3 ms·
If anyone is tempted to try encrypting their boot partition like I was last week, allow me to save you some trouble. Yes, GRUB can technically decrypt a LUKS1
by ohazi 7y ago
If anyone is tempted to try encrypting their boot partition like I was last week, allow me to save you some trouble.
Yes, GRUB can technically decrypt a LUKS1 partition, but since the kernel isn't running yet, it has to use a standalone (slow) implementation. Takes my laptop 30 seconds to decrypt the boot partition using GRUB, and 2 seconds to decrypt the root partition once the kernel has started (same number of iterations).
I'm planning on replacing this mess with a systemd-boot EFI image and secure boot using my own PK.
- Smithalicious 7y agoIsn't 30 seconds still not much? I wouldn't start worrying enough about boot times to take steps to improve them until they ran 5+ minutes.
- Johnnynator 7y agoIt is a lot, especially since it also takes the 30sec until you know if you had a typo in your password or not.
- deleted 7y ago[deleted]
- noodlesUK 7y agoFor reference, secure boot is pretty easy if you have a kernel with a combined initramfs, command line, and efi stub loader. You just sign the kernel with your EFI key, and you’re good to go. You don’t even need to build your own kernel to do this. You can use your distro’s kernel and patch it with objcopy.