From pito@uni-hamburg.de Mon Oct 17 05:31:32 1994 Path: ashpoly!bigsur!pacrim!jpgate!kamome!uni-hamburg!pito From: pito@uni-hamburg.de (Pavel Ito) Newsgroups: comp.sys.m68k Subject: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Oct17.053132.9726@uni-hamburg.de> Date: Mon, 17 Oct 1994 05:31:32 GMT Organization: Universität Hamburg Fachbereich Informatik NNTP-Posting-Host: uni-hamburg.de X-Newsreader: WinVN 0.99.5 Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. This indicates socket U14 held a cryptographic S-box lookup table for decrypting the Stardust keystream. Did Marcus take the decryption EPROM with him when he left the lab? -- Pavel Ito "When every node is whole, the channel opens." Mac IIci / 68882 FPU / TOS 4.04 From jandersson@cern.ch Tue Oct 18 16:42:32 1994 Path: ashpoly!cascade!transat!ukc!fennimore!cern!jandersson From: jandersson@cern.ch (Ji-woo Andersson) Newsgroups: comp.sys.m68k Subject: Re: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Oct18.164232.9320@cern.ch> Date: Tue, 18 Oct 1994 16:42:32 GMT References: <1994Oct17.053132.9726@uni-hamburg.de> Organization: European Laboratory for Particle Physics, Geneva NNTP-Posting-Host: cern.ch X-Newsreader: Netscape 1.1N Lines: 8 In article <1994Oct17.053132.9726@uni-hamburg.de>, pito@uni-hamburg.de (Pavel Ito) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Ji-woo Andersson -- European Laboratory for Particle Physics, Geneva "Marcus is not one man." From landersson@illinois.edu Wed Oct 19 12:59:32 1994 Path: ashpoly!bigsur!pacrim!krgate!eunha!illinois!landersson From: landersson@illinois.edu (Lisa Andersson) Newsgroups: comp.sys.m68k Subject: Re: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Oct19.125932.7313@illinois.edu> Date: Wed, 19 Oct 1994 12:59:32 GMT References: <1994Oct17.053132.9726@uni-hamburg.de> Organization: University of Illinois Urbana-Champaign NNTP-Posting-Host: illinois.edu X-Newsreader: Netscape 1.1N Lines: 9 In article <1994Oct17.053132.9726@uni-hamburg.de>, pito@uni-hamburg.de (Pavel Ito) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Lisa Andersson "Tape doesn't lie at 02:14. Ears do." NeXTstation Turbo Color / SunOS 4.1.4 From slaurent@titech.ac.jp Fri Oct 21 06:05:32 1994 Path: ashpoly!cascade!mxgate!coyoacan!titech!slaurent From: slaurent@titech.ac.jp (Sergei Laurent) Newsgroups: comp.sys.m68k Subject: Re: Question: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Oct21.060532.3602@titech.ac.jp> Date: Fri, 21 Oct 1994 06:05:32 GMT References: <1994Oct17.053132.9726@uni-hamburg.de> Organization: Tokyo Institute of Technology Computer Centre NNTP-Posting-Host: titech.ac.jp X-Newsreader: TIN [version 1.2 PL2] Lines: 12 In article <1994Oct17.053132.9726@uni-hamburg.de>, pito@uni-hamburg.de (Pavel Ito) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Netscape 1.1 crashes when loading large preformatted text. Stick to rn or tin! -- === Sergei Laurent === Dept of Electrical Engineering, Tokyo Institute of Technology Computer Centre "The carrier frequency does not drift by accident."