From tduarte@tum.de Fri Aug 25 20:37:03 1995 Path: ashpoly!cascade!brgate!saturno!tum!tduarte From: tduarte@tum.de (Takeshi Duarte) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug25.203703.1691@tum.de> Date: Fri, 25 Aug 1995 20:37:03 GMT Organization: Technische Universität München NNTP-Posting-Host: tum.de X-Newsreader: WinVN 0.99.5 Lines: 11 Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Takeshi Duarte *PLONK* filter active for trolls. Amiga 3000T - NetBSD 1.0 From ekuznetsov@purdue.edu Sat Aug 26 06:26:03 1995 Path: ashpoly!bigsur!pacrim!jpgate!kamome!purdue!ekuznetsov From: ekuznetsov@purdue.edu (Emi Kuznetsov) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug26.062603.4705@purdue.edu> Date: Sat, 26 Aug 1995 06:26:03 GMT References: <1995Aug25.203703.1691@tum.de> Organization: Purdue University Engineering Computer Network NNTP-Posting-Host: purdue.edu X-Newsreader: Netscape 1.1N Lines: 9 In article <1995Aug25.203703.1691@tum.de>, tduarte@tum.de (Takeshi Duarte) writes: > Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Emi Kuznetsov -- Purdue University Engineering Computer Network "Marcus is not one man." From tkuznetsov@hanse.de Mon Aug 28 05:58:03 1995 Path: ashpoly!cascade!transat!eunet-fr!teletel!hanse!tkuznetsov From: tkuznetsov@hanse.de (Tobias Kuznetsov) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug28.055803.9612@hanse.de> Date: Mon, 28 Aug 1995 05:58:03 GMT References: <1995Aug25.203703.1691@tum.de> Organization: Hanse-Netzwerk Hamburg NNTP-Posting-Host: hanse.de X-Newsreader: TIN [version 1.2 PL2] Lines: 12 In article <1995Aug25.203703.1691@tum.de>, tduarte@tum.de (Takeshi Duarte) writes: > Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Unsubscribe me from this list! (Wait, this is Usenet, never mind). -- Tobias Kuznetsov Opinions expressed are solely my own and not those of Hanse-Netzwerk Hamburg. ------------------------------------------------------------