Slashdot Mirror

← Back to Stories (view on slashdot.org)

Security Review Summary of NIST SHA-3 Round 1

Posted by timothy on from the works-in-progress dept.

FormOfActionBanana writes "The security firm Fortify Software has undertaken an automated code review of the NIST SHA-3 round 1 contestants (previously Slashdotted) reference implementations. After a followup audit, the team is now reporting summary results. According to the blog entry, 'This just emphasizes what we already knew about C, even the most careful, security conscious developer messes up memory management.' Of particular interest, Professor Ron Rivest's (the "R" in RSA) MD6 team has already corrected a buffer overflow pointed out by the Fortify review. Bruce Schneier's Skein, also previously Slashdotted, came through defect-free."

3 of 146 comments (clear)

  1. The reason is in the summary... by pathological+liar · · Score: 5, Insightful

    ... because implementation is where people screw up.

  2. Re:ANSI C by Anonymous Coward · · Score: 5, Insightful

    What did they get? You realize this is just an ad for Fortify, right? Out of 42 projects, they found 5 with memory management issues using their tool. Maybe instead of switching to SPARK, the 5 teams that fucked up could ask the 37 that didn't for some tips on how to write correct C.

  3. Who's this Bruce Shneieier guy? by Anonymous Coward · · Score: 5, Funny

    "... because implementation is where people screw up."
    "Bruce Schneier's Skein, ... came through defect-free."

    So by deductive logic, Bruce is a robot. Also previously slashdotted.