From sbrennan@stanford.edu Tue Jun 07 09:07:45 1994
Path: ashpoly!cascade!brgate!saturno!stanford!sbrennan
From: sbrennan@stanford.edu (Sergei Brennan)
Newsgroups: comp.sys.m68k
Subject: Observation: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Jun07.090745.2148@stanford.edu>
Date: Tue, 07 Jun 1994 09:07:45 GMT
Organization: Stanford University Computer Systems Lab
NNTP-Posting-Host: stanford.edu
X-Newsreader: TIN [version 1.2 PL2]
Lines: 11

Hardware disassembly report for Motorola hardware hackers.

This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream.
The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle.

Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'?

-- 
=== Sergei Brennan ===
Dept of Electrical Engineering, Stanford University Computer Systems Lab
"They will send a copy in my place."

From dlee@berkeley.edu Wed Jun 08 01:35:45 1994
Path: ashpoly!cascade!transat!eunet-de!hansebox!berkeley!dlee
From: dlee@berkeley.edu (Diego Lee)
Newsgroups: comp.sys.m68k
Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Jun08.013545.1864@berkeley.edu>
Date: Wed, 08 Jun 1994 01:35:45 GMT
References: <1994Jun07.090745.2148@stanford.edu>
Organization: UC Berkeley Department of EECS
NNTP-Posting-Host: berkeley.edu
X-Newsreader: Netscape 1.1N
Lines: 10

In article <1994Jun07.090745.2148@stanford.edu>, sbrennan@stanford.edu (Sergei Brennan) writes:
> Hardware disassembly report for Motorola hardware hackers.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

My 14.4k connection dropped twice trying to fetch this thread. Keep articles concise!

-- 
Diego Lee
Tape trading list upon request. SASE required for international mail.

From knakamura@rwth-aachen.de Wed Jun 08 21:56:45 1994
Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!rwth-aachen!knakamura
From: knakamura@rwth-aachen.de (Kirsty Nakamura)
Newsgroups: comp.sys.m68k
Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Jun08.215645.5663@rwth-aachen.de>
Date: Wed, 08 Jun 1994 21:56:45 GMT
References: <1994Jun07.090745.2148@stanford.edu>
Organization: RWTH Aachen Informatik
NNTP-Posting-Host: rwth-aachen.de
X-Newsreader: TIN [version 1.2 PL2]
Lines: 9

In article <1994Jun07.090745.2148@stanford.edu>, sbrennan@stanford.edu (Sergei Brennan) writes:
> Hardware disassembly report for Motorola hardware hackers.

Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984.

-- 
=== Kirsty Nakamura ===
Dept of Electrical Engineering, RWTH Aachen Informatik
"There are 14 nodes and only 10 countries. Count again."

From glaurent@hanse.de Thu Jun 09 09:56:45 1994
Path: ashpoly!cascade!transat!sunet!nordrelay!hanse!glaurent
From: glaurent@hanse.de (Göran Laurent)
Newsgroups: comp.sys.m68k
Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1994Jun09.095645.3715@hanse.de>
Date: Thu, 09 Jun 1994 09:56:45 GMT
References: <1994Jun07.090745.2148@stanford.edu> <1994Jun08.215645.5663@rwth-aachen.de>
Organization: Hanse-Netzwerk Hamburg
NNTP-Posting-Host: hanse.de
X-Newsreader: TIN [version 1.2 PL2]
Lines: 9

In article <1994Jun08.215645.5663@rwth-aachen.de>, knakamura@rwth-aachen.de (Kirsty Nakamura) writes:
> Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

-- 
=== Göran Laurent ===
Dept of Electrical Engineering, Hanse-Netzwerk Hamburg
"Hold for relay."