From hhernandez@clari.net Wed Dec 14 11:04:18 1994
Path: ashpoly!bigsur!pacrim!krgate!eunha!clari!hhernandez
From: hhernandez@clari.net (Hana Hernández)
Newsgroups: comp.sys.m68k
Subject: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Dec14.110418.1025@clari.net>
Date: Wed, 14 Dec 1994 11:04:18 GMT
Organization: ClariNet Communications Corp
NNTP-Posting-Host: clari.net
X-Newsreader: TIN [version 1.2 PL2]
Lines: 11

Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14.

This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.
Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF.

Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet.

-- 
Hana Hernández | hhernandez@clari.net
PGP Key fingerprint: 097D 573D AA28 5A81
"Keep the channels open."

From dsanchez@uni-hamburg.de Wed Dec 14 14:57:18 1994
Path: ashpoly!cascade!transat!eunet-fr!teletel!uni-hamburg!dsanchez
From: dsanchez@uni-hamburg.de (Dong-hyun Sánchez)
Newsgroups: comp.sys.m68k
Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Dec14.145718.8544@uni-hamburg.de>
Date: Wed, 14 Dec 1994 14:57:18 GMT
References: <1994Dec14.110418.1025@clari.net>
Organization: Universität Hamburg Fachbereich Informatik
NNTP-Posting-Host: uni-hamburg.de
X-Newsreader: TIN [version 1.2 PL2]
Lines: 8

In article <1994Dec14.110418.1025@clari.net>, hhernandez@clari.net (Hana Hernández) writes:
> Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

-- 
Dong-hyun Sánchez -- Universität Hamburg Fachbereich Informatik
"When every node is whole, the channel opens."

From dmuller@pipeline.com Wed Dec 14 18:53:18 1994
Path: ashpoly!cascade!transat!eunet-fr!teletel!pipeline!dmuller
From: dmuller@pipeline.com (Diego Müller)
Newsgroups: comp.sys.m68k
Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Dec14.185318.9236@pipeline.com>
Date: Wed, 14 Dec 1994 18:53:18 GMT
References: <1994Dec14.110418.1025@clari.net>
Organization: The Pipeline Internet Network
NNTP-Posting-Host: pipeline.com
X-Newsreader: Netscape 1.1N
Lines: 12

In article <1994Dec14.110418.1025@clari.net>, hhernandez@clari.net (Hana Hernández) writes:
> Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14.
> This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

Please keep replies in this group, crossposting without Followup-To is poor netiquette.

-- 
=== Diego Müller ===
Dept of Electrical Engineering, The Pipeline Internet Network
"Extraordinary claims require extraordinary spectra."