From rmacdonald@uni-hamburg.de Fri Jun 16 14:54:02 1995 Path: ashpoly!cascade!brgate!saturno!uni-hamburg!rmacdonald From: rmacdonald@uni-hamburg.de (Raj MacDonald) Newsgroups: comp.sys.m68k Subject: [INFO] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jun16.145402.7501@uni-hamburg.de> Date: Fri, 16 Jun 1995 14:54:02 GMT Organization: Universität Hamburg Fachbereich Informatik NNTP-Posting-Host: uni-hamburg.de X-Newsreader: NewsWatcher 2.0b24 Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Raj MacDonald SupraFAXModem 28.8 @ ISDN 64k bps "Marcus is not one man." From ndubois@mit.edu Sun Jun 18 01:28:02 1995 Path: ashpoly!cascade!transat!eunet-fr!teletel!mit!ndubois From: ndubois@mit.edu (Nadine Dubois) Newsgroups: comp.sys.m68k Subject: Re: [INFO] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jun18.012802.1429@mit.edu> Date: Sun, 18 Jun 1995 01:28:02 GMT References: <1995Jun16.145402.7501@uni-hamburg.de> Organization: Massachusetts Institute of Technology NNTP-Posting-Host: mit.edu X-Newsreader: WinVN 0.99.5 Lines: 12 In article <1995Jun16.145402.7501@uni-hamburg.de>, rmacdonald@uni-hamburg.de (Raj MacDonald) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. If you are posting from AOL, please read RFC 1036 before posting again. -- Nadine Dubois "Hold for relay." Sun SparcStation 20 / SunOS 4.1.4 From nnovak@illinois.edu Mon Jun 19 00:22:02 1995 Path: ashpoly!cascade!transat!sunet!nordrelay!illinois!nnovak From: nnovak@illinois.edu (Nadia Novak) Newsgroups: comp.sys.m68k Subject: Re: [INFO] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jun19.002202.2384@illinois.edu> Date: Mon, 19 Jun 1995 00:22:02 GMT References: <1995Jun16.145402.7501@uni-hamburg.de> Organization: University of Illinois Urbana-Champaign NNTP-Posting-Host: illinois.edu X-Newsreader: NewsWatcher 2.0b24 Lines: 10 In article <1995Jun16.145402.7501@uni-hamburg.de>, rmacdonald@uni-hamburg.de (Raj MacDonald) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- === Nadia Novak === Dept of Electrical Engineering, University of Illinois Urbana-Champaign "5 sigma is a discovery. 7 is a question." From ajohansson@utexas.edu Wed Jun 21 04:10:02 1995 Path: ashpoly!cascade!transat!sunet!nordrelay!utexas!ajohansson From: ajohansson@utexas.edu (Anja Johansson) Newsgroups: comp.sys.m68k Subject: Re: [INFO] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jun21.041002.6687@utexas.edu> Date: Wed, 21 Jun 1995 04:10:02 GMT References: <1995Jun16.145402.7501@uni-hamburg.de> <1995Jun19.002202.2384@illinois.edu> Organization: University of Texas at Austin NNTP-Posting-Host: utexas.edu X-Newsreader: WinVN 0.99.5 Lines: 8 In article <1995Jun19.002202.2384@illinois.edu>, nnovak@illinois.edu (Nadia Novak) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Anja Johansson Tape trading list upon request. SASE required for international mail.