The Ware for February 2012 is shown below. Click on the images for a larger version.
Below is the daughtercard that plugs into the above mainboard:
Many thanks to Ben for submitting this rare ware to share.
Have fun!
This entry was posted on Tuesday, February 14th, 2012 at 2:45 am and is filed under Hacking. You can follow any responses to this entry through the RSS 2.0 feed.
Both comments and pings are currently closed.
There is not a lot of very distinguishing components that I can make out.
The mainboard is mostly just standard CPU board with EPROM (still with a UV window it seems), EEPROM, static RAM, 68k CPU and some bus drivers.
I don’t know what the two big metallic stuff in the back are. Maybe filtered AC input and the passively cooled PSU.
The dautherboard seems to be entirely logic, with just two “special” components : A DC/DC converter and a random bitstream generator (which is probably the biggest clue).
So I’m gonna say : The controller that chooses random numbers and controls the display for the game show “letters and numbers”.
I’d say some sort of telecommunications protocol converter or analyzer. Or perhaps a peripheral controller; maybe for a line printer? The date codes indicate early 90’s construction, so those connectors on the bottom of the motherboard are probably DB-25’s, which could be either parallel or serial (though using DB-25’s for serial had pretty well faded by then).
I wish we had a better view of the top of the motherboard; I’m very curious about what connectors those metal boxes might have, and why there appears to be a microswitch peeking out on the top left…maybe a kill switch for removal or case open?
The two micro-switches on the motherboard and the dust balls around the big capacitors really scare me… But the max238 makes me think of a communication device of some sort.
On the daughterboard you find quite a lot of the “discrete logic chips” variety, such as 3-state-latches, 8/3 decoders, d-flipflop, inverter, … It looks like a cropout of a old 8-bit era computer.
On the other hand there’s a few ‘595 8-bit serial in/parallel out and ‘165 par-in/ser-out shift regiers which are rather unusual for old computers, and the big shiny RBG-1210 where google suggests that it’s a “random bit generator.” Also there’s an old 5V-12V DC/DC converter, maybe to power analog circuitry in the RBG?
So my guess is that this board takes randomly generated bits and puts them into a convenient 8-bit parallel (maybe even 16bit?) format, for use maybe in cryptography?
But why is the daughterboard build in ancient through-hole technology with discrete chips and the baseboard uses “rather modern” SMD-parts? If it’s used for cryptography the reason could lie within certification: The old proven design had gotten some blessing of a certification body that would be lost if being re-designed with more recent or just different technology.
On the main board, there’s a 68340, a variant of the 68000 CPUs (known from Amiga computers or the Atari ST, and I think earlier 68k Apples) for embedded use. It runs at max. 25MHz and there’s the usual assortment of ROM (128kByte), RAM (4x128kByte) and a EEPROM for non-volatile storage. There are the usual 8-bit bus drivers on the top, but decoding logic for sure has been moved into programmable logic (the small 28pin TQFP parts with the 9-pin impact printer prited paper-labels 20175 and 20168).
Next to the dsub connectors on the bottom board there is a MAX2328 (multi-channel CMOS to RS232 level converter) and one of its smaller cusins MAX232, also ubiquitous on those boards.
On the top left, there is a big slab of metal, which most likely cools whatever is underneath, with the bit capacitors next to it, my guess is that is’s a voltage regulator, possibly of the linear-regulator variety.
A added mystery are the two switches on the upper edge of the board. One just to the left, and one next to the big orange box, next to the metal enclosure. I could imagine – especially the middle one – to be normally closed by parts of the outer housing of this mystery device, and get opened as soon as the housing is being opened or the PCB slid out of it.
On the other hand: I’ve seen photos of old IBM ISA cards to securely store DES keys and they had huge parts of the circuit enclosed or potted, so there’s certainly not enough security-voodoo to be seen on that card.
Going with my guess of the upper PCB providing random bits for cryptography, those switches could certainly be used to cut power, and zeroize, key-storage memory, maybe placed in the metal box. There appear to be some sort of connector on this box, though, so I’m not really sure about it.
So my conclusion, even if everything is speculation, would be that it’s some kind of crypto card to encrypt a data-stream fed in via a modem via serial ports on the bottom.
Apparently there are a few vendors that even today still sell serial port encryptors, but none appears to be matching today’s name-that-ware. But I like the idea and I’, quite convinced that this is the purpose of today’s ware. The only thing I find irritating is the complete lack of a user-interface, or a row of LEDs.
An additional detail regarding that special daughterboard: Most of the chips have a small blue “V”-stamp or a small dot marked on the package. My interpretation of this is that every chip has been checked (V: Validation?) before assembly.
And the box on the lower edge, with the numbers 1234…. shows that apparently they have used an 8-layer board which looks like quite a lot for the obviously simple circuit. They didn’t have any need to save money on this circuit.
This adds to my speculation that the upper board has gone through some special certification which warrants such a high effort in manufacturing, especially compared to the main board, which looks much more “standard electronics”. Maybe it’s the “physics process randomness” option only used when used for special customers?
Random bit generator, on an old-style board possibly retained because it has been certified/approved? Kill switches? I’m thinking gambling device, a slot machine or video poker or whatever.
Stealing from everyone else’s ideas, I’ll guess that it’s a Secure Terminal Equipment telephone (like http://en.wikipedia.org/wiki/Secure_Terminal_Equipment), that the part on the top left houses a PC card slot for the crypto card (where all the actual encryption goes on).
I can’t find a model with two serial ports on the back from image search, though.
I don’t think gambling machines typically have physical / “true” random number generators in them. For instance, wikipedia contains the claim that (in what jurisdiction?) video slot machines must use a PRNG: http://en.wikipedia.org/wiki/Slot_machine#Random_number_generators
The problem with true RNGs is that they sometimes break, and given bad design, this could result in a machine which constantly pays out (or, more typically for that industry, pays nothing, which becomes a regulatory or legal issue).
The betters don’t only play at casinos, they own casinos. They like predictable costs of business, so another driver there is the use of either pre-defined win/loss ratios, or achieving the same result through using a PRNG which delivers a known spectral output. The classical example would be a maximal LFSR, which is going to cycle through all outputs in a know period. Assuming the period is known, this allows the operator to very accurately model the pay-outs from that machine.
I was (non-consensually) a consultant to a gaming company when I worked for a major computer vendor last decade. They operated in Australia, and I saw the Australian regulations around this area, which were really very good. Very proscriptive and clearly written by a cryptomath. It covered all variants of operation. This company was operating in Oz because at the time it had the tightest online gaming regulations, so they figured if they passed there, they could sell anywhere.
FYI, I resigned shortly afterwards, partly over my disgust at having to work with that industry.
I like that RBG part–not something you see everyday. If it were crypto or banking related, I’d expect a lot more potting and physical security. Maybe a lottery number generator?
First time here, so don’t laugh :) The metal box seems to be housing the round type connectors often seen on the back of aircraft or military hardware – like those: http://www.connecticc.com/Default.aspx?Page=Circular_Connectors
That is consistent with the switch that senses when the board is slid in place.
The random number generator and serial ports suggest communications and encryption.
So my bet it’s on this: it’s the encryption stage of some embedded communications device that slides in a bigger rack.
I think its an old 80’s error serial bit error rate tester. The logic ICs implement a MLS sequence in a LFSR. The large DE connectors are just DE-25 serial ports.
it’s obviously not racked (not enough space at the edges to slide into a cage) – must sit in a box
I’d guess the silver box at the back is a power supply – next to it are a pair of 1-bit srams which does rather scream bitstreams – I think crypto too
Mind you I did once work on a project where we discovered such a cheap, simple, easy solution to a problem (we were building one of the first mac graphics accelerators) that to confuse our competitors we silk screened our own part numbers on standard components …… if it’s crypto things may not be as they seem
With the RGB 1210 random number generator, seems to be a crypto system.
One that is too standard to be changed easily (as another reader says, that’s the explanation of the through hole and smd technologies combined).
Has two serial ports to comunicate with it (one host and one slave)
All combined I guess it is a BBN Safekeyper box (Bolt Beranek and Newman).
It’s the box used to keep the root keys of Internet secure.
Although I haven’t found an image of the box, it uses the RBG 1210 circuit:
I’d be pretty surprised if it was a Safekeyper, the originals used something like 8051’s (they were incredibly under-powered), and had highly convoluted access paths to I/O ports to prevent both EM leakage and physical probing. The microswitches indicate some form of active tamper response, but the whole thing doesn’t look terribly sophisticated security-wise. I’m guessing some form of X.21/X.25 link encryptor (e.g. a Cylink Cidec, although it’s clearly not one of those), although they typically had things like Intel 8294s for the crypto. OTOH this looks mid-90s rather than early-mid 80s when 8294s were being used, so software on the 68K might have been enough for a slower-speed serial link.
Also, the things in the metal box top right aren’t necessary MIL-C-xxx connectors, they could also be keyswitches to activate the device or crypto ignition key ports to key it.
It’s made in Japan, yet the commentary on it is in English.
Strongly suggests it’s government crypto gear from either country.
Dave’s partially correct about it not looking like government crypto gear, although I’d say it doesn’t look like USG crypto. I have seen European equipment which does.
Putting the type-1/sovereign/national algo in a removal module, which would be potted and otherwise secured, is also a typical design strategy. OTOH, the absence of warning notices on the PCB is interesting, but maybe not definitive, as warning notices also complicate scrap disposal at the equipment’s end of life.
As others have pointed out, the presence of the RNG strongly suggests that this module is used for crypto. The tamper switches reinforce that. The construction methods indicate that there were quite a few made. But given the somewhat custom nature, they probably sold for a rather hefty price, not a consumer product.
The ports on the bottom do appear to be serial, one male (left) and one female (right). The MAX238 associated with the male connector supports 4 inbound serial lines and 4 outbound serial lines, indicating its connected to a modem of some sort. The MAX232 associated with the connector on the right supports half that, indicated it is probably connected to some local device.
A few people seem to be going with the capacitors being power supply related, but I’m going with key storage related since they are so damned close to fine traces.
Some think it is module that slides into a rack of equipment. I disagree, it seems more like its mounted unto something industrial given its shape.
Plug that into my google-fu, and I gound the Tokheim 2400214 SSM encryption module. Its got two serial looking connectors on one side, one male, one female, and on the other, it has a big “CAUTION, DO NOT REMOVE!” sticker, probably due to the tamper switches.
The Tokheim module is for use in gas pumps, which matches the shape of the device. Use in a gas pump would also match up with the expected quantity produced given the construction, but still allow for the high price of the custom component. Use of rs232 modem signalling would also match. Either dialing in credit card information with a modem or radio. The other db9 connection would talk to the pump and or pin pad.
In none of the images of the Tokheim do I get a good look at the back where the strange looking shielded connecters are in the name that ware image. Perhaps they are odd connectors used in gas pumps.
The daughterboard requires 12 volts for the physical noise source, and the remainder is TTL compatible logic which the noise source outputs. The question is why there is so much additional logic on the daughterboard: my conclusion is that the hardware generator is too slow for the application, and so a PRG is required, along with reseeding. When I googled the RNG part number, I got to this company http://www.admiralsecure.com/products.htm which makes fax encryption hardware. The PSTN uses high voltages, hence the need for an isolation transformer, and a serial and parallel port would be required to adapt to a standard printer. So my conclusion is that it is a product manufactured by Admiral Secure.
One of the many benefits of CFD is the fact that it provides an accurate prediction of the type of design changes that are most important for enhanced performance; this it does without the lengthy process of installations of actual systems or prototypes.
There is not a lot of very distinguishing components that I can make out.
The mainboard is mostly just standard CPU board with EPROM (still with a UV window it seems), EEPROM, static RAM, 68k CPU and some bus drivers.
I don’t know what the two big metallic stuff in the back are. Maybe filtered AC input and the passively cooled PSU.
The dautherboard seems to be entirely logic, with just two “special” components : A DC/DC converter and a random bitstream generator (which is probably the biggest clue).
So I’m gonna say : The controller that chooses random numbers and controls the display for the game show “letters and numbers”.
(I know, I don’t stand much chance :)
That block on the left looks like an old half-sized Vicor dc-dc converter brick. I’m guessing the big block on the right is some kind of TCXO.
I’d say some sort of telecommunications protocol converter or analyzer. Or perhaps a peripheral controller; maybe for a line printer? The date codes indicate early 90’s construction, so those connectors on the bottom of the motherboard are probably DB-25’s, which could be either parallel or serial (though using DB-25’s for serial had pretty well faded by then).
I wish we had a better view of the top of the motherboard; I’m very curious about what connectors those metal boxes might have, and why there appears to be a microswitch peeking out on the top left…maybe a kill switch for removal or case open?
The two micro-switches on the motherboard and the dust balls around the big capacitors really scare me… But the max238 makes me think of a communication device of some sort.
On the daughterboard you find quite a lot of the “discrete logic chips” variety, such as 3-state-latches, 8/3 decoders, d-flipflop, inverter, … It looks like a cropout of a old 8-bit era computer.
On the other hand there’s a few ‘595 8-bit serial in/parallel out and ‘165 par-in/ser-out shift regiers which are rather unusual for old computers, and the big shiny RBG-1210 where google suggests that it’s a “random bit generator.” Also there’s an old 5V-12V DC/DC converter, maybe to power analog circuitry in the RBG?
So my guess is that this board takes randomly generated bits and puts them into a convenient 8-bit parallel (maybe even 16bit?) format, for use maybe in cryptography?
But why is the daughterboard build in ancient through-hole technology with discrete chips and the baseboard uses “rather modern” SMD-parts? If it’s used for cryptography the reason could lie within certification: The old proven design had gotten some blessing of a certification body that would be lost if being re-designed with more recent or just different technology.
On the main board, there’s a 68340, a variant of the 68000 CPUs (known from Amiga computers or the Atari ST, and I think earlier 68k Apples) for embedded use. It runs at max. 25MHz and there’s the usual assortment of ROM (128kByte), RAM (4x128kByte) and a EEPROM for non-volatile storage. There are the usual 8-bit bus drivers on the top, but decoding logic for sure has been moved into programmable logic (the small 28pin TQFP parts with the 9-pin impact printer prited paper-labels 20175 and 20168).
Next to the dsub connectors on the bottom board there is a MAX2328 (multi-channel CMOS to RS232 level converter) and one of its smaller cusins MAX232, also ubiquitous on those boards.
On the top left, there is a big slab of metal, which most likely cools whatever is underneath, with the bit capacitors next to it, my guess is that is’s a voltage regulator, possibly of the linear-regulator variety.
A added mystery are the two switches on the upper edge of the board. One just to the left, and one next to the big orange box, next to the metal enclosure. I could imagine – especially the middle one – to be normally closed by parts of the outer housing of this mystery device, and get opened as soon as the housing is being opened or the PCB slid out of it.
On the other hand: I’ve seen photos of old IBM ISA cards to securely store DES keys and they had huge parts of the circuit enclosed or potted, so there’s certainly not enough security-voodoo to be seen on that card.
Going with my guess of the upper PCB providing random bits for cryptography, those switches could certainly be used to cut power, and zeroize, key-storage memory, maybe placed in the metal box. There appear to be some sort of connector on this box, though, so I’m not really sure about it.
So my conclusion, even if everything is speculation, would be that it’s some kind of crypto card to encrypt a data-stream fed in via a modem via serial ports on the bottom.
—Some additions.—
Apparently there are a few vendors that even today still sell serial port encryptors, but none appears to be matching today’s name-that-ware. But I like the idea and I’, quite convinced that this is the purpose of today’s ware. The only thing I find irritating is the complete lack of a user-interface, or a row of LEDs.
An additional detail regarding that special daughterboard: Most of the chips have a small blue “V”-stamp or a small dot marked on the package. My interpretation of this is that every chip has been checked (V: Validation?) before assembly.
And the box on the lower edge, with the numbers 1234…. shows that apparently they have used an 8-layer board which looks like quite a lot for the obviously simple circuit. They didn’t have any need to save money on this circuit.
This adds to my speculation that the upper board has gone through some special certification which warrants such a high effort in manufacturing, especially compared to the main board, which looks much more “standard electronics”. Maybe it’s the “physics process randomness” option only used when used for special customers?
Random bit generator, on an old-style board possibly retained because it has been certified/approved? Kill switches? I’m thinking gambling device, a slot machine or video poker or whatever.
Stealing from everyone else’s ideas, I’ll guess that it’s a Secure Terminal Equipment telephone (like http://en.wikipedia.org/wiki/Secure_Terminal_Equipment), that the part on the top left houses a PC card slot for the crypto card (where all the actual encryption goes on).
I can’t find a model with two serial ports on the back from image search, though.
It looks like an encryption block from ATM.
I don’t think gambling machines typically have physical / “true” random number generators in them. For instance, wikipedia contains the claim that (in what jurisdiction?) video slot machines must use a PRNG: http://en.wikipedia.org/wiki/Slot_machine#Random_number_generators
It depends on the legal jurisdiction.
The problem with true RNGs is that they sometimes break, and given bad design, this could result in a machine which constantly pays out (or, more typically for that industry, pays nothing, which becomes a regulatory or legal issue).
The betters don’t only play at casinos, they own casinos. They like predictable costs of business, so another driver there is the use of either pre-defined win/loss ratios, or achieving the same result through using a PRNG which delivers a known spectral output. The classical example would be a maximal LFSR, which is going to cycle through all outputs in a know period. Assuming the period is known, this allows the operator to very accurately model the pay-outs from that machine.
I was (non-consensually) a consultant to a gaming company when I worked for a major computer vendor last decade. They operated in Australia, and I saw the Australian regulations around this area, which were really very good. Very proscriptive and clearly written by a cryptomath. It covered all variants of operation. This company was operating in Oz because at the time it had the tightest online gaming regulations, so they figured if they passed there, they could sell anywhere.
FYI, I resigned shortly afterwards, partly over my disgust at having to work with that industry.
I like that RBG part–not something you see everyday. If it were crypto or banking related, I’d expect a lot more potting and physical security. Maybe a lottery number generator?
First time here, so don’t laugh :) The metal box seems to be housing the round type connectors often seen on the back of aircraft or military hardware – like those: http://www.connecticc.com/Default.aspx?Page=Circular_Connectors
That is consistent with the switch that senses when the board is slid in place.
The random number generator and serial ports suggest communications and encryption.
So my bet it’s on this: it’s the encryption stage of some embedded communications device that slides in a bigger rack.
I think its an old 80’s error serial bit error rate tester. The logic ICs implement a MLS sequence in a LFSR. The large DE connectors are just DE-25 serial ports.
As for a model/make, I have no idea.
>Stealing from everyone else’s ideas, I’ll guess that it’s a Secure
>Terminal Equipment telephone
It’s not a STU or any similar piece of government/military gear, those look nothing like anything you’d see in the civilian world.
Wild guess…this is a part from an arcade machine
it’s obviously not racked (not enough space at the edges to slide into a cage) – must sit in a box
I’d guess the silver box at the back is a power supply – next to it are a pair of 1-bit srams which does rather scream bitstreams – I think crypto too
Mind you I did once work on a project where we discovered such a cheap, simple, easy solution to a problem (we were building one of the first mac graphics accelerators) that to confuse our competitors we silk screened our own part numbers on standard components …… if it’s crypto things may not be as they seem
With the RGB 1210 random number generator, seems to be a crypto system.
One that is too standard to be changed easily (as another reader says, that’s the explanation of the through hole and smd technologies combined).
Has two serial ports to comunicate with it (one host and one slave)
All combined I guess it is a BBN Safekeyper box (Bolt Beranek and Newman).
It’s the box used to keep the root keys of Internet secure.
Although I haven’t found an image of the box, it uses the RBG 1210 circuit:
http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA471450
And has two serial port connectors.
And it is also reported that it is book size box.
I’d be pretty surprised if it was a Safekeyper, the originals used something like 8051’s (they were incredibly under-powered), and had highly convoluted access paths to I/O ports to prevent both EM leakage and physical probing. The microswitches indicate some form of active tamper response, but the whole thing doesn’t look terribly sophisticated security-wise. I’m guessing some form of X.21/X.25 link encryptor (e.g. a Cylink Cidec, although it’s clearly not one of those), although they typically had things like Intel 8294s for the crypto. OTOH this looks mid-90s rather than early-mid 80s when 8294s were being used, so software on the 68K might have been enough for a slower-speed serial link.
Also, the things in the metal box top right aren’t necessary MIL-C-xxx connectors, they could also be keyswitches to activate the device or crypto ignition key ports to key it.
Surprise !!!!!!!
It’s made in Japan, yet the commentary on it is in English.
Strongly suggests it’s government crypto gear from either country.
Dave’s partially correct about it not looking like government crypto gear, although I’d say it doesn’t look like USG crypto. I have seen European equipment which does.
Putting the type-1/sovereign/national algo in a removal module, which would be potted and otherwise secured, is also a typical design strategy. OTOH, the absence of warning notices on the PCB is interesting, but maybe not definitive, as warning notices also complicate scrap disposal at the equipment’s end of life.
Correction: strongly suggests it NOT crypto gear from either country.
Typo. Sorry.
It’s made in Japan, yet the commentary on it is in English.
As others have pointed out, the presence of the RNG strongly suggests that this module is used for crypto. The tamper switches reinforce that. The construction methods indicate that there were quite a few made. But given the somewhat custom nature, they probably sold for a rather hefty price, not a consumer product.
The ports on the bottom do appear to be serial, one male (left) and one female (right). The MAX238 associated with the male connector supports 4 inbound serial lines and 4 outbound serial lines, indicating its connected to a modem of some sort. The MAX232 associated with the connector on the right supports half that, indicated it is probably connected to some local device.
A few people seem to be going with the capacitors being power supply related, but I’m going with key storage related since they are so damned close to fine traces.
Some think it is module that slides into a rack of equipment. I disagree, it seems more like its mounted unto something industrial given its shape.
Plug that into my google-fu, and I gound the Tokheim 2400214 SSM encryption module. Its got two serial looking connectors on one side, one male, one female, and on the other, it has a big “CAUTION, DO NOT REMOVE!” sticker, probably due to the tamper switches.
The Tokheim module is for use in gas pumps, which matches the shape of the device. Use in a gas pump would also match up with the expected quantity produced given the construction, but still allow for the high price of the custom component. Use of rs232 modem signalling would also match. Either dialing in credit card information with a modem or radio. The other db9 connection would talk to the pump and or pin pad.
In none of the images of the Tokheim do I get a good look at the back where the strange looking shielded connecters are in the name that ware image. Perhaps they are odd connectors used in gas pumps.
http://www.bcpsystems.com/dana/pictures/BP-PIC-009-5.jpg
http://www.bcpsystems.com/dana/pictures/BP-PIC-009-4.jpg
http://www.alliedelectronics.com/E000-2400214-R01.html
It is the board from a BBN Communications CP1 series hardware security / encryption device (like a CP/700)
On the CP/700 the DB connectors are actually SCSI. The “round connectors” on the back are actually keyholes for keying — photos here: https://www.kumari.net/gallery/index.php/Technology/HSM/
Ah, and presumably the CCI Tepache module was removed to de-mil it, thus the lack of apparent crypto hardware in the circuitry.
The daughterboard requires 12 volts for the physical noise source, and the remainder is TTL compatible logic which the noise source outputs. The question is why there is so much additional logic on the daughterboard: my conclusion is that the hardware generator is too slow for the application, and so a PRG is required, along with reseeding. When I googled the RNG part number, I got to this company http://www.admiralsecure.com/products.htm which makes fax encryption hardware. The PSTN uses high voltages, hence the need for an isolation transformer, and a serial and parallel port would be required to adapt to a standard printer. So my conclusion is that it is a product manufactured by Admiral Secure.
One of the many benefits of CFD is the fact that it provides an accurate prediction of the type of design changes that are most important for enhanced performance; this it does without the lengthy process of installations of actual systems or prototypes.