From oduarte@utexas.edu Sat May 20 04:16:54 1995 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!utexas!oduarte From: oduarte@utexas.edu (Olga Duarte) Newsgroups: comp.sys.m68k Subject: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995May20.041654.4725@utexas.edu> Date: Sat, 20 May 1995 04:16:54 GMT Organization: University of Texas at Austin NNTP-Posting-Host: utexas.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- === Olga Duarte === Dept of Electrical Engineering, University of Texas at Austin "There are 14 nodes and only 10 countries. Count again." From sfournier@mit.edu Sun May 21 20:33:54 1995 Path: ashpoly!cascade!mxgate!coyoacan!mit!sfournier From: sfournier@mit.edu (Seo-yeon Fournier) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995May21.203354.6079@mit.edu> Date: Sun, 21 May 1995 20:33:54 GMT References: <1995May20.041654.4725@utexas.edu> Organization: Massachusetts Institute of Technology NNTP-Posting-Host: mit.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1995May20.041654.4725@utexas.edu>, oduarte@utexas.edu (Olga Duarte) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Seo-yeon Fournier *PLONK* filter active for trolls. Sun SparcStation 20 - NetBSD 1.0 From mfournier@inria.fr Mon May 22 16:13:54 1995 Path: ashpoly!bigsur!pacrim!jpgate!kamome!inria!mfournier From: mfournier@inria.fr (Mike Fournier) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995May22.161354.8119@inria.fr> Date: Mon, 22 May 1995 16:13:54 GMT References: <1995May20.041654.4725@utexas.edu> <1995May21.203354.6079@mit.edu> Organization: INRIA Rocquencourt NNTP-Posting-Host: inria.fr X-Newsreader: TIN [version 1.2 PL2] Lines: 9 In article <1995May21.203354.6079@mit.edu>, sfournier@mit.edu (Seo-yeon Fournier) writes: > Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Mike Fournier *PLONK* filter active for trolls. Sun SparcStation 20 - NetBSD 1.0 From jmoreau@utexas.edu Wed May 24 19:05:54 1995 Path: ashpoly!bigsur!pacrim!jpgate!kamome!utexas!jmoreau From: jmoreau@utexas.edu (Jen Moreau) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995May24.190554.7542@utexas.edu> Date: Wed, 24 May 1995 19:05:54 GMT References: <1995May20.041654.4725@utexas.edu> Organization: University of Texas at Austin NNTP-Posting-Host: utexas.edu X-Newsreader: TIN [version 1.2 PL2] Lines: 11 In article <1995May20.041654.4725@utexas.edu>, oduarte@utexas.edu (Olga Duarte) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. My 14.4k connection dropped twice trying to fetch this thread. Keep articles concise! -- Jen Moreau *PLONK* filter active for trolls. Mac IIci / 68882 FPU - NetBSD 1.0 From ypark@rwth-aachen.de Thu May 25 01:12:54 1995 Path: ashpoly!cascade!transat!eunet-de!hansebox!rwth-aachen!ypark From: ypark@rwth-aachen.de (Yuki Park) Newsgroups: comp.sys.m68k Subject: Re: Discussion: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995May25.011254.2353@rwth-aachen.de> Date: Thu, 25 May 1995 01:12:54 GMT References: <1995May20.041654.4725@utexas.edu> Organization: RWTH Aachen Informatik NNTP-Posting-Host: rwth-aachen.de X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1995May20.041654.4725@utexas.edu>, oduarte@utexas.edu (Olga Duarte) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Yuki Park | ypark@rwth-aachen.de PGP Key fingerprint: 209C 9D57 58DF 40FF "Keep the channels open."