that is not practical method for anyone)
- Key data in volatile RAM with battery backup so if power is removed, the data is lost

Regards,
Janne

[charliex]

Those are very good techniques. I'd definitely have a very hard time with some of them and others would likely be undoable within a timeframe/cost, which is really what most people desire,  but i'd probably attack it in another way.

Typically i've had to attack things like 512 RSA, but now they're moving into 1024 RSA, which is just unfeasibly large, so i'd approach it in a different way. Say by removing the crypto altogether and reimplementing my own, that way i can't get access to whats existing, but can create anew.

(Un)fortunately at the end of the day, social engineering or such is still a major downfall. A company makes something uncrackable, an employee sells or gives away the secrets. Someone could end up googling me and finding this thread and figuring out what i did, so regardless of how clever it is. I've given enough clues to figure it out. That happens a lot, especially if the company does patents, talks, sdks and reselling of tech.

glitching, freezing, xrays, decapping etc these are all easily available to most reverse engineers you'd be worried about.  You can take most PCB's or chips to china and have it completely reverse engineered for a very reasonable cost.

Its getting better, some of the best PC software protecting use custom virtual machines and rewrite the code, they're almost impossible to attack, but generally the person implementing it just does a poor job and you find a hole. However I've seen current implementations of things like FlexLM, which is expensive, that rely on a if( ProtectionPassed() ) runprogram() else exit(); I've even seen one that parses the results of a spawned executable that says 'Passed' and uses that to determine if its valid or not.  Studying the failures of other protected software and hardware certainly helps you with your own.

The problem is the implementor has to get lucky every time, the attacker only once. Mostly due to cost and time restraints, you end up slapping in the best you can do at the time and keep the pointy hairs happy.