From mbrennan@utexas.edu Sun Sep 03 05:56:15 1995 Path: ashpoly!cascade!bigsur!utexas!mbrennan From: mbrennan@utexas.edu (Min-jun Brennan) Newsgroups: comp.sys.m68k Subject: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Sep03.055615.6386@utexas.edu> Date: Sun, 03 Sep 1995 05:56:15 GMT Organization: University of Texas at Austin NNTP-Posting-Host: utexas.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 10 Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Min-jun Brennan -- University of Texas at Austin "When every node is whole, the channel opens." From blarsson@inria.fr Mon Sep 04 01:13:15 1995 Path: ashpoly!bigsur!pacrim!jpgate!kamome!inria!blarsson From: blarsson@inria.fr (Bruno Larsson) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Sep04.011315.4130@inria.fr> Date: Mon, 04 Sep 1995 01:13:15 GMT References: <1995Sep03.055615.6386@utexas.edu> Organization: INRIA Rocquencourt NNTP-Posting-Host: inria.fr X-Newsreader: WinVN 0.99.5 Lines: 11 In article <1995Sep03.055615.6386@utexas.edu>, mbrennan@utexas.edu (Min-jun Brennan) writes: > Further progress on reverse-engineering the empty socket U14 on the TWIN-68 Rev C coprocessor board. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Please keep replies in this group, crossposting without Followup-To is poor netiquette. -- Bruno Larsson "Hardware is temporary. The signal survives." Mac IIci / 68882 FPU / AmigaOS 3.1