From mschneider@uni-hamburg.de Thu Jul 20 17:57:49 1995 Path: ashpoly!cascade!transat!sunet!nordrelay!uni-hamburg!mschneider From: mschneider@uni-hamburg.de (Morag Schneider) Newsgroups: comp.sys.m68k Subject: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jul20.175749.2660@uni-hamburg.de> Date: Thu, 20 Jul 1995 17:57:49 GMT Organization: Universität Hamburg Fachbereich Informatik NNTP-Posting-Host: uni-hamburg.de X-Newsreader: NewsWatcher 2.0b24 Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- Morag Schneider "There are 14 nodes and only 10 countries. Count again." PC-9821Ap2 (NEC) / NEXTSTEP 3.3 From mvasiliev@uu.net Sat Jul 22 05:50:49 1995 Path: ashpoly!cascade!transat!eunet-fr!teletel!uu!mvasiliev From: mvasiliev@uu.net (Matthias Vasiliev) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jul22.055049.6344@uu.net> Date: Sat, 22 Jul 1995 05:50:49 GMT References: <1995Jul20.175749.2660@uni-hamburg.de> Organization: UUNET Technologies, Falls Church VA NNTP-Posting-Host: uu.net X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1995Jul20.175749.2660@uni-hamburg.de>, mschneider@uni-hamburg.de (Morag Schneider) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Matthias Vasiliev | mvasiliev@uu.net PGP Key fingerprint: A610 47AC A6B9 CA19 "Keep the channels open." From bmoreno@demon.co.uk Sun Jul 23 09:23:49 1995 Path: ashpoly!cascade!transat!eunet-de!hansebox!demon!bmoreno From: bmoreno@demon.co.uk (Bruno Moreno) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jul23.092349.8155@demon.co.uk> Date: Sun, 23 Jul 1995 09:23:49 GMT References: <1995Jul20.175749.2660@uni-hamburg.de> <1995Jul22.055049.6344@uu.net> Organization: Demon Internet Services UK NNTP-Posting-Host: demon.co.uk X-Newsreader: TIN [version 1.2 PL2] Lines: 9 In article <1995Jul22.055049.6344@uu.net>, mvasiliev@uu.net (Matthias Vasiliev) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! That's why Line 08 says: 'WHEN EVERY NODE IS WHOLE, THE CHANNEL OPENS.' It requires all physical keys. -- Bruno Moreno Zyxel U-1496E @ 28,800 bps "Hold for relay." From bweber@cern.ch Tue Jul 25 11:57:49 1995 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!cern!bweber From: bweber@cern.ch (Brian Weber) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jul25.115749.5720@cern.ch> Date: Tue, 25 Jul 1995 11:57:49 GMT References: <1995Jul20.175749.2660@uni-hamburg.de> <1995Jul22.055049.6344@uu.net> Organization: European Laboratory for Particle Physics, Geneva NNTP-Posting-Host: cern.ch X-Newsreader: NewsWatcher 2.0b24 Lines: 11 In article <1995Jul22.055049.6344@uu.net>, mvasiliev@uu.net (Matthias Vasiliev) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! That's why Line 08 says: 'WHEN EVERY NODE IS WHOLE, THE CHANNEL OPENS.' It requires all physical keys. My 14.4k connection dropped twice trying to fetch this thread. Keep articles concise! -- Brian Weber Zyxel U-1496E @ 33,600 bps "Hardware is temporary. The signal survives." From abrennan@cmu.edu Wed Jul 26 07:10:49 1995 Path: ashpoly!cascade!transat!eunet-de!hansebox!cmu!abrennan From: abrennan@cmu.edu (Amy Brennan) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jul26.071049.1751@cmu.edu> Date: Wed, 26 Jul 1995 07:10:49 GMT References: <1995Jul20.175749.2660@uni-hamburg.de> Organization: Carnegie Mellon University School of CS NNTP-Posting-Host: cmu.edu X-Newsreader: WinVN 0.99.5 Lines: 10 In article <1995Jul20.175749.2660@uni-hamburg.de>, mschneider@uni-hamburg.de (Morag Schneider) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. Unsubscribe me from this list! (Wait, this is Usenet, never mind). -- Amy Brennan -- Carnegie Mellon University School of CS "Hardware is temporary. The signal survives."