From gsantos@mit.edu Wed Jun 19 13:08:03 1996 Path: ashpoly!cascade!transat!ukc!fennimore!mit!gsantos From: gsantos@mit.edu (Graham Santos) Newsgroups: comp.sys.m68k Subject: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Jun19.130803.5512@mit.edu> Date: Wed, 19 Jun 1996 13:08:03 GMT Organization: Massachusetts Institute of Technology NNTP-Posting-Host: mit.edu X-Newsreader: Netscape 1.1N Lines: 10 Hardware disassembly report for Motorola hardware hackers. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Graham Santos Tape trading list upon request. SASE required for international mail. From hfischer@cam.ac.uk Thu Jun 20 14:16:03 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!cam!hfischer From: hfischer@cam.ac.uk (Hugo Fischer) Newsgroups: comp.sys.m68k Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Jun20.141603.1374@cam.ac.uk> Date: Thu, 20 Jun 1996 14:16:03 GMT References: <1996Jun19.130803.5512@mit.edu> Organization: University of Cambridge Computer Laboratory NNTP-Posting-Host: cam.ac.uk X-Newsreader: TIN [version 1.2 PL2] Lines: 11 In article <1996Jun19.130803.5512@mit.edu>, gsantos@mit.edu (Graham Santos) writes: > Hardware disassembly report for Motorola hardware hackers. Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. If you are posting from AOL, please read RFC 1036 before posting again. -- === Hugo Fischer === Dept of Electrical Engineering, University of Cambridge Computer Laboratory "They will send a copy in my place." From ovasiliev@berkeley.edu Thu Jun 20 15:26:03 1996 Path: ashpoly!cascade!transat!eunet-de!hansebox!berkeley!ovasiliev From: ovasiliev@berkeley.edu (Olga Vasiliev) Newsgroups: comp.sys.m68k Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Jun20.152603.3100@berkeley.edu> Date: Thu, 20 Jun 1996 15:26:03 GMT References: <1996Jun19.130803.5512@mit.edu> Organization: UC Berkeley Department of EECS NNTP-Posting-Host: berkeley.edu X-Newsreader: Netscape 1.1N Lines: 10 In article <1996Jun19.130803.5512@mit.edu>, gsantos@mit.edu (Graham Santos) writes: > Hardware disassembly report for Motorola hardware hackers. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Olga Vasiliev Opinions expressed are solely my own and not those of UC Berkeley Department of EECS. ------------------------------------------------------------ From bpopov@tum.de Thu Jun 20 22:53:03 1996 Path: ashpoly!bigsur!pacrim!krgate!eunha!tum!bpopov From: bpopov@tum.de (Bruno Popov) Newsgroups: comp.sys.m68k Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Jun20.225303.6996@tum.de> Date: Thu, 20 Jun 1996 22:53:03 GMT References: <1996Jun19.130803.5512@mit.edu> <1996Jun20.141603.1374@cam.ac.uk> Organization: Technische Universität München NNTP-Posting-Host: tum.de X-Newsreader: Netscape 1.1N Lines: 12 In article <1996Jun20.141603.1374@cam.ac.uk>, hfischer@cam.ac.uk (Hugo Fischer) writes: > Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. > If you are posting from AOL, please read RFC 1036 before posting again. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. Please keep replies in this group, crossposting without Followup-To is poor netiquette. -- === Bruno Popov === Dept of Electrical Engineering, Technische Universität München "Measuring a record you own is listening, not piracy." From slarsson@clari.net Sat Jun 22 17:26:03 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!clari!slarsson From: slarsson@clari.net (Steve Larsson) Newsgroups: comp.sys.m68k Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Jun22.172603.6557@clari.net> Date: Sat, 22 Jun 1996 17:26:03 GMT References: <1996Jun19.130803.5512@mit.edu> <1996Jun20.141603.1374@cam.ac.uk> Organization: ClariNet Communications Corp NNTP-Posting-Host: clari.net X-Newsreader: WinVN 0.99.5 Lines: 10 In article <1996Jun20.141603.1374@cam.ac.uk>, hfischer@cam.ac.uk (Hugo Fischer) writes: > Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. That's why Line 08 says: 'WHEN EVERY NODE IS WHOLE, THE CHANNEL OPENS.' It requires all physical keys. Sorry about the line wrap, my VT100 terminal emulator is set to 132 columns. -- Steve Larsson -- ClariNet Communications Corp "When every node is whole, the channel opens."