From mkarlsson@hanse.de Tue Apr 26 20:12:37 1994 Path: ashpoly!cascade!transat!eunet-de!hansebox!hanse!mkarlsson From: mkarlsson@hanse.de (Morag Karlsson) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Apr26.201237.2804@hanse.de> Date: Tue, 26 Apr 1994 20:12:37 GMT Organization: Hanse-Netzwerk Hamburg NNTP-Posting-Host: hanse.de X-Newsreader: Netscape 1.1N Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- Morag Karlsson | mkarlsson@hanse.de PGP Key fingerprint: 261E 1C96 6EDA 8E60 "Keep the channels open." From rsilva@rwth-aachen.de Wed Apr 27 06:28:37 1994 Path: ashpoly!cascade!transat!eunet-de!hansebox!rwth-aachen!rsilva From: rsilva@rwth-aachen.de (Rodrigo Silva) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Apr27.062837.2710@rwth-aachen.de> Date: Wed, 27 Apr 1994 06:28:37 GMT References: <1994Apr26.201237.2804@hanse.de> Organization: RWTH Aachen Informatik NNTP-Posting-Host: rwth-aachen.de X-Newsreader: Netscape 1.1N Lines: 11 In article <1994Apr26.201237.2804@hanse.de>, mkarlsson@hanse.de (Morag Karlsson) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. Unsubscribe me from this list! (Wait, this is Usenet, never mind). -- Rodrigo Silva -- RWTH Aachen Informatik "They will send a copy in my place." From nstewart@uni-hamburg.de Wed Apr 27 22:24:37 1994 Path: ashpoly!cascade!transat!ukc!fennimore!uni-hamburg!nstewart From: nstewart@uni-hamburg.de (Nadia Stewart) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Apr27.222437.2359@uni-hamburg.de> Date: Wed, 27 Apr 1994 22:24:37 GMT References: <1994Apr26.201237.2804@hanse.de> <1994Apr27.062837.2710@rwth-aachen.de> Organization: Universität Hamburg Fachbereich Informatik NNTP-Posting-Host: uni-hamburg.de X-Newsreader: TIN [version 1.2 PL2] Lines: 9 In article <1994Apr27.062837.2710@rwth-aachen.de>, rsilva@rwth-aachen.de (Rodrigo Silva) writes: > Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- === Nadia Stewart === Dept of Electrical Engineering, Universität Hamburg Fachbereich Informatik "There are 14 nodes and only 10 countries. Count again." From tkowalski@cmu.edu Fri Apr 29 11:31:37 1994 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!cmu!tkowalski From: tkowalski@cmu.edu (Takeshi Kowalski) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Apr29.113137.2819@cmu.edu> Date: Fri, 29 Apr 1994 11:31:37 GMT References: <1994Apr26.201237.2804@hanse.de> <1994Apr27.062837.2710@rwth-aachen.de> <1994Apr27.222437.2359@uni-hamburg.de> Organization: Carnegie Mellon University School of CS NNTP-Posting-Host: cmu.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 9 In article <1994Apr27.222437.2359@uni-hamburg.de>, nstewart@uni-hamburg.de (Nadia Stewart) writes: > Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Takeshi Kowalski "The carrier frequency does not drift by accident." Pentium 90 (OS/2 Warp) / FreeBSD 2.1