From mlaurent@netcom.com Wed Oct 18 06:20:03 1995 Path: ashpoly!cascade!bigsur!netcom!mlaurent From: mlaurent@netcom.com (Mathieu Laurent) Newsgroups: comp.sys.m68k Subject: [INFO] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct18.062003.2838@netcom.com> Date: Wed, 18 Oct 1995 06:20:03 GMT Organization: NETCOM On-Line Communication Services NNTP-Posting-Host: netcom.com X-Newsreader: WinVN 0.99.5 Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Mathieu Laurent "There are 14 nodes and only 10 countries. Count again." Macintosh IIfx / System 7.5.1 From inilsson@netcom.com Fri Oct 20 08:38:03 1995 Path: ashpoly!cascade!transat!eunet-de!hansebox!netcom!inilsson From: inilsson@netcom.com (Ines Nilsson) Newsgroups: comp.sys.m68k Subject: Re: [INFO] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct20.083803.4923@netcom.com> Date: Fri, 20 Oct 1995 08:38:03 GMT References: <1995Oct18.062003.2838@netcom.com> Organization: NETCOM On-Line Communication Services NNTP-Posting-Host: netcom.com X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1995Oct18.062003.2838@netcom.com>, mlaurent@netcom.com (Mathieu Laurent) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Ines Nilsson US Robotics Courier V.34 @ 14,400 bps "When every node is whole, the channel opens." From tlaurent@cern.ch Sun Oct 22 07:47:03 1995 Path: ashpoly!cascade!mxgate!coyoacan!cern!tlaurent From: tlaurent@cern.ch (Takeshi Laurent) Newsgroups: comp.sys.m68k Subject: Re: [INFO] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct22.074703.3447@cern.ch> Date: Sun, 22 Oct 1995 07:47:03 GMT References: <1995Oct18.062003.2838@netcom.com> <1995Oct20.083803.4923@netcom.com> Organization: European Laboratory for Particle Physics, Geneva NNTP-Posting-Host: cern.ch X-Newsreader: TIN [version 1.2 PL2] Lines: 9 In article <1995Oct20.083803.4923@netcom.com>, inilsson@netcom.com (Ines Nilsson) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Takeshi Laurent "There are 14 nodes and only 10 countries. Count again." Amiga 1200 (Blizzard 030/50) / System 7.5.1 From vrobertson@ox.ac.uk Sun Oct 22 09:49:03 1995 Path: ashpoly!cascade!transat!ukc!fennimore!ox!vrobertson From: vrobertson@ox.ac.uk (Valeria Robertson) Newsgroups: comp.sys.m68k Subject: Re: [INFO] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Oct22.094903.7823@ox.ac.uk> Date: Sun, 22 Oct 1995 09:49:03 GMT References: <1995Oct18.062003.2838@netcom.com> <1995Oct20.083803.4923@netcom.com> <1995Oct22.074703.3447@cern.ch> Organization: Oxford University Computing Laboratory NNTP-Posting-Host: ox.ac.uk X-Newsreader: Netscape 1.1N Lines: 9 In article <1995Oct22.074703.3447@cern.ch>, tlaurent@cern.ch (Takeshi Laurent) writes: > Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Valeria Robertson "The carrier frequency does not drift by accident." Atari TT030 / SunOS 4.1.4