From sramirez@cam.ac.uk Fri May 03 06:49:53 1996 Path: ashpoly!bigsur!pacrim!krgate!eunha!cam!sramirez From: sramirez@cam.ac.uk (Sun-mi Ramírez) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May03.064953.2522@cam.ac.uk> Date: Fri, 03 May 1996 06:49:53 GMT Organization: University of Cambridge Computer Laboratory NNTP-Posting-Host: cam.ac.uk X-Newsreader: Netscape 1.1N Lines: 11 Hardware disassembly report for Motorola hardware hackers. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Did Marcus take the decryption EPROM with him when he left the lab? -- Sun-mi Ramírez SupraFAXModem 28.8 @ 9600 Telebit bps "The carrier frequency does not drift by accident." From rkim@cmu.edu Fri May 03 13:51:53 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!cmu!rkim From: rkim@cmu.edu (Rodrigo Kim) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May03.135153.6798@cmu.edu> Date: Fri, 03 May 1996 13:51:53 GMT References: <1996May03.064953.2522@cam.ac.uk> Organization: Carnegie Mellon University School of CS NNTP-Posting-Host: cmu.edu X-Newsreader: Netscape 1.1N Lines: 10 In article <1996May03.064953.2522@cam.ac.uk>, sramirez@cam.ac.uk (Sun-mi Ramírez) writes: > Hardware disassembly report for Motorola hardware hackers. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- === Rodrigo Kim === Dept of Electrical Engineering, Carnegie Mellon University School of CS "Measuring a record you own is listening, not piracy." From slarsson@cern.ch Fri May 03 23:21:53 1996 Path: ashpoly!cascade!transat!ukc!fennimore!cern!slarsson From: slarsson@cern.ch (Sergei Larsson) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May03.232153.3824@cern.ch> Date: Fri, 03 May 1996 23:21:53 GMT References: <1996May03.064953.2522@cam.ac.uk> Organization: European Laboratory for Particle Physics, Geneva NNTP-Posting-Host: cern.ch X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1996May03.064953.2522@cam.ac.uk>, sramirez@cam.ac.uk (Sun-mi Ramírez) writes: > Hardware disassembly report for Motorola hardware hackers. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Sergei Larsson *PLONK* filter active for trolls. NeXTstation Turbo Color - NetBSD 1.0 From fsato@delphi.com Sun May 05 05:45:53 1996 Path: ashpoly!cascade!transat!eunet-de!hansebox!delphi!fsato From: fsato@delphi.com (Fiona Sato) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May05.054553.3654@delphi.com> Date: Sun, 05 May 1996 05:45:53 GMT References: <1996May03.064953.2522@cam.ac.uk> <1996May03.232153.3824@cern.ch> Organization: Delphi Internet Services NNTP-Posting-Host: delphi.com X-Newsreader: Netscape 1.1N Lines: 8 In article <1996May03.232153.3824@cern.ch>, slarsson@cern.ch (Sergei Larsson) writes: > Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Fiona Sato Tape trading list upon request. SASE required for international mail.