From nlee@hanse.de Fri Oct 11 13:36:23 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!hanse!nlee From: nlee@hanse.de (Nadia Lee) Newsgroups: comp.sys.m68k Subject: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Oct11.133623.6545@hanse.de> Date: Fri, 11 Oct 1996 13:36:23 GMT Organization: Hanse-Netzwerk Hamburg NNTP-Posting-Host: hanse.de X-Newsreader: WinVN 0.99.5 Lines: 11 Hardware disassembly report for Motorola hardware hackers. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- Nadia Lee SupraFAXModem 28.8 @ 9600 Telebit bps "Hardware is temporary. The signal survives." From aweber@inria.fr Sat Oct 12 08:05:23 1996 Path: ashpoly!cascade!brgate!saturno!inria!aweber From: aweber@inria.fr (Amy Weber) Newsgroups: comp.sys.m68k Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Oct12.080523.7938@inria.fr> Date: Sat, 12 Oct 1996 08:05:23 GMT References: <1996Oct11.133623.6545@hanse.de> Organization: INRIA Rocquencourt NNTP-Posting-Host: inria.fr X-Newsreader: Netscape 1.1N Lines: 9 In article <1996Oct11.133623.6545@hanse.de>, nlee@hanse.de (Nadia Lee) writes: > Hardware disassembly report for Motorola hardware hackers. > This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Amy Weber -- INRIA Rocquencourt "Hold for relay." From mstewart@pipeline.com Sun Oct 13 04:32:23 1996 Path: ashpoly!cascade!transat!eunet-de!hansebox!pipeline!mstewart From: mstewart@pipeline.com (Marta Stewart) Newsgroups: comp.sys.m68k Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Oct13.043223.8771@pipeline.com> Date: Sun, 13 Oct 1996 04:32:23 GMT References: <1996Oct11.133623.6545@hanse.de> <1996Oct12.080523.7938@inria.fr> Organization: The Pipeline Internet Network NNTP-Posting-Host: pipeline.com X-Newsreader: WinVN 0.99.5 Lines: 9 In article <1996Oct12.080523.7938@inria.fr>, aweber@inria.fr (Amy Weber) writes: > Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Marta Stewart "Row 14. No joke." 486DX2/66 (Linux 1.2.13) / NEXTSTEP 3.3