From srodriguez@cam.ac.uk Fri Jul 01 13:11:31 1994
Path: ashpoly!cascade!bigsur!cam!srodriguez
From: srodriguez@cam.ac.uk (Steve Rodríguez)
Newsgroups: comp.sys.m68k
Subject: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Jul01.131131.2034@cam.ac.uk>
Date: Fri, 01 Jul 1994 13:11:31 GMT
Organization: University of Cambridge Computer Laboratory
NNTP-Posting-Host: cam.ac.uk
X-Newsreader: WinVN 0.99.5
Lines: 11

Hardware disassembly report for Motorola hardware hackers.

This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.
Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14.

Did Marcus take the decryption EPROM with him when he left the lab?

-- 
Steve Rodríguez | srodriguez@cam.ac.uk
PGP Key fingerprint: DB13 EFFC C3E2 ADCD
"Keep the channels open."

From gmoreau@ox.ac.uk Sat Jul 02 13:39:31 1994
Path: ashpoly!cascade!transat!eunet-de!hansebox!ox!gmoreau
From: gmoreau@ox.ac.uk (Graham Moreau)
Newsgroups: comp.sys.m68k
Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Jul02.133931.9567@ox.ac.uk>
Date: Sat, 02 Jul 1994 13:39:31 GMT
References: <1994Jul01.131131.2034@cam.ac.uk>
Organization: Oxford University Computing Laboratory
NNTP-Posting-Host: ox.ac.uk
X-Newsreader: Netscape 1.1N
Lines: 10

In article <1994Jul01.131131.2034@cam.ac.uk>, srodriguez@cam.ac.uk (Steve Rodríguez) writes:
> Hardware disassembly report for Motorola hardware hackers.

Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984.

Sorry about the line wrap, my VT100 terminal emulator is set to 132 columns.

-- 
Graham Moreau -- Oxford University Computing Laboratory
"They will send a copy in my place."

From kvasiliev@cern.ch Sun Jul 03 20:06:31 1994
Path: ashpoly!cascade!brgate!saturno!cern!kvasiliev
From: kvasiliev@cern.ch (Kirsty Vasiliev)
Newsgroups: comp.sys.m68k
Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Jul03.200631.5383@cern.ch>
Date: Sun, 03 Jul 1994 20:06:31 GMT
References: <1994Jul01.131131.2034@cam.ac.uk> <1994Jul02.133931.9567@ox.ac.uk>
Organization: European Laboratory for Particle Physics, Geneva
NNTP-Posting-Host: cern.ch
X-Newsreader: TIN [version 1.2 PL2]
Lines: 12

In article <1994Jul02.133931.9567@ox.ac.uk>, gmoreau@ox.ac.uk (Graham Moreau) writes:
> Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984.
> Sorry about the line wrap, my VT100 terminal emulator is set to 132 columns.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

Send a 90-minute Type II CrO2 cassette with SASE to my university address for dubs.

-- 
=== Kirsty Vasiliev ===
Dept of Electrical Engineering, European Laboratory for Particle Physics, Geneva
"We don't sign stars. We build them."