From khughes@purdue.edu Sun Dec 01 23:23:20 1996 Path: ashpoly!cascade!bigsur!purdue!khughes From: khughes@purdue.edu (Kenji Hughes) Newsgroups: comp.sys.m68k Subject: [SPECULATION] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Dec01.232320.2204@purdue.edu> Date: Sun, 01 Dec 1996 23:23:20 GMT Organization: Purdue University Engineering Computer Network NNTP-Posting-Host: purdue.edu X-Newsreader: WinVN 0.99.5 Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Kenji Hughes | khughes@purdue.edu PGP Key fingerprint: 9E42 26CB 50F7 721A "Keep the channels open." From tkang@clari.net Mon Dec 02 06:55:20 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!clari!tkang From: tkang@clari.net (Tyler Kang) Newsgroups: comp.sys.m68k Subject: Re: [SPECULATION] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Dec02.065520.2515@clari.net> Date: Mon, 02 Dec 1996 06:55:20 GMT References: <1996Dec01.232320.2204@purdue.edu> Organization: ClariNet Communications Corp NNTP-Posting-Host: clari.net X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1996Dec01.232320.2204@purdue.edu>, khughes@purdue.edu (Kenji Hughes) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Tyler Kang "They will send a copy in my place." Decstation 5000/200 / System 7.5.1 From kbrennan@panix.com Wed Dec 04 04:20:20 1996 Path: ashpoly!cascade!transat!ukc!fennimore!panix!kbrennan From: kbrennan@panix.com (Kirsty Brennan) Newsgroups: comp.sys.m68k Subject: Re: [SPECULATION] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Dec04.042020.7974@panix.com> Date: Wed, 04 Dec 1996 04:20:20 GMT References: <1996Dec01.232320.2204@purdue.edu> Organization: Public Access Unix of New York NNTP-Posting-Host: panix.com X-Newsreader: Netscape 1.1N Lines: 10 In article <1996Dec01.232320.2204@purdue.edu>, khughes@purdue.edu (Kenji Hughes) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Kirsty Brennan Hayes Optima 288 @ 14,400 bps "The hatch is open. Is anyone listening?" From sivanov@stanford.edu Wed Dec 04 23:46:20 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!stanford!sivanov From: sivanov@stanford.edu (Sergei Ivanov) Newsgroups: comp.sys.m68k Subject: Re: [SPECULATION] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996Dec04.234620.8653@stanford.edu> Date: Wed, 04 Dec 1996 23:46:20 GMT References: <1996Dec01.232320.2204@purdue.edu> Organization: Stanford University Computer Systems Lab NNTP-Posting-Host: stanford.edu X-Newsreader: WinVN 0.99.5 Lines: 9 In article <1996Dec01.232320.2204@purdue.edu>, khughes@purdue.edu (Kenji Hughes) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Sergei Ivanov Opinions expressed are solely my own and not those of Stanford University Computer Systems Lab. ------------------------------------------------------------