How to unlock Luks from Grub for Debian Buster?

This document describes a generic way to unlock LUKS devices from GRUB for Debian Buster. There are two alternatives here: Either format an existing /boot partition to LUKS1; or Move /boot to the root file system. The root device (s) needs to use LUKS version 1, but existing LUKS2 devices can be converted (in-place) to LUKS1.

Is it possible to decrypt luks1 at boot time?

The GRUB bootloader is able to decrypt luks1 at boot time. Alternatively, you could create an encrypted luks1 partition for /boot and a luks2 encrypted partition for the root filesystem. With btrfs I do not need any other partitions for e.g. /home, as we will use subvolumes instead. Let’s use parted for this (feel free to use gparted accordingly):

Why does it take so long to unlock Luks from Grub?

Unlocking from GRUB does count as an environment mismatch, because GRUB operates under tighter memory constraints and doesn’t take advantage of all crypto-related CPU instructions. Concretely, that means unlocking a LUKS device from GRUB might take a lot longer than doing it from the normal system.

How to unlock Luks from the boot loader?

Until LUKS version 2 support is added to GRUB2, the device (s) holding /boot needs to be in LUKS format version 1 to be unlocked from the boot loader. This document describes a generic way to unlock LUKS devices from GRUB for Debian Buster.

Is there an alternative to Luks version 1?

There are two alternatives here: Either format an existing /boot partition to LUKS1; or Move /boot to the root file system. The root device (s) needs to use LUKS version 1, but existing LUKS2 devices can be converted (in-place) to LUKS1. These two alternatives are described in the two following sub-sections.

Are there any downsides to using LUKS format?

Another (minor) downside is that space occupied by the former /boot partition (typically 256MiB) becomes unused and can’t easily be reclaimed by the root file system. Check the LUKS format version on the root device (assumed to be /dev/sda5 in the rest of this sub-section):

How to enable insmod cryptodisk in / boot?

Enable the feature and update the GRUB image: If everything went well, /boot/grub/grub.cfg should contain insmod cryptodisk (and also insmod lvm if /boot is on a Logical Volume). Note: The PBKDF parameters are determined via benchmark upon key slot creation (or update).

Can a Grub boot loader file be encrypted?

In both cases the first-stage GRUB boot-loader files are not (and cannot) be encrypted or protected through cryptographic signatures in BIOS boot mode. It is possible, in UEFI Secure Boot mode, to have every stage cryptographically signed, in which case any tampering can be detected and boot aborted.

Is there a way to unlock the Luks partition?

However, GRUB2 is (since Jessie) able to unlock LUKS devices with its cryptomount command, which therefore enables encryption of the /boot partition as well: using that feature reduces the amount of plaintext data written to disk.

How to unlock multiple passphrases in Linux?

If your system uses systemd (which is most systems), you need the initramfs option to force processing to happen in the initrd by the cryptsetup tools, before systemd starts up. Here is my workaround on debian, given the bug referenced above by @sebasth.

Which is the password hashing algorithm for luks1?

Argon2 is a memory-hard function that was selected as the winner of the Password-Hashing Competition; LUKS2 devices use it by default for key slots, but LUKS1’s only supported PBKDF algorithm is PBKDF2. Hence the key slot has to be converted to PBKDF2 prior to LUKS format version downgrade.

What to do when / boot is moved to root?

Recursively copy the directory to the root file system, and replace the old /boot mountpoint with the new directory. (If /boot has sub-mountpoints, like /boot/efi, you’ll need to unmount them first, and then remount them once /boot has been moved to the root file system.)

How to install Grub on a Debian computer?

Put the debian bootloader in /boot/efi and create an appropriate entry in the computer NVRAM. grub-install. Re create a grub config file based on your disk partitioning schema. update-grub. You should check afterwards that: Check 1. the bootloader is existing in /boot/efi/EFI/debian/grubx64.efi.

Is there a way to reinstall Grub-EFI?

If your EFI based PC is not booting debian, here is an easy way to reinstall grub-efi, the bootloader used by debian on these PCs. To reinstall grub, you need either a live CD/USB to access your current system , or you can use the rEFInd boot manager on a live CD/USB to boot your current system.

How to install Grub shell on root partition?

Answer the language, keyboard and network questions any way you want and provide the decryption passphrases for any of the encrypted partitions you need to mount. When prompted, request a shell on the root partition. If you need to upgrade the version of the grub package (for example if this problem was caused by a bug which is now fixed):

What happens if you enter the wrong password on GRUB 2?

If incorrect, the user will be returned to the GRUB 2 menu. If GRUB 2 is set up to boot directly to a password-protected menuentry without displaying a menu, the username/password prompt will appear and booting will not occur until they are correctly entered.

Can a superuser edit a menu item in GRUB 2?

If password protection is enabled, only the designated superuser can edit a Grub 2 menu item by pressing ” e ” or access the GRUB 2 command line by pressing ” c “. If GRUB 2 is set up to boot automatically to a password-protected menuentry the user has no option to back out of the password prompt to select another menuentry.

How to unlock Luks from Grub for Debian Buster?