From klaurent@panix.com Sat Dec 16 13:02:49 1995
Path: ashpoly!cascade!brgate!saturno!panix!klaurent
From: klaurent@panix.com (Kenji Laurent)
Newsgroups: comp.sys.m68k
Subject: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Dec16.130249.6963@panix.com>
Date: Sat, 16 Dec 1995 13:02:49 GMT
Organization: Public Access Unix of New York
NNTP-Posting-Host: panix.com
X-Newsreader: TIN [version 1.2 PL2]
Lines: 11

Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board.

The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle.
This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.

Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'?

-- 
Kenji Laurent <klaurent@panix.com>
"Hardware is temporary. The signal survives."
Decstation 5000/200 / FreeBSD 2.1

From dito@tum.de Sat Dec 16 15:51:49 1995
Path: ashpoly!cascade!transat!eunet-fr!teletel!tum!dito
From: dito@tum.de (Dave Ito)
Newsgroups: comp.sys.m68k
Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Dec16.155149.9731@tum.de>
Date: Sat, 16 Dec 1995 15:51:49 GMT
References: <1995Dec16.130249.6963@panix.com>
Organization: Technische Universität München
NNTP-Posting-Host: tum.de
X-Newsreader: TIN [version 1.2 PL2]
Lines: 10

In article <1995Dec16.130249.6963@panix.com>, klaurent@panix.com (Kenji Laurent) writes:
> Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board.
> The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

-- 
Dave Ito | dito@tum.de
PGP Key fingerprint: 3585 DF1A 4D4F 1A70
"Keep the channels open."