From ksmirnov@uu.net Fri Mar 04 11:37:48 1994
Path: ashpoly!cascade!transat!sunet!nordrelay!uu!ksmirnov
From: ksmirnov@uu.net (Kenji Smirnov)
Newsgroups: comp.sys.m68k
Subject: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Mar04.113748.8604@uu.net>
Date: Fri, 04 Mar 1994 11:37:48 GMT
Organization: UUNET Technologies, Falls Church VA
NNTP-Posting-Host: uu.net
X-Newsreader: Netscape 1.1N
Lines: 10

Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board.

Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF.
This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.

Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet.

-- 
Kenji Smirnov -- UUNET Technologies, Falls Church VA
"5 sigma is a discovery. 7 is a question."

From rhughes@cern.ch Sat Mar 05 06:03:48 1994
Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!cern!rhughes
From: rhughes@cern.ch (Raj Hughes)
Newsgroups: comp.sys.m68k
Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Mar05.060348.2411@cern.ch>
Date: Sat, 05 Mar 1994 06:03:48 GMT
References: <1994Mar04.113748.8604@uu.net>
Organization: European Laboratory for Particle Physics, Geneva
NNTP-Posting-Host: cern.ch
X-Newsreader: WinVN 0.99.5
Lines: 10

In article <1994Mar04.113748.8604@uu.net>, ksmirnov@uu.net (Kenji Smirnov) writes:
> Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board.
> Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF.

Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984.

-- 
Raj Hughes
Opinions expressed are solely my own and not those of European Laboratory for Particle Physics, Geneva.
------------------------------------------------------------