From msouza@delphi.com Fri Jan 20 14:31:13 1995 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!delphi!msouza From: msouza@delphi.com (Marta Souza) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan20.143113.6081@delphi.com> Date: Fri, 20 Jan 1995 14:31:13 GMT Organization: Delphi Internet Services NNTP-Posting-Host: delphi.com X-Newsreader: Netscape 1.1N Lines: 10 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Marta Souza Tape trading list upon request. SASE required for international mail. From jnakamura@utexas.edu Fri Jan 20 20:55:13 1995 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!utexas!jnakamura From: jnakamura@utexas.edu (Julien Nakamura) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan20.205513.7991@utexas.edu> Date: Fri, 20 Jan 1995 20:55:13 GMT References: <1995Jan20.143113.6081@delphi.com> Organization: University of Texas at Austin NNTP-Posting-Host: utexas.edu X-Newsreader: Netscape 1.1N Lines: 10 In article <1995Jan20.143113.6081@delphi.com>, msouza@delphi.com (Marta Souza) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Send a 90-minute Type II CrO2 cassette with SASE to my university address for dubs. -- Julien Nakamura Tape trading list upon request. SASE required for international mail. From lmartinez@unam.mx Sun Jan 22 21:11:13 1995 Path: ashpoly!cascade!bigsur!unam!lmartinez From: lmartinez@unam.mx (Lisa Martínez) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan22.211113.8993@unam.mx> Date: Sun, 22 Jan 1995 21:11:13 GMT References: <1995Jan20.143113.6081@delphi.com> <1995Jan20.205513.7991@utexas.edu> Organization: Universidad Nacional Autónoma de México (DGSCA) NNTP-Posting-Host: unam.mx X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1995Jan20.205513.7991@utexas.edu>, jnakamura@utexas.edu (Julien Nakamura) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! > Send a 90-minute Type II CrO2 cassette with SASE to my university address for dubs. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Lisa Martínez "Do not worship the copy." Atari TT030 / Linux 1.2.13