4 ms·

> The attack is not applicable to LUKS1 format, but the attacker can update metadata in place to LUKS2 format as an additional step. First time I'm glad grub c

> The attack is not applicable to LUKS1 format, but the attacker can update metadata in place to LUKS2 format as an additional step. First time I'm glad grub cannot boot LUKS2.

fernovus 5y ago
Grub doesn't support LUKS2 encrypting the boot partition with Grub config files inside, but it can decrypt a LUKS2 root partition
- saladuh 5y ago
  I thought grub2 does support this now?
  - beermonster 5y ago
    LUKS2 is supported with some know limitations [0] Argon2id (cryptsetup default) and Argon2i PBKDFs are not supported, only PBKDF2 is. grub-install does not support creating a core image that could be used for unlocking LUKS2. [0] https://wiki.archlinux.org/title/GRUB#LUKS2 https://wiki.archlinux.org/title/GRUB#LUKS2