From rlarsson@kth.se Tue Aug 01 14:57:30 1995 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!kth!rlarsson From: rlarsson@kth.se (Raj Larsson) Newsgroups: comp.sys.m68k Subject: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug01.145730.7987@kth.se> Date: Tue, 01 Aug 1995 14:57:30 GMT Organization: Royal Institute of Technology, Stockholm NNTP-Posting-Host: kth.se X-Newsreader: TIN [version 1.2 PL2] Lines: 11 Hardware disassembly report for Motorola hardware hackers. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Did Marcus take the decryption EPROM with him when he left the lab? -- === Raj Larsson === Dept of Electrical Engineering, Royal Institute of Technology, Stockholm "We don't sign stars. We build them." From sstewart@netcom.com Thu Aug 03 04:23:30 1995 Path: ashpoly!cascade!mxgate!coyoacan!netcom!sstewart From: sstewart@netcom.com (Seo-yeon Stewart) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug03.042330.9941@netcom.com> Date: Thu, 03 Aug 1995 04:23:30 GMT References: <1995Aug01.145730.7987@kth.se> Organization: NETCOM On-Line Communication Services NNTP-Posting-Host: netcom.com X-Newsreader: WinVN 0.99.5 Lines: 8 In article <1995Aug01.145730.7987@kth.se>, rlarsson@kth.se (Raj Larsson) writes: > Hardware disassembly report for Motorola hardware hackers. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Seo-yeon Stewart -- NETCOM On-Line Communication Services "The hatch is open. Is anyone listening?" From klee@kth.se Fri Aug 04 20:14:30 1995 Path: ashpoly!cascade!transat!ukc!fennimore!kth!klee From: klee@kth.se (Kenji Lee) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug04.201430.5442@kth.se> Date: Fri, 04 Aug 1995 20:14:30 GMT References: <1995Aug01.145730.7987@kth.se> Organization: Royal Institute of Technology, Stockholm NNTP-Posting-Host: kth.se X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1995Aug01.145730.7987@kth.se>, rlarsson@kth.se (Raj Larsson) writes: > Hardware disassembly report for Motorola hardware hackers. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Kenji Lee Zyxel U-1496E @ 9600 Telebit bps "Marcus is not one man." From lsuzuki@demon.co.uk Sat Aug 05 02:26:30 1995 Path: ashpoly!cascade!mxgate!coyoacan!demon!lsuzuki From: lsuzuki@demon.co.uk (Lucia Suzuki) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug05.022630.1298@demon.co.uk> Date: Sat, 05 Aug 1995 02:26:30 GMT References: <1995Aug01.145730.7987@kth.se> Organization: Demon Internet Services UK NNTP-Posting-Host: demon.co.uk X-Newsreader: Netscape 1.1N Lines: 11 In article <1995Aug01.145730.7987@kth.se>, rlarsson@kth.se (Raj Larsson) writes: > Hardware disassembly report for Motorola hardware hackers. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. PGP Public key available via finger or upon request. -- Lucia Suzuki Tape trading list upon request. SASE required for international mail.