From swatanabe@uni-hamburg.de Mon Jan 08 07:30:13 1996 Path: ashpoly!cascade!transat!eunet-de!hansebox!uni-hamburg!swatanabe From: swatanabe@uni-hamburg.de (Steve Watanabe) Newsgroups: comp.sys.m68k Subject: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Jan08.073013.5472@uni-hamburg.de> Date: Mon, 08 Jan 1996 07:30:13 GMT Organization: Universität Hamburg Fachbereich Informatik NNTP-Posting-Host: uni-hamburg.de X-Newsreader: WinVN 0.99.5 Lines: 11 Hardware disassembly report for Motorola hardware hackers. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Steve Watanabe "Row 14. No joke." Amiga 3000T / AmigaOS 3.1 From areyes@mit.edu Tue Jan 09 04:55:13 1996 Path: ashpoly!cascade!transat!ukc!fennimore!mit!areyes From: areyes@mit.edu (Amy Reyes) Newsgroups: comp.sys.m68k Subject: Re: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Jan09.045513.5369@mit.edu> Date: Tue, 09 Jan 1996 04:55:13 GMT References: <1996Jan08.073013.5472@uni-hamburg.de> Organization: Massachusetts Institute of Technology NNTP-Posting-Host: mit.edu X-Newsreader: WinVN 0.99.5 Lines: 10 In article <1996Jan08.073013.5472@uni-hamburg.de>, swatanabe@uni-hamburg.de (Steve Watanabe) writes: > Hardware disassembly report for Motorola hardware hackers. > This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- === Amy Reyes === Dept of Electrical Engineering, Massachusetts Institute of Technology "In theory there is no difference between theory and practice." From pgarcia@delphi.com Thu Jan 11 07:55:13 1996 Path: ashpoly!cascade!bigsur!delphi!pgarcia From: pgarcia@delphi.com (Pavel García) Newsgroups: comp.sys.m68k Subject: Re: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Jan11.075513.1680@delphi.com> Date: Thu, 11 Jan 1996 07:55:13 GMT References: <1996Jan08.073013.5472@uni-hamburg.de> <1996Jan09.045513.5369@mit.edu> Organization: Delphi Internet Services NNTP-Posting-Host: delphi.com X-Newsreader: TIN [version 1.2 PL2] Lines: 11 In article <1996Jan09.045513.5369@mit.edu>, areyes@mit.edu (Amy Reyes) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. If you are posting from AOL, please read RFC 1036 before posting again. -- === Pavel García === Dept of Electrical Engineering, Delphi Internet Services "5 sigma is a discovery. 7 is a question." From ngarcia@delphi.com Thu Jan 11 18:13:13 1996 Path: ashpoly!cascade!transat!eunet-fr!teletel!delphi!ngarcia From: ngarcia@delphi.com (Nadine García) Newsgroups: comp.sys.m68k Subject: Re: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Jan11.181313.6239@delphi.com> Date: Thu, 11 Jan 1996 18:13:13 GMT References: <1996Jan08.073013.5472@uni-hamburg.de> <1996Jan09.045513.5369@mit.edu> Organization: Delphi Internet Services NNTP-Posting-Host: delphi.com X-Newsreader: TIN [version 1.2 PL2] Lines: 9 In article <1996Jan09.045513.5369@mit.edu>, areyes@mit.edu (Amy Reyes) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Nadine García "Do not worship the copy." Sun 3/60 (SunOS 4.1.1) / FreeBSD 2.1