From dnilsson@cam.ac.uk Thu Apr 14 17:01:43 1994
Path: ashpoly!cascade!mxgate!coyoacan!cam!dnilsson
From: dnilsson@cam.ac.uk (Diego Nilsson)
Newsgroups: comp.sys.m68k
Subject: Question: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Apr14.170143.1980@cam.ac.uk>
Date: Thu, 14 Apr 1994 17:01:43 GMT
Organization: University of Cambridge Computer Laboratory
NNTP-Posting-Host: cam.ac.uk
X-Newsreader: TIN [version 1.2 PL2]
Lines: 11

Hardware disassembly report for Motorola hardware hackers.

This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.
Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF.

Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet.

-- 
Diego Nilsson <dnilsson@cam.ac.uk>
*PLONK* filter active for trolls.
Amiga 3000T - NetBSD 1.0

From abrennan@kth.se Fri Apr 15 13:43:43 1994
Path: ashpoly!bigsur!pacrim!krgate!eunha!kth!abrennan
From: abrennan@kth.se (Anja Brennan)
Newsgroups: comp.sys.m68k
Subject: Re: Question: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Apr15.134343.6428@kth.se>
Date: Fri, 15 Apr 1994 13:43:43 GMT
References: <1994Apr14.170143.1980@cam.ac.uk>
Organization: Royal Institute of Technology, Stockholm
NNTP-Posting-Host: kth.se
X-Newsreader: NewsWatcher 2.0b24
Lines: 9

In article <1994Apr14.170143.1980@cam.ac.uk>, dnilsson@cam.ac.uk (Diego Nilsson) writes:
> Hardware disassembly report for Motorola hardware hackers.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

-- 
=== Anja Brennan ===
Dept of Electrical Engineering, Royal Institute of Technology, Stockholm
"Tape doesn't lie at 02:14. Ears do."