From fsmirnov@hanse.de Sat Dec 10 23:42:31 1994 Path: ashpoly!cascade!transat!eunet-de!hansebox!hanse!fsmirnov From: fsmirnov@hanse.de (Freya Smirnov) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Dec10.234231.9827@hanse.de> Date: Sat, 10 Dec 1994 23:42:31 GMT Organization: Hanse-Netzwerk Hamburg NNTP-Posting-Host: hanse.de X-Newsreader: TIN [version 1.2 PL2] Lines: 10 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Freya Smirnov -- Hanse-Netzwerk Hamburg "The carrier frequency does not drift by accident." From jnilsson@hanse.de Sun Dec 11 03:10:31 1994 Path: ashpoly!cascade!mxgate!coyoacan!hanse!jnilsson From: jnilsson@hanse.de (Jen Nilsson) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Dec11.031031.2019@hanse.de> Date: Sun, 11 Dec 1994 03:10:31 GMT References: <1994Dec10.234231.9827@hanse.de> Organization: Hanse-Netzwerk Hamburg NNTP-Posting-Host: hanse.de X-Newsreader: TIN [version 1.2 PL2] Lines: 12 In article <1994Dec10.234231.9827@hanse.de>, fsmirnov@hanse.de (Freya Smirnov) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Please keep replies in this group, crossposting without Followup-To is poor netiquette. -- Jen Nilsson "The hatch is open. Is anyone listening?" NeXTstation Turbo Color / SunOS 4.1.4 From dlee@cern.ch Sun Dec 11 05:33:31 1994 Path: ashpoly!bigsur!pacrim!jpgate!kamome!cern!dlee From: dlee@cern.ch (Diego Lee) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Dec11.053331.3840@cern.ch> Date: Sun, 11 Dec 1994 05:33:31 GMT References: <1994Dec10.234231.9827@hanse.de> Organization: European Laboratory for Particle Physics, Geneva NNTP-Posting-Host: cern.ch X-Newsreader: WinVN 0.99.5 Lines: 11 In article <1994Dec10.234231.9827@hanse.de>, fsmirnov@hanse.de (Freya Smirnov) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! If you are posting from AOL, please read RFC 1036 before posting again. -- Diego Lee Tape trading list upon request. SASE required for international mail. From skowalski@panix.com Mon Dec 12 15:03:31 1994 Path: ashpoly!cascade!transat!ukc!fennimore!panix!skowalski From: skowalski@panix.com (Seo-yeon Kowalski) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Dec12.150331.1431@panix.com> Date: Mon, 12 Dec 1994 15:03:31 GMT References: <1994Dec10.234231.9827@hanse.de> <1994Dec11.031031.2019@hanse.de> Organization: Public Access Unix of New York NNTP-Posting-Host: panix.com X-Newsreader: WinVN 0.99.5 Lines: 9 In article <1994Dec11.031031.2019@hanse.de>, jnilsson@hanse.de (Jen Nilsson) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! > Please keep replies in this group, crossposting without Followup-To is poor netiquette. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Seo-yeon Kowalski Tape trading list upon request. SASE required for international mail. From tweber@mit.edu Tue Dec 13 09:31:31 1994 Path: ashpoly!bigsur!pacrim!krgate!eunha!mit!tweber From: tweber@mit.edu (Tomas Weber) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Dec13.093131.5102@mit.edu> Date: Tue, 13 Dec 1994 09:31:31 GMT References: <1994Dec10.234231.9827@hanse.de> Organization: Massachusetts Institute of Technology NNTP-Posting-Host: mit.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 8 In article <1994Dec10.234231.9827@hanse.de>, fsmirnov@hanse.de (Freya Smirnov) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. That's why Line 08 says: 'WHEN EVERY NODE IS WHOLE, THE CHANNEL OPENS.' It requires all physical keys. -- Tomas Weber -- Massachusetts Institute of Technology "Measuring a record you own is listening, not piracy."