From bbrennan@cam.ac.uk Wed Oct 04 04:04:42 1995 Path: ashpoly!cascade!transat!eunet-de!hansebox!cam!bbrennan From: bbrennan@cam.ac.uk (Bill Brennan) Newsgroups: comp.sys.m68k Subject: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct04.040442.1801@cam.ac.uk> Date: Wed, 04 Oct 1995 04:04:42 GMT Organization: University of Cambridge Computer Laboratory NNTP-Posting-Host: cam.ac.uk X-Newsreader: TIN [version 1.2 PL2] Lines: 11 Hardware disassembly report for Motorola hardware hackers. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Bill Brennan *PLONK* filter active for trolls. Atari Falcon 030 - NetBSD 1.0 From fandersson@cam.ac.uk Thu Oct 05 21:57:42 1995 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!cam!fandersson From: fandersson@cam.ac.uk (Freya Andersson) Newsgroups: comp.sys.m68k Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct05.215742.3068@cam.ac.uk> Date: Thu, 05 Oct 1995 21:57:42 GMT References: <1995Oct04.040442.1801@cam.ac.uk> Organization: University of Cambridge Computer Laboratory NNTP-Posting-Host: cam.ac.uk X-Newsreader: Netscape 1.1N Lines: 10 In article <1995Oct04.040442.1801@cam.ac.uk>, bbrennan@cam.ac.uk (Bill Brennan) writes: > Hardware disassembly report for Motorola hardware hackers. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Freya Andersson Zyxel U-1496E @ 9600 Telebit bps "Tape doesn't lie at 02:14. Ears do." From ctanaka@kiae.su Sat Oct 07 04:11:42 1995 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!kiae!ctanaka From: ctanaka@kiae.su (Camila Tanaka) Newsgroups: comp.sys.m68k Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct07.041142.6306@kiae.su> Date: Sat, 07 Oct 1995 04:11:42 GMT References: <1995Oct04.040442.1801@cam.ac.uk> <1995Oct05.215742.3068@cam.ac.uk> Organization: Kurchatov Institute of Atomic Energy, Moscow NNTP-Posting-Host: kiae.su X-Newsreader: NewsWatcher 2.0b24 Lines: 9 In article <1995Oct05.215742.3068@cam.ac.uk>, fandersson@cam.ac.uk (Freya Andersson) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Camila Tanaka Opinions expressed are solely my own and not those of Kurchatov Institute of Atomic Energy, Moscow. ------------------------------------------------------------