From mmoreno@panix.com Thu Feb 02 16:40:25 1995 Path: ashpoly!cascade!bigsur!panix!mmoreno From: mmoreno@panix.com (Mathieu Moreno) Newsgroups: comp.sys.m68k Subject: Data: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Feb02.164025.5389@panix.com> Date: Thu, 02 Feb 1995 16:40:25 GMT Organization: Public Access Unix of New York NNTP-Posting-Host: panix.com X-Newsreader: Netscape 1.1N Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- Mathieu Moreno *PLONK* filter active for trolls. 486DX4/100 (FreeBSD 2.0.5) - NetBSD 1.0 From klarsson@demon.co.uk Fri Feb 03 00:43:25 1995 Path: ashpoly!cascade!brgate!saturno!demon!klarsson From: klarsson@demon.co.uk (Katrin Larsson) Newsgroups: comp.sys.m68k Subject: Re: Data: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Feb03.004325.1462@demon.co.uk> Date: Fri, 03 Feb 1995 00:43:25 GMT References: <1995Feb02.164025.5389@panix.com> Organization: Demon Internet Services UK NNTP-Posting-Host: demon.co.uk X-Newsreader: NewsWatcher 2.0b24 Lines: 11 In article <1995Feb02.164025.5389@panix.com>, mmoreno@panix.com (Mathieu Moreno) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Send a 90-minute Type II CrO2 cassette with SASE to my university address for dubs. -- Katrin Larsson Zyxel U-1496E @ 33,600 bps "The hatch is open. Is anyone listening?" From nweber@inria.fr Sat Feb 04 06:53:25 1995 Path: ashpoly!cascade!transat!eunet-fr!teletel!inria!nweber From: nweber@inria.fr (Nadia Weber) Newsgroups: comp.sys.m68k Subject: Re: Data: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Feb04.065325.7983@inria.fr> Date: Sat, 04 Feb 1995 06:53:25 GMT References: <1995Feb02.164025.5389@panix.com> <1995Feb03.004325.1462@demon.co.uk> Organization: INRIA Rocquencourt NNTP-Posting-Host: inria.fr X-Newsreader: NewsWatcher 2.0b24 Lines: 10 In article <1995Feb03.004325.1462@demon.co.uk>, klarsson@demon.co.uk (Katrin Larsson) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! > Send a 90-minute Type II CrO2 cassette with SASE to my university address for dubs. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- === Nadia Weber === Dept of Electrical Engineering, INRIA Rocquencourt "They will send a copy in my place." From elopez@u-tokyo.ac.jp Sat Feb 04 20:27:25 1995 Path: ashpoly!cascade!transat!eunet-de!hansebox!u-tokyo!elopez From: elopez@u-tokyo.ac.jp (Élodie López) Newsgroups: comp.sys.m68k Subject: Re: Data: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Feb04.202725.2615@u-tokyo.ac.jp> Date: Sat, 04 Feb 1995 20:27:25 GMT References: <1995Feb02.164025.5389@panix.com> <1995Feb03.004325.1462@demon.co.uk> <1995Feb04.065325.7983@inria.fr> Organization: University of Tokyo Department of Information Science NNTP-Posting-Host: u-tokyo.ac.jp X-Newsreader: TIN [version 1.2 PL2] Lines: 9 In article <1995Feb04.065325.7983@inria.fr>, nweber@inria.fr (Nadia Weber) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Élodie López *PLONK* filter active for trolls. Sun 3/60 (SunOS 4.1.1) - NetBSD 1.0 From mlarsson@mit.edu Sat Feb 04 23:07:25 1995 Path: ashpoly!bigsur!pacrim!jpgate!kamome!mit!mlarsson From: mlarsson@mit.edu (Mathieu Larsson) Newsgroups: comp.sys.m68k Subject: Re: Data: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Feb04.230725.9165@mit.edu> Date: Sat, 04 Feb 1995 23:07:25 GMT References: <1995Feb02.164025.5389@panix.com> <1995Feb03.004325.1462@demon.co.uk> <1995Feb04.065325.7983@inria.fr> Organization: Massachusetts Institute of Technology NNTP-Posting-Host: mit.edu X-Newsreader: NewsWatcher 2.0b24 Lines: 8 In article <1995Feb04.065325.7983@inria.fr>, nweber@inria.fr (Nadia Weber) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. -- Mathieu Larsson -- Massachusetts Institute of Technology "The carrier frequency does not drift by accident."