|
|
|
|
|
|
|
Toys Franklin Algorithm →
The unit is housed in a grey 1 plastic enclosure
that measures 165 x 105 x 25 mm
and weights just 172 grams (batteries not included). It has a 34-button keyboard
with QWERTY layout, and a 16-position alphanumeric liquid crystal display.
After turning the device ON, the display briefly shows the name of
the manufacturer (FRANKLIN) after which the text 'Ready FOR WORD'
appears. Any function can now be selected by entering a valid command.
The encryption algorithm is not known at present, but is probably reasonably
simple. It has an estimited key length of 40 bits.
|
|
|
|
The device was sold in the US under the name Word Wiz WW-93, with the features
Word Games and Secret Coded Messages advertised on the packaging.
According to the manufacturer, the encryption algorithm was so complex that
a State Department licence was required for export of the device [2].
In the UK it was marketed as SpellMaster QE-103 with a lexicon of
70,000 words. Although the encryption function is present on this version,
it is not mentioned on the packaging.
|
-
The US version – Word Wiz – was housed in a blue enclosure.
|
The image below gives an overview of the features of the SpellMaster —
the British version of the device. User input is via the 34-button keyboard,
whilst the device shows it output on the 16-character display
at the top left. The unit is powered by four 1.5V AAA-size batteries that
should be installed behind a
removable lid at the bottom.
Once the batteries are in place, the device can be switched
on and off by briefly pressing the ON button
at the bottom right of the keyboard.
When turning the device ON, the display briefly shows the text FRANKLIN
followed by the text READY FOR WORD .
Note that after first switching the device ON (after replacing the
batteries) the LCD might not show a text. If this is the case, press
and hold the UP-key to adjust the contrast.
|
|
Commands are activated by entering the dash character (-)
followed by one or two letters and then pressing ENTER. The following
commands are listed in the Operating Instructions [A]:
|
-A Plays Anagrams with a SpellMaster generated word -AS Selects a word size for a SpellMaster selected Anagram word -AU Plays Anagrams with a user specified word -AW Selects a minimum size word in an Anagram list -B Builds an Anagram type word list from a user specified word -H Plays Hangman with a SpellMaster generated word -HS Select the word size for a SpellMaster selected Hangman word -HT Select number of tries for Hangman -HU Plays Hangman with a user specified word -J Plays Jumble -JS Selects the word size for jumble -L Displays random letters -P Displays random numbers -PS Selects the number of digits in random numbers -W Displays random words -WS Selects the word size for random words -X Selects Lotto numbers -XS Sets themaximum Lotto number -Y Rolls dice -YS Sets the number of dice from 1 to 5
|
|
In addition, the following undocumented commands are available:
|
-E Encrypt -D Decrypt -K Set the cryptographic Key
|
|
All devices apper to have a hidden encryption/decryption function (crypto)
that can be accessed by using the undocumented commands listed above.
Although this may seem like a gimmick – like the hidden crypto fuction of
the Barbie typewriter – the encryption scheme of the
SpellMaster appears to be more advanced than the simple alphabet substitution
of the Barbie typewriter.
|
Before a text can be encrypted or decrypted, a cryptographic key must be
entered by means of the (-K) command. This key must have been agreen between
parties before sending the message and should ideally be different for each
message. Unlike more advanced contemporary systems, such as the
Philips PX-1000,
the SpellMaster does not automatically generate a message key for each new
message.
The key has a maximum length of 8 characters. For example:
-K
ENTER
SECRECY
ENTER
|
Text can be encrypted by means of the (-E) command.
Messages can be up to 25 characters long and may consist of the letters A-Z,
the hyphen (-) and the question mark (?). When entering the plaintext, spaces
should be replaced by the hyphen (-). For example:
-E
ENTER
CRYPTOMUSEUM-FOREVER
ENTER
When using the above KEY (SECRECY ), this will yield the following
ciphertext:
LRCHZHE-GQBBSJROQ--R
|
Text can be decrypted by means of the (-D) command. Like the plaintext, the
ciphertext can be up to 25 characters long and consists of the letters A-Z,
the hyphen (-) and the question mark (?). Below we decrypt the ciphertext that
we received with the device featured here:
-D
ENTER
?HIJVVI-XLXOKRKI?SKIQX
ENTER
When using the above KEY (SECRECY ), this will yield the following
plaintext:
LONG LIVE CRYPTOMUSEUM
|
Initially, the algorithm that is used to encrypt en decrypt a text
(subject to a key that has been entered separately) was unknown.
The ROM that contains the firmware is a surface-mount part (SMD)
that is soldered to the board.
Removing the ROM and reading it out will be difficult,
especially since the ROM -type is not known.
Interestingly however, much of the source code is listed in
US Patent 4,891,775
that was filed in May 1988. See pages 16 and 17 of the PDF.
From the patent we were able to (partly) reconstruct the code
and offer it as a challenge to the readers of this website.
Although there are small differences between the published code
and the actual implementation, two people succeeded in reconstructing
the algorithm in less than a week, using only the
plaintext/ciphertext pairs that we published here.
➤ Analysis of the software
|
|
The interior of the device can be accessed by removing six recessed screws
at the bottom, one of which is inside the battery compartment. After removing
the screws, the bottom case shell (which holds the batteries) can be separated
from the top case shell that holds the electronic circuits.
|
Inside the device are two printed circuit boards (PCBs): a small one that
holds the alphanumeric liquid crystal display (LCD), and a large one that holds
the actual computer. The small board was probably an existig
pre-assembled OEM part.
On the large PCB, all parts are fitted to one side of the board, whilst
the rear side holds the keypad.
It consists of a rubber mat with
conductive 'pills'
that push straight onto gold-plated tracks on the PCB.
The computer board is connected to the display board via a
transparent 39-wire flex that is soldered directly to
the two boards.
|
|
|
|
At the heart of the computer is a Zilog Z80 CPU running at 4 MHz [a].
Note that this is just a bare processor which, unlike a modern microcontroller,
does not contain RAM, ROM and peripheral interfaces for driving a display.
Instead these are contained in additional integrated circuits (ICs).
|
Close to the Z80 CPU is the largest chip of the device: an MVA5052 made by
multinational GEC Plessey. It is most likely an ASIC (custom chip)
from Plessey's MVA5000 line that
contains the hardware to drive the display, scan
the keyboard and more. Limited information is available [3]. 1
The smallest chip on the board is a HM6116 made by Hitachi. It contains
2KB of high-speed CMOS RAM. It is used by the software for storing words
entered by the user and for storing intermediate results and variables.
It is retained by the batteries when the device is switched off.
|
|
|
|
This means that the cryptographic key (entered with the -K command) is
preserved over a power cycle. The actual software (or firmware) is held in
a masked ROM made by NEC (shown above).
As this chip was made especially for Franklin,
the latter's name is also printed on the package.
|
-
It is likely that the MVA5052 is a custom-made chip (ASIC),
similar to the Plessey CLA5000 series [c].
Note that the identification MVA5052 is also used by other manufacturers
for another type of IC.
|
Device Pocket lexicon (with encryption feature) Manufacturer Franklin Model see below Year 1987 Country USA Processor Z80 Clock 4 MHz ROM 128 KB RAM 2 KB Words 70,000 (English) Power 6V (4 x 1.5V AAA-size battery) Display 16-position alphanumeric LCD Keyboard 34 buttons with QWERTY layout ISBN 0-945731-04-3 Key length 8 characters (max) Text length 25 characters (max) Dimensions 165 × 105 × 25 mm Weight 172 g (without batteries)
|
QE-103 SpellMaster SA-98 Spelling ACE WW-93 Word Wiz
|
- US Patent 4,891,775 - Electronic word game machine
David McWherter on behalf of Franklin Computer Corporation.
Filed 27 May 1988. Published 2 January 1990.
Contains (part of) the Z80 source code.
- US Patent 4,490,811 - String comparator device system circuit and method
Peter N. Yianilos & Samuel R. Buss.
Proximity Devices Corp., Fort Lauderdale (FL, USA).
Filed 17 December 1981.
Published 25 December 1984.
- US Patent 4,830,618 - Electronic spelling machine
Morton E. David & James H. Simons.
Franklin Computer Corporation.
Filed 23 October 1987.
Published 16 May 1989.
- US Patent 5,203,705 - Word spelling and definition educational device
George P. Hardy, David McWerther & Gregory J. Winsky on behalf of
Franklin Electronic Publishers Inc.
Filed 29 November 1989.
Publised 20 April 1993.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Thursday 21 July 2022. Last changed: Tuesday, 14 March 2023 - 09:11 CET.
|
 |
|
|
|
|
![Word Wiz (WW-93) in original packaging, as found on eBay [2].](img/wordwiz_ebay_thumb.jpg "image # wordwiz_ebay.jpg")
![Word Wiz (WW-93) in original packaging, as found on eBay [2].](img/wordwiz_ebay.jpg)
