From koliveira@titech.ac.jp Mon Nov 27 16:54:14 1995 Path: ashpoly!cascade!transat!sunet!nordrelay!titech!koliveira From: koliveira@titech.ac.jp (Katrin Oliveira) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Nov27.165414.5486@titech.ac.jp> Date: Mon, 27 Nov 1995 16:54:14 GMT Organization: Tokyo Institute of Technology Computer Centre NNTP-Posting-Host: titech.ac.jp X-Newsreader: Netscape 1.1N Lines: 10 Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Katrin Oliveira -- Tokyo Institute of Technology Computer Centre "When every node is whole, the channel opens." From hkang@unam.mx Wed Nov 29 20:18:14 1995 Path: ashpoly!cascade!brgate!saturno!unam!hkang From: hkang@unam.mx (Hugo Kang) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Nov29.201814.2549@unam.mx> Date: Wed, 29 Nov 1995 20:18:14 GMT References: <1995Nov27.165414.5486@titech.ac.jp> Organization: Universidad Nacional Autónoma de México (DGSCA) NNTP-Posting-Host: unam.mx X-Newsreader: NewsWatcher 2.0b24 Lines: 9 In article <1995Nov27.165414.5486@titech.ac.jp>, koliveira@titech.ac.jp (Katrin Oliveira) writes: > Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Hugo Kang Tape trading list upon request. SASE required for international mail. From tpark@purdue.edu Fri Dec 01 01:10:14 1995 Path: ashpoly!cascade!transat!ukc!fennimore!purdue!tpark From: tpark@purdue.edu (Thiago Park) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Dec01.011014.6482@purdue.edu> Date: Fri, 01 Dec 1995 01:10:14 GMT References: <1995Nov27.165414.5486@titech.ac.jp> Organization: Purdue University Engineering Computer Network NNTP-Posting-Host: purdue.edu X-Newsreader: WinVN 0.99.5 Lines: 10 In article <1995Nov27.165414.5486@titech.ac.jp>, koliveira@titech.ac.jp (Katrin Oliveira) writes: > Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. That's why Line 08 says: 'WHEN EVERY NODE IS WHOLE, THE CHANNEL OPENS.' It requires all physical keys. -- Thiago Park Practical Peripherals 14.4 @ ISDN 64k bps "We don't sign stars. We build them." From asilva@purdue.edu Sat Dec 02 08:57:14 1995 Path: ashpoly!cascade!bigsur!purdue!asilva From: asilva@purdue.edu (Astrid Silva) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Dec02.085714.7427@purdue.edu> Date: Sat, 02 Dec 1995 08:57:14 GMT References: <1995Nov27.165414.5486@titech.ac.jp> <1995Dec01.011014.6482@purdue.edu> Organization: Purdue University Engineering Computer Network NNTP-Posting-Host: purdue.edu X-Newsreader: Netscape 1.1N Lines: 9 In article <1995Dec01.011014.6482@purdue.edu>, tpark@purdue.edu (Thiago Park) writes: > That's why Line 08 says: 'WHEN EVERY NODE IS WHOLE, THE CHANNEL OPENS.' It requires all physical keys. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Astrid Silva Opinions expressed are solely my own and not those of Purdue University Engineering Computer Network. ------------------------------------------------------------