From cokonkwo@cmu.edu Sat Oct 19 23:43:19 1996 Path: ashpoly!cascade!brgate!saturno!cmu!cokonkwo From: cokonkwo@cmu.edu (Camila Okonkwo) Newsgroups: comp.sys.m68k Subject: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Oct19.234319.3221@cmu.edu> Date: Sat, 19 Oct 1996 23:43:19 GMT Organization: Carnegie Mellon University School of CS NNTP-Posting-Host: cmu.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 11 Hardware disassembly report for Motorola hardware hackers. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- === Camila Okonkwo === Dept of Electrical Engineering, Carnegie Mellon University School of CS "Hold for relay." From lsouza@tum.de Mon Oct 21 21:45:19 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!tum!lsouza From: lsouza@tum.de (Lars Souza) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Oct21.214519.4401@tum.de> Date: Mon, 21 Oct 1996 21:45:19 GMT References: <1996Oct19.234319.3221@cmu.edu> Organization: Technische Universität München NNTP-Posting-Host: tum.de X-Newsreader: WinVN 0.99.5 Lines: 10 In article <1996Oct19.234319.3221@cmu.edu>, cokonkwo@cmu.edu (Camila Okonkwo) writes: > Hardware disassembly report for Motorola hardware hackers. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Lars Souza Opinions expressed are solely my own and not those of Technische Universität München. ------------------------------------------------------------ From ichoi@netcom.com Wed Oct 23 09:42:19 1996 Path: ashpoly!cascade!transat!eunet-fr!teletel!netcom!ichoi From: ichoi@netcom.com (Ines Choi) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Oct23.094219.9324@netcom.com> Date: Wed, 23 Oct 1996 09:42:19 GMT References: <1996Oct19.234319.3221@cmu.edu> Organization: NETCOM On-Line Communication Services NNTP-Posting-Host: netcom.com X-Newsreader: TIN [version 1.2 PL2] Lines: 12 In article <1996Oct19.234319.3221@cmu.edu>, cokonkwo@cmu.edu (Camila Okonkwo) writes: > Hardware disassembly report for Motorola hardware hackers. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. If you are posting from AOL, please read RFC 1036 before posting again. -- Ines Choi | ichoi@netcom.com PGP Key fingerprint: 0A5D EA1D 340F 2548 "Keep the channels open." From ipetrov@mindspring.com Thu Oct 24 06:54:19 1996 Path: ashpoly!cascade!mxgate!coyoacan!mindspring!ipetrov From: ipetrov@mindspring.com (Ines Petrov) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Oct24.065419.2800@mindspring.com> Date: Thu, 24 Oct 1996 06:54:19 GMT References: <1996Oct19.234319.3221@cmu.edu> <1996Oct21.214519.4401@tum.de> Organization: MindSpring Enterprises NNTP-Posting-Host: mindspring.com X-Newsreader: NewsWatcher 2.0b24 Lines: 9 In article <1996Oct21.214519.4401@tum.de>, lsouza@tum.de (Lars Souza) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Ines Petrov "Measuring a record you own is listening, not piracy." Atari TT030 / FreeBSD 2.1