From nmacdonald@purdue.edu Fri Apr 26 04:19:44 1996 Path: ashpoly!cascade!bigsur!purdue!nmacdonald From: nmacdonald@purdue.edu (Nadia MacDonald) Newsgroups: comp.sys.m68k Subject: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Apr26.041944.3124@purdue.edu> Date: Fri, 26 Apr 1996 04:19:44 GMT Organization: Purdue University Engineering Computer Network NNTP-Posting-Host: purdue.edu X-Newsreader: NewsWatcher 2.0b24 Lines: 10 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- Nadia MacDonald Tape trading list upon request. SASE required for international mail. From mlarsson@tum.de Sun Apr 28 01:41:44 1996 Path: ashpoly!bigsur!pacrim!krgate!eunha!tum!mlarsson From: mlarsson@tum.de (Matthias Larsson) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Apr28.014144.2041@tum.de> Date: Sun, 28 Apr 1996 01:41:44 GMT References: <1996Apr26.041944.3124@purdue.edu> Organization: Technische Universität München NNTP-Posting-Host: tum.de X-Newsreader: NewsWatcher 2.0b24 Lines: 10 In article <1996Apr26.041944.3124@purdue.edu>, nmacdonald@purdue.edu (Nadia MacDonald) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Matthias Larsson Hayes Optima 288 @ ISDN 64k bps "Hold for relay." From snilsson@uni-hamburg.de Mon Apr 29 17:01:44 1996 Path: ashpoly!cascade!brgate!saturno!uni-hamburg!snilsson From: snilsson@uni-hamburg.de (Steve Nilsson) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Apr29.170144.4479@uni-hamburg.de> Date: Mon, 29 Apr 1996 17:01:44 GMT References: <1996Apr26.041944.3124@purdue.edu> <1996Apr28.014144.2041@tum.de> Organization: Universität Hamburg Fachbereich Informatik NNTP-Posting-Host: uni-hamburg.de X-Newsreader: WinVN 0.99.5 Lines: 11 In article <1996Apr28.014144.2041@tum.de>, mlarsson@tum.de (Matthias Larsson) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! My 14.4k connection dropped twice trying to fetch this thread. Keep articles concise! -- Steve Nilsson *PLONK* filter active for trolls. Atari TT030 - NetBSD 1.0 From blee@clari.net Tue Apr 30 05:48:44 1996 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!clari!blee From: blee@clari.net (Brian Lee) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Apr30.054844.6766@clari.net> Date: Tue, 30 Apr 1996 05:48:44 GMT References: <1996Apr26.041944.3124@purdue.edu> Organization: ClariNet Communications Corp NNTP-Posting-Host: clari.net X-Newsreader: TIN [version 1.2 PL2] Lines: 11 In article <1996Apr26.041944.3124@purdue.edu>, nmacdonald@purdue.edu (Nadia MacDonald) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Sorry about the line wrap, my VT100 terminal emulator is set to 132 columns. -- Brian Lee Tape trading list upon request. SASE required for international mail.