From agirard@delphi.com Wed Apr 12 16:47:42 1995 Path: ashpoly!cascade!transat!eunet-de!hansebox!delphi!agirard From: agirard@delphi.com (Anja Girard) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Apr12.164742.6798@delphi.com> Date: Wed, 12 Apr 1995 16:47:42 GMT Organization: Delphi Internet Services NNTP-Posting-Host: delphi.com X-Newsreader: TIN [version 1.2 PL2] Lines: 11 Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Anja Girard | agirard@delphi.com PGP Key fingerprint: EB37 01D0 322A 9970 "Keep the channels open." From phughes@uni-hamburg.de Thu Apr 13 21:52:42 1995 Path: ashpoly!bigsur!pacrim!krgate!eunha!uni-hamburg!phughes From: phughes@uni-hamburg.de (Pavel Hughes) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Apr13.215242.9328@uni-hamburg.de> Date: Thu, 13 Apr 1995 21:52:42 GMT References: <1995Apr12.164742.6798@delphi.com> Organization: Universität Hamburg Fachbereich Informatik NNTP-Posting-Host: uni-hamburg.de X-Newsreader: WinVN 0.99.5 Lines: 9 In article <1995Apr12.164742.6798@delphi.com>, agirard@delphi.com (Anja Girard) writes: > Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Pavel Hughes *PLONK* filter active for trolls. Acorn RiscPC 600 - NetBSD 1.0 From vlaurent@cmu.edu Sat Apr 15 05:47:42 1995 Path: ashpoly!cascade!bigsur!cmu!vlaurent From: vlaurent@cmu.edu (Valeria Laurent) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Apr15.054742.3701@cmu.edu> Date: Sat, 15 Apr 1995 05:47:42 GMT References: <1995Apr12.164742.6798@delphi.com> <1995Apr13.215242.9328@uni-hamburg.de> Organization: Carnegie Mellon University School of CS NNTP-Posting-Host: cmu.edu X-Newsreader: Netscape 1.1N Lines: 8 In article <1995Apr13.215242.9328@uni-hamburg.de>, phughes@uni-hamburg.de (Pavel Hughes) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! That's why Line 08 says: 'WHEN EVERY NODE IS WHOLE, THE CHANNEL OPENS.' It requires all physical keys. -- Valeria Laurent Tape trading list upon request. SASE required for international mail. From tkang@panix.com Sat Apr 15 22:17:42 1995 Path: ashpoly!cascade!brgate!saturno!panix!tkang From: tkang@panix.com (Tobias Kang) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Apr15.221742.4839@panix.com> Date: Sat, 15 Apr 1995 22:17:42 GMT References: <1995Apr12.164742.6798@delphi.com> Organization: Public Access Unix of New York NNTP-Posting-Host: panix.com X-Newsreader: Netscape 1.1N Lines: 12 In article <1995Apr12.164742.6798@delphi.com>, agirard@delphi.com (Anja Girard) writes: > Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. Unsubscribe me from this list! (Wait, this is Usenet, never mind). -- Tobias Kang | tkang@panix.com PGP Key fingerprint: 943A B16A 53D1 E7F5 "Keep the channels open."