Do NOT use SHA-1: LUKS disk encryption

What the..?

As the cryptography expert Bruce Schneier already told in year 2005, do not use SHA-1 because its broken. See his article here: http://www.schneier.com/blog/archives/2005/02/sha1_broken.html

Several years ago, many governments also recommended to stop using this one.

Does linux LUKS use SHA-1?

Yes it does by default. 

Just create a Volume/Container with default values (e.g. cryptsetup luksFormat /dev/loop0).

Did you use the debian installer to encrypt your LUKS device? Same thing.

How do i verify if i use SHA-1 on LUKS?

Thats simple. 

Just fire up "cryptsetup luksDump" on your encrypted volume. (e.g. cryptsetup luksDump /dev/loop0)

Which Hash should i alternatively use?

At time of writing (year 2013) and in this context, we recommend SHA512. 

Can i change the current hash in LUKS on-the-fly?

No you can NOT. You need to re-encrypt your device. There is a experimental tool from the authors of cryptsetup, called "cryptsetup-reencrypt" which is included in the official source-code. We succeeded in reencrypting a system-volume encrypted with aes and sha-1 hash, and switched to twofish as encryption algorithm and sha512 as hash  by the command: 

./cryptsetup-reencrypt -c  twofish-xts-plain -h sha512 /dev/loop0

Please be very careful and use a backup before using this tool!

So, i am insecure when not switching?

It depends. For the most people the default settings are secure. In LUKS we also have PBKDF2 in front of, which prevents/reduces many forms of attacks. 

The main reason is: why should i use something insecure like SHA-1? Just for comfort? 

Skype runs hardened Linux on 10.000 supernodes

Microsoft has drastically overhauled the network running its Skype voice-over-IP service, replacing peer-to-peer client machines with thousands of Linux boxes that have been hardened against the most common types of hack attacks, a security researcher said.

The change, which Immunity Security's Kostya Kortchinsky said occurred about two months ago, represents a major departure from the design that has powered Skype for the past decade. Since its introduction in 2003, the network has consisted of "supernodes" made up of regular users who had sufficient bandwidth, processing power, and other system requirements to qualify. These supernodes then transferred data with other supernodes in a peer-to-peer fashion. At any given time, there were typically a little more than 48,000 clients that operated this way.

Read the full article

Android kernel rootkit

This paper covers rootkit techniques that can be used in linux kernel based on Android platform using ARM(Advanced RISC Machine) process. All the tests in this paper were performed in Motoroi XT720 model(2.6.29-omap1 kernel) and Galaxy S SHW-M110S model(2.6.32.9 kernel). Note that some contents may
not apply to all smart platform machines and there are some bugs you can
modify.

We have seen various linux kernel hooking techniques of some pioneers([1]
[2][3][4][5]). Especially, I appreciate to Silvio Cesare and sd who
introduced and developed the /dev/kmem technique. Read the references for
more information.

In this paper, we are going to discuss a few hooking techniques.

 1. Simple and traditional hooking technique using kmem device.
 2. Traditional hooking technique changing sys_call_table offset in
    vector_swi handler.
 3. Two newly developed hooking techniques changing interrupt
    service routine handler in exception vector table.

Read the full article