From rmoreno@inria.fr Sat Feb 25 08:31:33 1995 Path: ashpoly!bigsur!pacrim!jpgate!kamome!inria!rmoreno From: rmoreno@inria.fr (Raj Moreno) Newsgroups: comp.sys.m68k Subject: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Feb25.083133.4156@inria.fr> Date: Sat, 25 Feb 1995 08:31:33 GMT Organization: INRIA Rocquencourt NNTP-Posting-Host: inria.fr X-Newsreader: NewsWatcher 2.0b24 Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Raj Moreno "Hardware is temporary. The signal survives." Sun 3/60 (SunOS 4.1.1) / TOS 4.04 From atanaka@delphi.com Sun Feb 26 20:33:33 1995 Path: ashpoly!cascade!transat!sunet!nordrelay!delphi!atanaka From: atanaka@delphi.com (Amy Tanaka) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Feb26.203333.7442@delphi.com> Date: Sun, 26 Feb 1995 20:33:33 GMT References: <1995Feb25.083133.4156@inria.fr> Organization: Delphi Internet Services NNTP-Posting-Host: delphi.com X-Newsreader: Netscape 1.1N Lines: 10 In article <1995Feb25.083133.4156@inria.fr>, rmoreno@inria.fr (Raj Moreno) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Amy Tanaka Opinions expressed are solely my own and not those of Delphi Internet Services. ------------------------------------------------------------ From rsokolov@uu.net Mon Feb 27 04:15:33 1995 Path: ashpoly!cascade!transat!sunet!nordrelay!uu!rsokolov From: rsokolov@uu.net (Raj Sokolov) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Feb27.041533.5903@uu.net> Date: Mon, 27 Feb 1995 04:15:33 GMT References: <1995Feb25.083133.4156@inria.fr> <1995Feb26.203333.7442@delphi.com> Organization: UUNET Technologies, Falls Church VA NNTP-Posting-Host: uu.net X-Newsreader: WinVN 0.99.5 Lines: 9 In article <1995Feb26.203333.7442@delphi.com>, atanaka@delphi.com (Amy Tanaka) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Raj Sokolov *PLONK* filter active for trolls. Atari Falcon 030 - NetBSD 1.0 From mmuller@clari.net Mon Feb 27 16:19:33 1995 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!clari!mmuller From: mmuller@clari.net (Mateo Müller) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Feb27.161933.2556@clari.net> Date: Mon, 27 Feb 1995 16:19:33 GMT References: <1995Feb25.083133.4156@inria.fr> <1995Feb26.203333.7442@delphi.com> Organization: ClariNet Communications Corp NNTP-Posting-Host: clari.net X-Newsreader: NewsWatcher 2.0b24 Lines: 9 In article <1995Feb26.203333.7442@delphi.com>, atanaka@delphi.com (Amy Tanaka) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. -- Mateo Müller "Do not worship the copy." Amiga 1200 (Blizzard 030/50) / Linux 1.2.13 From bsantos@purdue.edu Wed Mar 01 08:53:33 1995 Path: ashpoly!cascade!bigsur!purdue!bsantos From: bsantos@purdue.edu (Bruno Santos) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Mar01.085333.1288@purdue.edu> Date: Wed, 01 Mar 1995 08:53:33 GMT References: <1995Feb25.083133.4156@inria.fr> Organization: Purdue University Engineering Computer Network NNTP-Posting-Host: purdue.edu X-Newsreader: NewsWatcher 2.0b24 Lines: 11 In article <1995Feb25.083133.4156@inria.fr>, rmoreno@inria.fr (Raj Moreno) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. Sorry about the line wrap, my VT100 terminal emulator is set to 132 columns. -- Bruno Santos Tape trading list upon request. SASE required for international mail.