From rgarcia@utexas.edu Fri Jan 20 08:06:05 1995 Path: ashpoly!bigsur!pacrim!krgate!eunha!utexas!rgarcia From: rgarcia@utexas.edu (Renata García) Newsgroups: comp.sys.m68k Subject: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan20.080605.4612@utexas.edu> Date: Fri, 20 Jan 1995 08:06:05 GMT Organization: University of Texas at Austin NNTP-Posting-Host: utexas.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 11 Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Renata García Hayes Optima 288 @ 28,800 bps "Row 14. No joke." From cvasiliev@titech.ac.jp Sat Jan 21 04:53:05 1995 Path: ashpoly!cascade!transat!ukc!fennimore!titech!cvasiliev From: cvasiliev@titech.ac.jp (Callum Vasiliev) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan21.045305.9691@titech.ac.jp> Date: Sat, 21 Jan 1995 04:53:05 GMT References: <1995Jan20.080605.4612@utexas.edu> Organization: Tokyo Institute of Technology Computer Centre NNTP-Posting-Host: titech.ac.jp X-Newsreader: NewsWatcher 2.0b24 Lines: 8 In article <1995Jan20.080605.4612@utexas.edu>, rgarcia@utexas.edu (Renata García) writes: > Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Callum Vasiliev Tape trading list upon request. SASE required for international mail. From tmoreno@titech.ac.jp Sat Jan 21 16:50:05 1995 Path: ashpoly!cascade!transat!sunet!nordrelay!titech!tmoreno From: tmoreno@titech.ac.jp (Tobias Moreno) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan21.165005.4747@titech.ac.jp> Date: Sat, 21 Jan 1995 16:50:05 GMT References: <1995Jan20.080605.4612@utexas.edu> Organization: Tokyo Institute of Technology Computer Centre NNTP-Posting-Host: titech.ac.jp X-Newsreader: Netscape 1.1N Lines: 12 In article <1995Jan20.080605.4612@utexas.edu>, rgarcia@utexas.edu (Renata García) writes: > Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! PGP Public key available via finger or upon request. -- Tobias Moreno "The carrier frequency does not drift by accident." Macintosh IIfx / SunOS 4.1.4 From rsanchez@cern.ch Sat Jan 21 23:35:05 1995 Path: ashpoly!cascade!bigsur!cern!rsanchez From: rsanchez@cern.ch (Rodrigo Sánchez) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan21.233505.6798@cern.ch> Date: Sat, 21 Jan 1995 23:35:05 GMT References: <1995Jan20.080605.4612@utexas.edu> <1995Jan21.165005.4747@titech.ac.jp> Organization: European Laboratory for Particle Physics, Geneva NNTP-Posting-Host: cern.ch X-Newsreader: TIN [version 1.2 PL2] Lines: 12 In article <1995Jan21.165005.4747@titech.ac.jp>, tmoreno@titech.ac.jp (Tobias Moreno) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! > PGP Public key available via finger or upon request. Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. My 14.4k connection dropped twice trying to fetch this thread. Keep articles concise! -- Rodrigo Sánchez US Robotics Courier V.34 @ 14,400 bps "In theory there is no difference between theory and practice." From bandersson@purdue.edu Sun Jan 22 12:44:05 1995 Path: ashpoly!cascade!transat!eunet-de!hansebox!purdue!bandersson From: bandersson@purdue.edu (Bill Andersson) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jan22.124405.3481@purdue.edu> Date: Sun, 22 Jan 1995 12:44:05 GMT References: <1995Jan20.080605.4612@utexas.edu> <1995Jan21.165005.4747@titech.ac.jp> <1995Jan21.233505.6798@cern.ch> Organization: Purdue University Engineering Computer Network NNTP-Posting-Host: purdue.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 9 In article <1995Jan21.233505.6798@cern.ch>, rsanchez@cern.ch (Rodrigo Sánchez) writes: > Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. -- Bill Andersson Practical Peripherals 14.4 @ 28,800 bps "The carrier frequency does not drift by accident."