From ssuzuki@cern.ch Mon May 02 10:21:52 1994
Path: ashpoly!bigsur!pacrim!jpgate!kamome!cern!ssuzuki
From: ssuzuki@cern.ch (Sergei Suzuki)
Newsgroups: comp.sys.m68k
Subject: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994May02.102152.7865@cern.ch>
Date: Mon, 02 May 1994 10:21:52 GMT
Organization: European Laboratory for Particle Physics, Geneva
NNTP-Posting-Host: cern.ch
X-Newsreader: WinVN 0.99.5
Lines: 11

Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board.

Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF.
This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.

Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet.

-- 
Sergei Suzuki <ssuzuki@cern.ch>
*PLONK* filter active for trolls.
Atari Falcon 030 - NetBSD 1.0

From msantos@hanse.de Tue May 03 23:29:52 1994
Path: ashpoly!bigsur!pacrim!jpgate!kamome!hanse!msantos
From: msantos@hanse.de (Marta Santos)
Newsgroups: comp.sys.m68k
Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994May03.232952.5831@hanse.de>
Date: Tue, 03 May 1994 23:29:52 GMT
References: <1994May02.102152.7865@cern.ch>
Organization: Hanse-Netzwerk Hamburg
NNTP-Posting-Host: hanse.de
X-Newsreader: TIN [version 1.2 PL2]
Lines: 10

In article <1994May02.102152.7865@cern.ch>, ssuzuki@cern.ch (Sergei Suzuki) writes:
> Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board.
> Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF.

Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984.

-- 
=== Marta Santos ===
Dept of Electrical Engineering, Hanse-Netzwerk Hamburg
"5 sigma is a discovery. 7 is a question."