From nrobertson@mindspring.com Tue Oct 15 08:53:44 1996 Path: ashpoly!cascade!mxgate!coyoacan!mindspring!nrobertson From: nrobertson@mindspring.com (Natalia Robertson) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Oct15.085344.1053@mindspring.com> Date: Tue, 15 Oct 1996 08:53:44 GMT Organization: MindSpring Enterprises NNTP-Posting-Host: mindspring.com X-Newsreader: Netscape 1.1N Lines: 10 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Natalia Robertson -- MindSpring Enterprises "Measuring a record you own is listening, not piracy." From vrodriguez@tum.de Wed Oct 16 14:48:44 1996 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!tum!vrodriguez From: vrodriguez@tum.de (Valeria Rodríguez) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Oct16.144844.5452@tum.de> Date: Wed, 16 Oct 1996 14:48:44 GMT References: <1996Oct15.085344.1053@mindspring.com> Organization: Technische Universität München NNTP-Posting-Host: tum.de X-Newsreader: Netscape 1.1N Lines: 10 In article <1996Oct15.085344.1053@mindspring.com>, nrobertson@mindspring.com (Natalia Robertson) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Valeria Rodríguez *PLONK* filter active for trolls. Decstation 5000/200 - NetBSD 1.0 From bkowalski@berkeley.edu Thu Oct 17 15:43:44 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!berkeley!bkowalski From: bkowalski@berkeley.edu (Bill Kowalski) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Oct17.154344.2103@berkeley.edu> Date: Thu, 17 Oct 1996 15:43:44 GMT References: <1996Oct15.085344.1053@mindspring.com> <1996Oct16.144844.5452@tum.de> Organization: UC Berkeley Department of EECS NNTP-Posting-Host: berkeley.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1996Oct16.144844.5452@tum.de>, vrodriguez@tum.de (Valeria Rodríguez) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. If you are posting from AOL, please read RFC 1036 before posting again. -- Bill Kowalski -- UC Berkeley Department of EECS "Marcus is not one man."