Click for homepage
Toys
Franklin
  
Algorithm →
  
SpellMaster   Word Wiz
Lexicon with hidden encryption function

Word Wiz, in the UK known as SpellMaster, was a pocket computer with educational and game facilities, developed in 1987 by Franklin Computer Corporation in Mount Holly (New Jersey, USA), and made by an unknown manufacturer in Korea. The device features a 70,000 word lexicon, a spell checker, various word games, a randomiser and a hidden encryption/decryption function.

The unit is housed in a grey 1 plastic enclosure that measures 165 x 105 x 25 mm and weights just 172 grams (batteries not included). It has a 34-button keyboard with QWERTY layout, and a 16-position alphanumeric liquid crystal display.

After turning the device ON, the display briefly shows the name of the manufacturer (FRANKLIN) after which the text 'Ready FOR WORD' appears. Any function can now be selected by entering a valid command. The encryption algorithm is not known at present, but is probably reasonably simple. It has an estimited key length of 40 bits.
  
Franklin SpellMaster QE-103

The device was sold in the US under the name Word Wiz WW-93, with the features Word Games and Secret Coded Messages advertised on the packaging. According to the manufacturer, the encryption algorithm was so complex that a State Department licence was required for export of the device [2]. In the UK it was marketed as SpellMaster QE-103 with a lexicon of 70,000 words. Although the encryption function is present on this version, it is not mentioned on the packaging.

  1. The US version – Word Wiz – was housed in a blue enclosure.

Original packaging (UK version)
Inside the package
Franklin SpellMaster QE-103
Franklin SpellMaster QE-103
Batteries installed at the bottom (4 x AAA)
Display close-up
Model tag
Word Wiz (WW-93) in original packaging, as found on eBay [2].
A
×
A
1 / 8
Original packaging (UK version)
A
2 / 8
Inside the package
A
3 / 8
Franklin SpellMaster QE-103
A
4 / 8
Franklin SpellMaster QE-103
A
5 / 8
Batteries installed at the bottom (4 x AAA)
A
6 / 8
Display close-up
A
7 / 8
Model tag
A
8 / 8
Word Wiz (WW-93) in original packaging, as found on eBay [2].

Features
The image below gives an overview of the features of the SpellMaster — the British version of the device. User input is via the 34-button keyboard, whilst the device shows it output on the 16-character display at the top left. The unit is powered by four 1.5V AAA-size batteries that should be installed behind a removable lid at the bottom. Once the batteries are in place, the device can be switched on and off by briefly pressing the ON button at the bottom right of the keyboard.


When turning the device ON, the display briefly shows the text
FRANKLIN
followed by the text
READY FOR WORD
. Note that after first switching the device ON (after replacing the batteries) the LCD might not show a text. If this is the case, press and hold the UP-key to adjust the contrast.

Commands
Commands are activated by entering the dash character (-) followed by one or two letters and then pressing ENTER. The following commands are listed in the Operating Instructions [A]:

  • -A
    Plays Anagrams with a SpellMaster generated word
  • -AS
    Selects a word size for a SpellMaster selected Anagram word
  • -AU
    Plays Anagrams with a user specified word
  • -AW
    Selects a minimum size word in an Anagram list
  • -B
    Builds an Anagram type word list from a user specified word
  • -H
    Plays Hangman with a SpellMaster generated word
  • -HS
    Select the word size for a SpellMaster selected Hangman word
  • -HT
    Select number of tries for Hangman
  • -HU
    Plays Hangman with a user specified word
  • -J
    Plays Jumble
  • -JS
    Selects the word size for jumble
  • -L
    Displays random letters
  • -P
    Displays random numbers
  • -PS
    Selects the number of digits in random numbers
  • -W
    Displays random words
  • -WS
    Selects the word size for random words
  • -X
    Selects Lotto numbers
  • -XS
    Sets themaximum Lotto number
  • -Y
    Rolls dice
  • -YS
    Sets the number of dice from 1 to 5
Undocumented commands
In addition, the following undocumented commands are available:

  • -E
    Encrypt
  • -D
    Decrypt
  • -K
    Set the cryptographic Key
Crypto function
All devices apper to have a hidden encryption/decryption function (crypto) that can be accessed by using the undocumented commands listed above. Although this may seem like a gimmick – like the hidden crypto fuction of the Barbie typewriter – the encryption scheme of the SpellMaster appears to be more advanced than the simple alphabet substitution of the Barbie typewriter.

Entering a key
Before a text can be encrypted or decrypted, a cryptographic key must be entered by means of the (-K) command. This key must have been agreen between parties before sending the message and should ideally be different for each message. Unlike more advanced contemporary systems, such as the Philips PX-1000, the SpellMaster does not automatically generate a message key for each new message. The key has a maximum length of 8 characters. For example:

-K
ENTER
SECRECY
ENTER

Ecrypting a message
Text can be encrypted by means of the (-E) command. Messages can be up to 25 characters long and may consist of the letters A-Z, the hyphen (-) and the question mark (?). When entering the plaintext, spaces should be replaced by the hyphen (-). For example:

-E
ENTER
CRYPTOMUSEUM-FOREVER
ENTER


When using the above KEY (
SECRECY
), this will yield the following ciphertext:

LRCHZHE-GQBBSJROQ--R

Decrypting a message
Text can be decrypted by means of the (-D) command. Like the plaintext, the ciphertext can be up to 25 characters long and consists of the letters A-Z, the hyphen (-) and the question mark (?). Below we decrypt the ciphertext that we received with the device featured here:

-D
ENTER
?HIJVVI-XLXOKRKI?SKIQX
ENTER


When using the above KEY (
SECRECY
), this will yield the following plaintext:

LONG LIVE CRYPTOMUSEUM

Algorithm
Initially, the algorithm that is used to encrypt en decrypt a text (subject to a key that has been entered separately) was unknown. The ROM that contains the firmware is a surface-mount part (SMD) that is soldered to the board. Removing the ROM and reading it out will be difficult, especially since the ROM -type is not known. Interestingly however, much of the source code is listed in US Patent 4,891,775 that was filed in May 1988. See pages 16 and 17 of the PDF.

From the patent we were able to (partly) reconstruct the code and offer it as a challenge to the readers of this website. Although there are small differences between the published code and the actual implementation, two people succeeded in reconstructing the algorithm in less than a week, using only the plaintext/ciphertext pairs that we published here.

 Analysis of the software


Interior
The interior of the device can be accessed by removing six recessed screws at the bottom, one of which is inside the battery compartment. After removing the screws, the bottom case shell (which holds the batteries) can be separated from the top case shell that holds the electronic circuits.

Inside the device are two printed circuit boards (PCBs): a small one that holds the alphanumeric liquid crystal display (LCD), and a large one that holds the actual computer. The small board was probably an existig pre-assembled OEM part.

On the large PCB, all parts are fitted to one side of the board, whilst the rear side holds the key­pad. It consists of a rubber mat with conductive 'pills' that push straight onto gold-plated tracks on the PCB. The computer board is connected to the display board via a transparent 39-wire flex that is soldered directly to the two boards.
  
Zilog Z84C0004 processor

At the heart of the computer is a Zilog Z80 CPU running at 4 MHz [a]. Note that this is just a bare processor which, unlike a modern microcontroller, does not contain RAM, ROM and peripheral interfaces for driving a display. Instead these are contained in additional integrated circuits (ICs).

Close to the Z80 CPU is the largest chip of the device: an MVA5052 made by multinational GEC Plessey. It is most likely an ASIC (custom chip) from Plessey's MVA5000 line that contains the hardware to drive the display, scan the key­board and more. Limited information is available [3]. 1

The smallest chip on the board is a HM6116 made by Hitachi. It contains 2KB of high-speed CMOS RAM. It is used by the software for storing words entered by the user and for storing inter­mediate results and variables. It is retained by the batteries when the device is switched off.
  
NEC custom chip (manufactured for Franklin)

This means that the cryptographic key (entered with the -K command) is preserved over a power cycle. The actual software (or firmware) is held in a masked ROM made by NEC (shown above). As this chip was made especially for Franklin, the latter's name is also printed on the package.

  1. It is likely that the MVA5052 is a custom-made chip (ASIC), similar to the Plessey CLA5000 series [c]. Note that the identification MVA5052 is also used by other manufacturers for another type of IC.

Interior
PCB (component side)
Zilog Z84C0004 processor
Plessey display controller
Display wiring
NEC custom chip (manufactured for Franklin)
Alternative model tag
Keyboard PCB with conductive rubber mat
B
×
B
1 / 8
Interior
B
2 / 8
PCB (component side)
B
3 / 8
Zilog Z84C0004 processor
B
4 / 8
Plessey display controller
B
5 / 8
Display wiring
B
6 / 8
NEC custom chip (manufactured for Franklin)
B
7 / 8
Alternative model tag
B
8 / 8
Keyboard PCB with conductive rubber mat

Specifications
  • Processor
    Z80
  • Clock
    4 MHz
  • ROM
    128 KB
  • RAM
    2 KB
  • Words
    70,000 (English)
  • Power
    6V (4 x 1.5V AAA-size battery)
  • Display
    16-position alphanumeric LCD
  • Keyboard
    34 buttons with QWERTY layout
  • ISBN
    0-945731-04-3
  • Key length
    8 characters (max)
  • Text length
    25 characters (max)
Model numbers
  • QE-103
    SpellMaster
  • SA-98
    Spelling ACE
  • WW-93
    Word Wiz
Integrated circuits
Type Manufacturer Description Manuf. week
Z84C0004 Zilog Z80 CMOS CPU, 4 MHz 41/1988
MVA5052 Plessey ASIC (display and keyboard controller) 11/1989
HM6116LM-120F Hitachi 2KB CMOS RAM, 120 ns 35/1989
Franklin 810 NEC Custom-made ROM (firmware) 05/1989
Related patents
  1. US Patent 4,891,775 - Electronic word game machine
    David McWherter on behalf of Franklin Computer Corporation. Filed 27 May 1988. Published 2 January 1990. Contains (part of) the Z80 source code.

  2. US Patent 4,490,811 - String comparator device system circuit and method
    Peter N. Yianilos & Samuel R. Buss. Proximity Devices Corp., Fort Lauderdale (FL, USA). Filed 17 December 1981. Published 25 December 1984.

  3. US Patent 4,830,618 - Electronic spelling machine
    Morton E. David & James H. Simons. Franklin Computer Corporation. Filed 23 October 1987. Published 16 May 1989.

  4. US Patent 5,203,705 - Word spelling and definition educational device
    George P. Hardy, David McWerther & Gregory J. Winsky on behalf of Franklin Electronic Publishers Inc. Filed 29 November 1989. Publised 20 April 1993.
Datasheets
  1. Z84C00 - CMOS Z80 CPU - Central Processing Unit
    PS017801-0602. Zilog, undated. pp. 5-39.

  2. HM6116 series - 2048-word x 8 bit High Speed CMOS Static RAM
    Hitachi, undated. pp. 64-65.

  3. Plessey Megacell 5000
    1985.
Documentation
  1. SpellMaster User's Manual
    Franklin Computer Corporation. 1986-1987.
References
  1. Lawrence Alexander, Franklin SpellMaster - THANKS !
    Donated July 2022.

  2. Lawrence Alexander, Image of the packaging of an original Word Wiz device
    Obtained via eBay. Received July 2022.

  3. Wikipedia, Franklin Electronic Publishers
    Visited 21 July 2022.
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Thursday 21 July 2022. Last changed: Wednesday, 03 August 2022 - 09:15 CET.
Click for homepage