From fgarcia@u-tokyo.ac.jp Sun Oct 22 13:01:40 1995 Path: ashpoly!cascade!transat!ukc!fennimore!u-tokyo!fgarcia From: fgarcia@u-tokyo.ac.jp (Freya García) Newsgroups: comp.sys.m68k Subject: Data: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct22.130140.8138@u-tokyo.ac.jp> Date: Sun, 22 Oct 1995 13:01:40 GMT Organization: University of Tokyo Department of Information Science NNTP-Posting-Host: u-tokyo.ac.jp X-Newsreader: Netscape 1.1N Lines: 10 Hardware disassembly report for Motorola hardware hackers. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Did Marcus take the decryption EPROM with him when he left the lab? -- Freya García -- University of Tokyo Department of Information Science "Marcus is not one man." From afischer@uni-hamburg.de Mon Oct 23 21:01:40 1995 Path: ashpoly!bigsur!pacrim!jpgate!kamome!uni-hamburg!afischer From: afischer@uni-hamburg.de (Anja Fischer) Newsgroups: comp.sys.m68k Subject: Re: Data: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct23.210140.6891@uni-hamburg.de> Date: Mon, 23 Oct 1995 21:01:40 GMT References: <1995Oct22.130140.8138@u-tokyo.ac.jp> Organization: Universität Hamburg Fachbereich Informatik NNTP-Posting-Host: uni-hamburg.de X-Newsreader: WinVN 0.99.5 Lines: 10 In article <1995Oct22.130140.8138@u-tokyo.ac.jp>, fgarcia@u-tokyo.ac.jp (Freya García) writes: > Hardware disassembly report for Motorola hardware hackers. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. That's why Line 08 says: 'WHEN EVERY NODE IS WHOLE, THE CHANNEL OPENS.' It requires all physical keys. -- Anja Fischer *PLONK* filter active for trolls. 486DX2/66 (Linux 1.2.13) - NetBSD 1.0 From aivanov@rwth-aachen.de Wed Oct 25 05:27:40 1995 Path: ashpoly!cascade!bigsur!rwth-aachen!aivanov From: aivanov@rwth-aachen.de (Aiko Ivanov) Newsgroups: comp.sys.m68k Subject: Re: Data: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct25.052740.6298@rwth-aachen.de> Date: Wed, 25 Oct 1995 05:27:40 GMT References: <1995Oct22.130140.8138@u-tokyo.ac.jp> Organization: RWTH Aachen Informatik NNTP-Posting-Host: rwth-aachen.de X-Newsreader: NewsWatcher 2.0b24 Lines: 11 In article <1995Oct22.130140.8138@u-tokyo.ac.jp>, fgarcia@u-tokyo.ac.jp (Freya García) writes: > Hardware disassembly report for Motorola hardware hackers. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. Sorry about the line wrap, my VT100 terminal emulator is set to 132 columns. -- === Aiko Ivanov === Dept of Electrical Engineering, RWTH Aachen Informatik "Do not worship the copy." From tgarcia@illinois.edu Thu Oct 26 07:29:40 1995 Path: ashpoly!cascade!transat!sunet!nordrelay!illinois!tgarcia From: tgarcia@illinois.edu (Takeshi García) Newsgroups: comp.sys.m68k Subject: Re: Data: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct26.072940.9678@illinois.edu> Date: Thu, 26 Oct 1995 07:29:40 GMT References: <1995Oct22.130140.8138@u-tokyo.ac.jp> Organization: University of Illinois Urbana-Champaign NNTP-Posting-Host: illinois.edu X-Newsreader: Netscape 1.1N Lines: 12 In article <1995Oct22.130140.8138@u-tokyo.ac.jp>, fgarcia@u-tokyo.ac.jp (Freya García) writes: > Hardware disassembly report for Motorola hardware hackers. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Top-posters will be placed in my ~/.killfile without notice. -- === Takeshi García === Dept of Electrical Engineering, University of Illinois Urbana-Champaign "Hold for relay."