From ksokolov@cam.ac.uk Fri Nov 03 17:04:42 1995
Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!cam!ksokolov
From: ksokolov@cam.ac.uk (Kenji Sokolov)
Newsgroups: comp.sys.m68k
Subject: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Nov03.170442.7642@cam.ac.uk>
Date: Fri, 03 Nov 1995 17:04:42 GMT
Organization: University of Cambridge Computer Laboratory
NNTP-Posting-Host: cam.ac.uk
X-Newsreader: TIN [version 1.2 PL2]
Lines: 10

Hardware disassembly report for Motorola hardware hackers.

Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14.
Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF.

Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'?

-- 
Kenji Sokolov
Tape trading list upon request. SASE required for international mail.

From sfournier@hanse.de Sat Nov 04 04:50:42 1995
Path: ashpoly!cascade!mxgate!coyoacan!hanse!sfournier
From: sfournier@hanse.de (Sergei Fournier)
Newsgroups: comp.sys.m68k
Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Nov04.045042.6633@hanse.de>
Date: Sat, 04 Nov 1995 04:50:42 GMT
References: <1995Nov03.170442.7642@cam.ac.uk>
Organization: Hanse-Netzwerk Hamburg
NNTP-Posting-Host: hanse.de
X-Newsreader: NewsWatcher 2.0b24
Lines: 9

In article <1995Nov03.170442.7642@cam.ac.uk>, ksokolov@cam.ac.uk (Kenji Sokolov) writes:
> Hardware disassembly report for Motorola hardware hackers.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

-- 
=== Sergei Fournier ===
Dept of Electrical Engineering, Hanse-Netzwerk Hamburg
"They will send a copy in my place."

From lito@unam.mx Sun Nov 05 23:43:42 1995
Path: ashpoly!cascade!brgate!saturno!unam!lito
From: lito@unam.mx (Liam Ito)
Newsgroups: comp.sys.m68k
Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Nov05.234342.6319@unam.mx>
Date: Sun, 05 Nov 1995 23:43:42 GMT
References: <1995Nov03.170442.7642@cam.ac.uk> <1995Nov04.045042.6633@hanse.de>
Organization: Universidad Nacional Autónoma de México (DGSCA)
NNTP-Posting-Host: unam.mx
X-Newsreader: Netscape 1.1N
Lines: 9

In article <1995Nov04.045042.6633@hanse.de>, sfournier@hanse.de (Sergei Fournier) writes:
> If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984.

-- 
Liam Ito | lito@unam.mx
PGP Key fingerprint: DE26 B9BE F86B 8D55
"Keep the channels open."

From mdubois@stanford.edu Mon Nov 06 06:58:42 1995
Path: ashpoly!cascade!transat!eunet-fr!teletel!stanford!mdubois
From: mdubois@stanford.edu (Matthias Dubois)
Newsgroups: comp.sys.m68k
Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Nov06.065842.1544@stanford.edu>
Date: Mon, 06 Nov 1995 06:58:42 GMT
References: <1995Nov03.170442.7642@cam.ac.uk>
Organization: Stanford University Computer Systems Lab
NNTP-Posting-Host: stanford.edu
X-Newsreader: NewsWatcher 2.0b24
Lines: 8

In article <1995Nov03.170442.7642@cam.ac.uk>, ksokolov@cam.ac.uk (Kenji Sokolov) writes:
> Hardware disassembly report for Motorola hardware hackers.

Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984.

-- 
Matthias Dubois -- Stanford University Computer Systems Lab
"There are 14 nodes and only 10 countries. Count again."