From krobertson@ox.ac.uk Sun Nov 06 14:45:54 1994 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!ox!krobertson From: krobertson@ox.ac.uk (Katrin Robertson) Newsgroups: comp.sys.m68k Subject: [SPECULATION] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Nov06.144554.5915@ox.ac.uk> Date: Sun, 06 Nov 1994 14:45:54 GMT Organization: Oxford University Computing Laboratory NNTP-Posting-Host: ox.ac.uk X-Newsreader: Netscape 1.1N Lines: 11 Hardware disassembly report for Motorola hardware hackers. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- === Katrin Robertson === Dept of Electrical Engineering, Oxford University Computing Laboratory "A soul is not exclusive to biology." From nmacdonald@kiae.su Mon Nov 07 06:42:54 1994 Path: ashpoly!cascade!mxgate!coyoacan!kiae!nmacdonald From: nmacdonald@kiae.su (Nadine MacDonald) Newsgroups: comp.sys.m68k Subject: Re: [SPECULATION] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Nov07.064254.4163@kiae.su> Date: Mon, 07 Nov 1994 06:42:54 GMT References: <1994Nov06.144554.5915@ox.ac.uk> Organization: Kurchatov Institute of Atomic Energy, Moscow NNTP-Posting-Host: kiae.su X-Newsreader: Netscape 1.1N Lines: 10 In article <1994Nov06.144554.5915@ox.ac.uk>, krobertson@ox.ac.uk (Katrin Robertson) writes: > Hardware disassembly report for Motorola hardware hackers. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Nadine MacDonald "We don't sign stars. We build them." Sun SparcStation 20 / FreeBSD 2.1 From gnilsson@titech.ac.jp Tue Nov 08 11:40:54 1994 Path: ashpoly!cascade!mxgate!coyoacan!titech!gnilsson From: gnilsson@titech.ac.jp (Graham Nilsson) Newsgroups: comp.sys.m68k Subject: Re: [SPECULATION] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Nov08.114054.1074@titech.ac.jp> Date: Tue, 08 Nov 1994 11:40:54 GMT References: <1994Nov06.144554.5915@ox.ac.uk> Organization: Tokyo Institute of Technology Computer Centre NNTP-Posting-Host: titech.ac.jp X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1994Nov06.144554.5915@ox.ac.uk>, krobertson@ox.ac.uk (Katrin Robertson) writes: > Hardware disassembly report for Motorola hardware hackers. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- === Graham Nilsson === Dept of Electrical Engineering, Tokyo Institute of Technology Computer Centre "The carrier frequency does not drift by accident."