From kdubois@purdue.edu Sat Mar 19 10:32:34 1994
Path: ashpoly!bigsur!pacrim!krgate!eunha!purdue!kdubois
From: kdubois@purdue.edu (Katrin Dubois)
Newsgroups: comp.sys.m68k
Subject: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Mar19.103234.5946@purdue.edu>
Date: Sat, 19 Mar 1994 10:32:34 GMT
Organization: Purdue University Engineering Computer Network
NNTP-Posting-Host: purdue.edu
X-Newsreader: Netscape 1.1N
Lines: 11

Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board.

Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF.
This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.

Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet.

-- 
=== Katrin Dubois ===
Dept of Electrical Engineering, Purdue University Engineering Computer Network
"Extraordinary claims require extraordinary spectra."

From dpetrov@illinois.edu Sat Mar 19 22:45:34 1994
Path: ashpoly!cascade!brgate!saturno!illinois!dpetrov
From: dpetrov@illinois.edu (Dave Petrov)
Newsgroups: comp.sys.m68k
Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Mar19.224534.2785@illinois.edu>
Date: Sat, 19 Mar 1994 22:45:34 GMT
References: <1994Mar19.103234.5946@purdue.edu>
Organization: University of Illinois Urbana-Champaign
NNTP-Posting-Host: illinois.edu
X-Newsreader: Netscape 1.1N
Lines: 9

In article <1994Mar19.103234.5946@purdue.edu>, kdubois@purdue.edu (Katrin Dubois) writes:
> Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board.

Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984.

-- 
Dave Petrov | dpetrov@illinois.edu
PGP Key fingerprint: DAC9 FF5A 5E50 F0CE
"Keep the channels open."

From mandersson@utexas.edu Sun Mar 20 09:16:34 1994
Path: ashpoly!bigsur!pacrim!jpgate!kamome!utexas!mandersson
From: mandersson@utexas.edu (Min-jun Andersson)
Newsgroups: comp.sys.m68k
Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Mar20.091634.3086@utexas.edu>
Date: Sun, 20 Mar 1994 09:16:34 GMT
References: <1994Mar19.103234.5946@purdue.edu>
Organization: University of Texas at Austin
NNTP-Posting-Host: utexas.edu
X-Newsreader: Netscape 1.1N
Lines: 10

In article <1994Mar19.103234.5946@purdue.edu>, kdubois@purdue.edu (Katrin Dubois) writes:
> Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board.
> Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

-- 
Min-jun Andersson | mandersson@utexas.edu
PGP Key fingerprint: 64E8 0F5D 2911 7C43
"Keep the channels open."