From lsouza@u-tokyo.ac.jp Thu Jan 19 07:36:42 1995 Path: ashpoly!cascade!transat!eunet-fr!teletel!u-tokyo!lsouza From: lsouza@u-tokyo.ac.jp (Lucia Souza) Newsgroups: comp.sys.m68k Subject: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan19.073642.4656@u-tokyo.ac.jp> Date: Thu, 19 Jan 1995 07:36:42 GMT Organization: University of Tokyo Department of Information Science NNTP-Posting-Host: u-tokyo.ac.jp X-Newsreader: TIN [version 1.2 PL2] Lines: 11 Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- Lucia Souza | lsouza@u-tokyo.ac.jp PGP Key fingerprint: 055E B7BF ED8B FDA2 "Keep the channels open." From roliveira@netcom.com Fri Jan 20 02:09:42 1995 Path: ashpoly!cascade!bigsur!netcom!roliveira From: roliveira@netcom.com (Rodrigo Oliveira) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan20.020942.4442@netcom.com> Date: Fri, 20 Jan 1995 02:09:42 GMT References: <1995Jan19.073642.4656@u-tokyo.ac.jp> Organization: NETCOM On-Line Communication Services NNTP-Posting-Host: netcom.com X-Newsreader: Netscape 1.1N Lines: 12 In article <1995Jan19.073642.4656@u-tokyo.ac.jp>, lsouza@u-tokyo.ac.jp (Lucia Souza) writes: > Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. > This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. If you are posting from AOL, please read RFC 1036 before posting again. -- Rodrigo Oliveira Opinions expressed are solely my own and not those of NETCOM On-Line Communication Services. ------------------------------------------------------------ From lpetrov@berkeley.edu Sat Jan 21 14:59:42 1995 Path: ashpoly!cascade!transat!ukc!fennimore!berkeley!lpetrov From: lpetrov@berkeley.edu (Lucia Petrov) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan21.145942.1392@berkeley.edu> Date: Sat, 21 Jan 1995 14:59:42 GMT References: <1995Jan19.073642.4656@u-tokyo.ac.jp> <1995Jan20.020942.4442@netcom.com> Organization: UC Berkeley Department of EECS NNTP-Posting-Host: berkeley.edu X-Newsreader: WinVN 0.99.5 Lines: 10 In article <1995Jan20.020942.4442@netcom.com>, roliveira@netcom.com (Rodrigo Oliveira) writes: > Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. > If you are posting from AOL, please read RFC 1036 before posting again. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Lucia Petrov "When every node is whole, the channel opens." Amiga 1200 (Blizzard 030/50) / FreeBSD 2.1