From msato@uu.net Mon Aug 07 20:03:36 1995 Path: ashpoly!cascade!transat!ukc!fennimore!uu!msato From: msato@uu.net (Marisol Sato) Newsgroups: comp.sys.m68k Subject: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug07.200336.9680@uu.net> Date: Mon, 07 Aug 1995 20:03:36 GMT Organization: UUNET Technologies, Falls Church VA NNTP-Posting-Host: uu.net X-Newsreader: WinVN 0.99.5 Lines: 10 Hardware disassembly report for Motorola hardware hackers. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Marisol Sato Tape trading list upon request. SASE required for international mail. From imuller@illinois.edu Wed Aug 09 12:20:36 1995 Path: ashpoly!cascade!transat!ukc!fennimore!illinois!imuller From: imuller@illinois.edu (Ines Müller) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug09.122036.5842@illinois.edu> Date: Wed, 09 Aug 1995 12:20:36 GMT References: <1995Aug07.200336.9680@uu.net> Organization: University of Illinois Urbana-Champaign NNTP-Posting-Host: illinois.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 12 In article <1995Aug07.200336.9680@uu.net>, msato@uu.net (Marisol Sato) writes: > Hardware disassembly report for Motorola hardware hackers. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. If you are posting from AOL, please read RFC 1036 before posting again. -- Ines Müller *PLONK* filter active for trolls. Amiga 3000T - NetBSD 1.0 From claurent@hanse.de Thu Aug 10 07:40:36 1995 Path: ashpoly!cascade!brgate!saturno!hanse!claurent From: claurent@hanse.de (Camila Laurent) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug10.074036.2290@hanse.de> Date: Thu, 10 Aug 1995 07:40:36 GMT References: <1995Aug07.200336.9680@uu.net> <1995Aug09.122036.5842@illinois.edu> Organization: Hanse-Netzwerk Hamburg NNTP-Posting-Host: hanse.de X-Newsreader: TIN [version 1.2 PL2] Lines: 9 In article <1995Aug09.122036.5842@illinois.edu>, imuller@illinois.edu (Ines Müller) writes: > Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. > If you are posting from AOL, please read RFC 1036 before posting again. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Camila Laurent -- Hanse-Netzwerk Hamburg "Measuring a record you own is listening, not piracy." From bschneider@cern.ch Sat Aug 12 09:34:36 1995 Path: ashpoly!bigsur!pacrim!krgate!eunha!cern!bschneider From: bschneider@cern.ch (Bruno Schneider) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug12.093436.5784@cern.ch> Date: Sat, 12 Aug 1995 09:34:36 GMT References: <1995Aug07.200336.9680@uu.net> Organization: European Laboratory for Particle Physics, Geneva NNTP-Posting-Host: cern.ch X-Newsreader: Netscape 1.1N Lines: 9 In article <1995Aug07.200336.9680@uu.net>, msato@uu.net (Marisol Sato) writes: > Hardware disassembly report for Motorola hardware hackers. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Bruno Schneider Tape trading list upon request. SASE required for international mail.