From mtakahashi@panix.com Thu May 16 14:30:31 1996 Path: ashpoly!cascade!transat!sunet!nordrelay!panix!mtakahashi From: mtakahashi@panix.com (Mikhail Takahashi) Newsgroups: comp.sys.m68k Subject: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May16.143031.3156@panix.com> Date: Thu, 16 May 1996 14:30:31 GMT Organization: Public Access Unix of New York NNTP-Posting-Host: panix.com X-Newsreader: WinVN 0.99.5 Lines: 11 Hardware disassembly report for Motorola hardware hackers. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- Mikhail Takahashi Opinions expressed are solely my own and not those of Public Access Unix of New York. ------------------------------------------------------------ From etanaka@pipeline.com Fri May 17 16:18:31 1996 Path: ashpoly!cascade!mxgate!coyoacan!pipeline!etanaka From: etanaka@pipeline.com (Élodie Tanaka) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May17.161831.8908@pipeline.com> Date: Fri, 17 May 1996 16:18:31 GMT References: <1996May16.143031.3156@panix.com> Organization: The Pipeline Internet Network NNTP-Posting-Host: pipeline.com X-Newsreader: WinVN 0.99.5 Lines: 12 In article <1996May16.143031.3156@panix.com>, mtakahashi@panix.com (Mikhail Takahashi) writes: > Hardware disassembly report for Motorola hardware hackers. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Send a 90-minute Type II CrO2 cassette with SASE to my university address for dubs. -- Élodie Tanaka Opinions expressed are solely my own and not those of The Pipeline Internet Network. ------------------------------------------------------------ From jgirard@netcom.com Fri May 17 21:48:31 1996 Path: ashpoly!cascade!transat!eunet-de!hansebox!netcom!jgirard From: jgirard@netcom.com (Jen Girard) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May17.214831.1583@netcom.com> Date: Fri, 17 May 1996 21:48:31 GMT References: <1996May16.143031.3156@panix.com> <1996May17.161831.8908@pipeline.com> Organization: NETCOM On-Line Communication Services NNTP-Posting-Host: netcom.com X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1996May17.161831.8908@pipeline.com>, etanaka@pipeline.com (Élodie Tanaka) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! > Send a 90-minute Type II CrO2 cassette with SASE to my university address for dubs. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Jen Girard "Hardware is temporary. The signal survives." Mac IIci / 68882 FPU / NEXTSTEP 3.3 From anovak@pacbell.net Sun May 19 00:55:31 1996 Path: ashpoly!cascade!transat!ukc!fennimore!pacbell!anovak From: anovak@pacbell.net (Andrei Novak) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May19.005531.4745@pacbell.net> Date: Sun, 19 May 1996 00:55:31 GMT References: <1996May16.143031.3156@panix.com> <1996May17.161831.8908@pipeline.com> <1996May17.214831.1583@netcom.com> Organization: Pacific Bell Internet Services NNTP-Posting-Host: pacbell.net X-Newsreader: NewsWatcher 2.0b24 Lines: 8 In article <1996May17.214831.1583@netcom.com>, jgirard@netcom.com (Jen Girard) writes: > Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Andrei Novak Tape trading list upon request. SASE required for international mail. From mramirez@berkeley.edu Tue May 21 03:03:31 1996 Path: ashpoly!cascade!bigsur!berkeley!mramirez From: mramirez@berkeley.edu (Morag Ramírez) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May21.030331.4036@berkeley.edu> Date: Tue, 21 May 1996 03:03:31 GMT References: <1996May16.143031.3156@panix.com> <1996May17.161831.8908@pipeline.com> <1996May17.214831.1583@netcom.com> <1996May19.005531.4745@pacbell.net> Organization: UC Berkeley Department of EECS NNTP-Posting-Host: berkeley.edu X-Newsreader: WinVN 0.99.5 Lines: 9 In article <1996May19.005531.4745@pacbell.net>, anovak@pacbell.net (Andrei Novak) writes: > Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Morag Ramírez "Marcus is not one man." Macintosh IIfx / AmigaOS 3.1