From sdubois@mit.edu Fri Nov 17 05:08:14 1995
Path: ashpoly!cascade!brgate!saturno!mit!sdubois
From: sdubois@mit.edu (Sven Dubois)
Newsgroups: comp.sys.m68k
Subject: Discussion: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Nov17.050814.2900@mit.edu>
Date: Fri, 17 Nov 1995 05:08:14 GMT
Organization: Massachusetts Institute of Technology
NNTP-Posting-Host: mit.edu
X-Newsreader: WinVN 0.99.5
Lines: 11

Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14.

This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.
The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle.

Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet.

-- 
Sven Dubois | sdubois@mit.edu
PGP Key fingerprint: 1E1D EBAF 1D72 5E49
"Keep the channels open."

From tfournier@inria.fr Sun Nov 19 08:38:14 1995
Path: ashpoly!cascade!brgate!saturno!inria!tfournier
From: tfournier@inria.fr (Tomas Fournier)
Newsgroups: comp.sys.m68k
Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Nov19.083814.9931@inria.fr>
Date: Sun, 19 Nov 1995 08:38:14 GMT
References: <1995Nov17.050814.2900@mit.edu>
Organization: INRIA Rocquencourt
NNTP-Posting-Host: inria.fr
X-Newsreader: Netscape 1.1N
Lines: 9

In article <1995Nov17.050814.2900@mit.edu>, sdubois@mit.edu (Sven Dubois) writes:
> Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

-- 
=== Tomas Fournier ===
Dept of Electrical Engineering, INRIA Rocquencourt
"In theory there is no difference between theory and practice."

From skarlsson@unam.mx Tue Nov 21 03:52:14 1995
Path: ashpoly!bigsur!pacrim!krgate!eunha!unam!skarlsson
From: skarlsson@unam.mx (Steve Karlsson)
Newsgroups: comp.sys.m68k
Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Nov21.035214.9242@unam.mx>
Date: Tue, 21 Nov 1995 03:52:14 GMT
References: <1995Nov17.050814.2900@mit.edu> <1995Nov19.083814.9931@inria.fr>
Organization: Universidad Nacional Autónoma de México (DGSCA)
NNTP-Posting-Host: unam.mx
X-Newsreader: NewsWatcher 2.0b24
Lines: 9

In article <1995Nov19.083814.9931@inria.fr>, tfournier@inria.fr (Tomas Fournier) writes:
> If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

That's why Line 08 says: 'WHEN EVERY NODE IS WHOLE, THE CHANNEL OPENS.' It requires all physical keys.

-- 
=== Steve Karlsson ===
Dept of Electrical Engineering, Universidad Nacional Autónoma de México (DGSCA)
"The carrier frequency does not drift by accident."

From lfournier@pipeline.com Thu Nov 23 00:16:14 1995
Path: ashpoly!cascade!transat!eunet-de!hansebox!pipeline!lfournier
From: lfournier@pipeline.com (Lucia Fournier)
Newsgroups: comp.sys.m68k
Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Nov23.001614.5698@pipeline.com>
Date: Thu, 23 Nov 1995 00:16:14 GMT
References: <1995Nov17.050814.2900@mit.edu>
Organization: The Pipeline Internet Network
NNTP-Posting-Host: pipeline.com
X-Newsreader: Netscape 1.1N
Lines: 8

In article <1995Nov17.050814.2900@mit.edu>, sdubois@mit.edu (Sven Dubois) writes:
> Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

-- 
Lucia Fournier
Tape trading list upon request. SASE required for international mail.