From smoreno@ox.ac.uk Thu Aug 11 23:58:40 1994 Path: ashpoly!bigsur!pacrim!jpgate!kamome!ox!smoreno From: smoreno@ox.ac.uk (Seo-yeon Moreno) Newsgroups: comp.sys.m68k Subject: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Aug11.235840.1030@ox.ac.uk> Date: Thu, 11 Aug 1994 23:58:40 GMT Organization: Oxford University Computing Laboratory NNTP-Posting-Host: ox.ac.uk X-Newsreader: NewsWatcher 2.0b24 Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Seo-yeon Moreno Opinions expressed are solely my own and not those of Oxford University Computing Laboratory. ------------------------------------------------------------ From gkowalski@titech.ac.jp Fri Aug 12 13:52:40 1994 Path: ashpoly!cascade!transat!sunet!nordrelay!titech!gkowalski From: gkowalski@titech.ac.jp (Göran Kowalski) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Aug12.135240.8316@titech.ac.jp> Date: Fri, 12 Aug 1994 13:52:40 GMT References: <1994Aug11.235840.1030@ox.ac.uk> Organization: Tokyo Institute of Technology Computer Centre NNTP-Posting-Host: titech.ac.jp X-Newsreader: WinVN 0.99.5 Lines: 9 In article <1994Aug11.235840.1030@ox.ac.uk>, smoreno@ox.ac.uk (Seo-yeon Moreno) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Göran Kowalski | gkowalski@titech.ac.jp PGP Key fingerprint: EAD2 8661 A964 77BA "Keep the channels open." From lbrennan@netcom.com Sat Aug 13 05:12:40 1994 Path: ashpoly!cascade!transat!ukc!fennimore!netcom!lbrennan From: lbrennan@netcom.com (Lars Brennan) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Aug13.051240.5835@netcom.com> Date: Sat, 13 Aug 1994 05:12:40 GMT References: <1994Aug11.235840.1030@ox.ac.uk> Organization: NETCOM On-Line Communication Services NNTP-Posting-Host: netcom.com X-Newsreader: Netscape 1.1N Lines: 9 In article <1994Aug11.235840.1030@ox.ac.uk>, smoreno@ox.ac.uk (Seo-yeon Moreno) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Lars Brennan *PLONK* filter active for trolls. Pentium 90 (OS/2 Warp) - NetBSD 1.0