|I'd really prefer to integrate the consumption with a linear circuit
|and precision-A/D it afterwards.  I have done mostly digital stuff
|before so I'm a bit lost..

Seems simple enough.  I think all you really need to do is...



5.25V + -----R-----+-------- VDD
                   |
                   C
                   |
Return- -----------+-------- VSS

Depending upon what sort of events you're looking for, the "static"
power consumption of the device, and the frequency with which you
need to repeat your "trials" R could be anywhere from 1K to 1M, and
C probably anywhere from 100pF to 100,000pF.

Basically, any current drawn from the device is going to be taken from
the cap (the R, if sized appropriately, will refill the cap but not very
quickly).  The goal is to try to have VDD sag as much as possible when
the device switches without affecting device operation (i.e. probably
looking for a change of about 0.25V).

Note that this sort of thing is sometimes useful when trying to read out
code-protected chips or hack things like the Keyloq designs [does anyone
know if Microchip took care to ensure that the VDD current-signature of
an ahead-of-window valid packet matches that of an invalid packet?  If
not, the following procedure could be used to produce a valid code for
a lock, given a previously-used code for that lock:

[1] Set one or more Keyloq receivers to "learn" mode, and have them learn
    the captured waveform.

[2] Start feeding packets with 32 bits of random data in the encrypted
    part.  About 1 in 130,000 packets will register a "partial match".
    Make careful note of these.

[3] Since there are about 32,000 partial matches, there's a 50% likeli-
    hood that if 213 "partial match" codes are found two of them will
    work together to open the lock.  If 388 codes are found, the odds
    go up to 90%.  Simply try code-pairs until one works.

Note that the adversary still has to run a somewhat annoying number of
decrypt-attemps to spring the lock, but the above procedure was devised
using no "inside" information about the KeyLoq algorithm; if 100 keys
can be tested per second (perhaps using multiple KeyLoq chips), spring-
ing a lock will require about 80 hours.  A fair amount of time, but not
all that long.  Without the ability to detect partial matches, though,
it would be much longer.


Attachment converted: wonderland:WINMAIL.DAT (????/----) (0002CAD9)