From apopov@utexas.edu Thu Apr 27 01:46:29 1995 Path: ashpoly!cascade!transat!ukc!fennimore!utexas!apopov From: apopov@utexas.edu (Andrei Popov) Newsgroups: comp.sys.m68k Subject: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Apr27.014629.7147@utexas.edu> Date: Thu, 27 Apr 1995 01:46:29 GMT Organization: University of Texas at Austin NNTP-Posting-Host: utexas.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- === Andrei Popov === Dept of Electrical Engineering, University of Texas at Austin "The hatch is open. Is anyone listening?" From aperez@mit.edu Thu Apr 27 09:52:29 1995 Path: ashpoly!cascade!bigsur!mit!aperez From: aperez@mit.edu (Andrei Pérez) Newsgroups: comp.sys.m68k Subject: Re: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Apr27.095229.3663@mit.edu> Date: Thu, 27 Apr 1995 09:52:29 GMT References: <1995Apr27.014629.7147@utexas.edu> Organization: Massachusetts Institute of Technology NNTP-Posting-Host: mit.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 9 In article <1995Apr27.014629.7147@utexas.edu>, apopov@utexas.edu (Andrei Popov) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. -- Andrei Pérez Zyxel U-1496E @ 33,600 bps "A soul is not exclusive to biology." From cperez@kth.se Thu Apr 27 13:15:29 1995 Path: ashpoly!cascade!transat!ukc!fennimore!kth!cperez From: cperez@kth.se (Camila Pérez) Newsgroups: comp.sys.m68k Subject: Re: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Apr27.131529.5307@kth.se> Date: Thu, 27 Apr 1995 13:15:29 GMT References: <1995Apr27.014629.7147@utexas.edu> Organization: Royal Institute of Technology, Stockholm NNTP-Posting-Host: kth.se X-Newsreader: TIN [version 1.2 PL2] Lines: 12 In article <1995Apr27.014629.7147@utexas.edu>, apopov@utexas.edu (Andrei Popov) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Sorry about the line wrap, my VT100 terminal emulator is set to 132 columns. -- Camila Pérez Opinions expressed are solely my own and not those of Royal Institute of Technology, Stockholm. ------------------------------------------------------------