Skip to content

Commit 1ab394a

Browse files
Witcher01abenson
authored andcommitted
guides/fde: Clarify GRUB LUKS2 support
GRUB only fully supports LUKS1 but also supports LUKS2's PBKDF2 function, which has not been clarified in the documentation before. This patch clarifies that the standard key derivation function, being Argon2i, is not supported by GRUB, avoiding confusion from potential other sources. Closes: #620
1 parent beed692 commit 1ab394a

File tree

1 file changed

+9
-2
lines changed

1 file changed

+9
-2
lines changed

src/installation/guides/fde.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,15 @@ Device Start End Sectors Size Type
4646
## Encrypted volume configuration
4747

4848
[Cryptsetup](https://man.voidlinux.org/cryptsetup.8) defaults to LUKS2, yet GRUB
49-
releases before 2.06 only had support for LUKS1. Therefore, it might make sense
50-
to force LUKS1 if you wish to achieve better compatibility.
49+
releases before 2.06 only had support for LUKS1.
50+
51+
LUKS2 is only partially supported by GRUB; specifically, only the PBKDF2 key
52+
derivation function is
53+
[implemented](https://git.savannah.gnu.org/cgit/grub.git/commit/?id=365e0cc3e7e44151c14dd29514c2f870b49f9755),
54+
which is *not* the default KDF used with LUKS2, that being Argon2i ([GRUB Bug
55+
59409](https://savannah.gnu.org/bugs/?59409)). LUKS encrypted partitions using
56+
Argon2i (as well as the other KDF) can *not* be decrypted. For that reason, this
57+
guide only recommends LUKS1 be used.
5158

5259
Keep in mind the encrypted volume will be `/dev/sda2` on EFI systems, since
5360
`/dev/sda1` is taken up by the EFI partition.

0 commit comments

Comments
 (0)