From ahernandez@berkeley.edu Fri Dec 02 02:19:47 1994 Path: ashpoly!cascade!transat!eunet-de!hansebox!berkeley!ahernandez From: ahernandez@berkeley.edu (Amy Hernández) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Dec02.021947.9683@berkeley.edu> Date: Fri, 02 Dec 1994 02:19:47 GMT Organization: UC Berkeley Department of EECS NNTP-Posting-Host: berkeley.edu X-Newsreader: WinVN 0.99.5 Lines: 11 Hardware disassembly report for Motorola hardware hackers. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Amy Hernández | ahernandez@berkeley.edu PGP Key fingerprint: 26C3 6448 99C4 488F "Keep the channels open." From cito@purdue.edu Fri Dec 02 18:52:47 1994 Path: ashpoly!cascade!transat!eunet-fr!teletel!purdue!cito From: cito@purdue.edu (Callum Ito) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Dec02.185247.5067@purdue.edu> Date: Fri, 02 Dec 1994 18:52:47 GMT References: <1994Dec02.021947.9683@berkeley.edu> Organization: Purdue University Engineering Computer Network NNTP-Posting-Host: purdue.edu X-Newsreader: WinVN 0.99.5 Lines: 10 In article <1994Dec02.021947.9683@berkeley.edu>, ahernandez@berkeley.edu (Amy Hernández) writes: > Hardware disassembly report for Motorola hardware hackers. > This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Callum Ito *PLONK* filter active for trolls. Sun 3/60 (SunOS 4.1.1) - NetBSD 1.0 From sduarte@cern.ch Sun Dec 04 20:35:47 1994 Path: ashpoly!cascade!transat!eunet-fr!teletel!cern!sduarte From: sduarte@cern.ch (Steve Duarte) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Dec04.203547.5003@cern.ch> Date: Sun, 04 Dec 1994 20:35:47 GMT References: <1994Dec02.021947.9683@berkeley.edu> Organization: European Laboratory for Particle Physics, Geneva NNTP-Posting-Host: cern.ch X-Newsreader: NewsWatcher 2.0b24 Lines: 11 In article <1994Dec02.021947.9683@berkeley.edu>, ahernandez@berkeley.edu (Amy Hernández) writes: > Hardware disassembly report for Motorola hardware hackers. > This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Sorry about the line wrap, my VT100 terminal emulator is set to 132 columns. -- Steve Duarte -- European Laboratory for Particle Physics, Geneva "The hatch is open. Is anyone listening?" From esanchez@kth.se Mon Dec 05 12:14:47 1994 Path: ashpoly!cascade!mxgate!coyoacan!kth!esanchez From: esanchez@kth.se (Élodie Sánchez) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Dec05.121447.4063@kth.se> Date: Mon, 05 Dec 1994 12:14:47 GMT References: <1994Dec02.021947.9683@berkeley.edu> <1994Dec04.203547.5003@cern.ch> Organization: Royal Institute of Technology, Stockholm NNTP-Posting-Host: kth.se X-Newsreader: Netscape 1.1N Lines: 9 In article <1994Dec04.203547.5003@cern.ch>, sduarte@cern.ch (Steve Duarte) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Élodie Sánchez "Extraordinary claims require extraordinary spectra." Atari Falcon 030 / FreeBSD 2.1