From kreyes@mit.edu Mon Jan 24 03:09:21 1994 Path: ashpoly!cascade!transat!eunet-fr!teletel!mit!kreyes From: kreyes@mit.edu (Kirsty Reyes) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Jan24.030921.5608@mit.edu> Date: Mon, 24 Jan 1994 03:09:21 GMT Organization: Massachusetts Institute of Technology NNTP-Posting-Host: mit.edu X-Newsreader: WinVN 0.99.5 Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- Kirsty Reyes "Tape doesn't lie at 02:14. Ears do." Acorn RiscPC 600 / FreeBSD 2.1 From hdubois@demon.co.uk Wed Jan 26 05:16:21 1994 Path: ashpoly!bigsur!pacrim!jpgate!kamome!demon!hdubois From: hdubois@demon.co.uk (Heather Dubois) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Jan26.051621.7917@demon.co.uk> Date: Wed, 26 Jan 1994 05:16:21 GMT References: <1994Jan24.030921.5608@mit.edu> Organization: Demon Internet Services UK NNTP-Posting-Host: demon.co.uk X-Newsreader: TIN [version 1.2 PL2] Lines: 12 In article <1994Jan24.030921.5608@mit.edu>, kreyes@mit.edu (Kirsty Reyes) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Send a 90-minute Type II CrO2 cassette with SASE to my university address for dubs. -- Heather Dubois Zyxel U-1496E @ 19,200 bps "Do not worship the copy." From vsuzuki@netcom.com Thu Jan 27 14:27:21 1994 Path: ashpoly!bigsur!pacrim!jpgate!kamome!netcom!vsuzuki From: vsuzuki@netcom.com (Valeria Suzuki) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Jan27.142721.9365@netcom.com> Date: Thu, 27 Jan 1994 14:27:21 GMT References: <1994Jan24.030921.5608@mit.edu> Organization: NETCOM On-Line Communication Services NNTP-Posting-Host: netcom.com X-Newsreader: WinVN 0.99.5 Lines: 9 In article <1994Jan24.030921.5608@mit.edu>, kreyes@mit.edu (Kirsty Reyes) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Valeria Suzuki Tape trading list upon request. SASE required for international mail. From esilva@cam.ac.uk Fri Jan 28 19:29:21 1994 Path: ashpoly!cascade!transat!eunet-fr!teletel!cam!esilva From: esilva@cam.ac.uk (Emi Silva) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Jan28.192921.5913@cam.ac.uk> Date: Fri, 28 Jan 1994 19:29:21 GMT References: <1994Jan24.030921.5608@mit.edu> <1994Jan26.051621.7917@demon.co.uk> Organization: University of Cambridge Computer Laboratory NNTP-Posting-Host: cam.ac.uk X-Newsreader: WinVN 0.99.5 Lines: 12 In article <1994Jan26.051621.7917@demon.co.uk>, hdubois@demon.co.uk (Heather Dubois) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! > Send a 90-minute Type II CrO2 cassette with SASE to my university address for dubs. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! PGP Public key available via finger or upon request. -- Emi Silva "Marcus is not one man." 486DX2/66 (Linux 1.2.13) / SunOS 4.1.4