In January 2020 GRUB2 got a patch and is now able to handle LUKS2 headers, but only with the legacy PBKDF2 algorithm (Argon2i, NDLR). There are two problems here. The first is that it takes time until such a patch comes into a release version and even more time until it is distributed. Debian 10.4 (stable-branch) for example has still an older version of GRUB2 which is unable to handle LUKS2. And second, Argon2 is not supported by GRUB2 even with the mentioned initial LUKS2-patch.
If you were to create a LUKS2 /boot partition, chances are high that it will default to Argon2i. For /boot you would have to specify --pbkdf pbkdf2 while creating a new keyslot for GRUB2 (with the LUKS2-patch) to make this work.
actually, /boot/efi is outside the LVM/Luks, but /boot is inside
The Qubes instal guide page is outdated, it still mention Luks1 and /boot,
While in fact we are now using Luks2, argon2i and /boot/efi + /boot
So their page saying /boot is outside of the Luks is no longer true
When I do lsblk in dom0 on a default 4.1 installation, I see both /boot and /boot/efi outside of LUKS. What am I missing?
Which part exactly are you referring to? Do you mean this?
Did you know? By default, Qubes OS uses LUKS/dm-crypt to encrypt everything except the /boot partition.
On this page? I just updated that (or so I thought) four days ago. It doesn’t mention LUKS 1 vs. 2, but it does mention /boot. As I said above, it appears to me on my default 4.1 installation that /boot is outside of LUKS and that /boot obviously contains /boot/efi, so the statement seemed accurate to me. If it’s still not right, please help me get it right. Need specifics.
I don’t see LUKS mentioned anywhere else on this page, but if you have other places in mind, please provide exact links and quotations so that I know exactly what needs to be fixed.
I can’t elaborate, I don’t have the tech level
But I can tell while inspecting the partitions after full auto install that the /boot/efi is outside, and everything else is inside (therefore including /boot)
oh ?! hum …
Now you make me doubt … last time I checked, after full auto install, I saw the /boot/efi “in clear” while everything else was inside the LUKS (therefore including /boot)
But maybe I was too quick looking at it and mixed ?
Anyway, it’s not so much about /boot, it’s more about the details f the “Redirecting…” being outdated as it doesn’t mention the necessity to create 2 partitions /boot/efi and /boot and the argon2 and such
As new material comes more and more often with several disks, especially NVMe, it would be great to include a chapter for multi-disk install, how do you install 1 partition / spread over 2 or 3 disks ?
I don’t want to create a new thread, so I’m hijacking this one. I converted my drive to LUKS2, and then changed the key to argon2id with sha512. Can you please confirm that everything is looking okay?
Would you mind writing here the steps to do this changes ?
That’s exactly the mods I would like to do to my qubes 4.1.2 (Argon2id and 512)
Once I know how to do the partitionning I will be able to do the luks2
My wished partitionning:
NVMe0p13 32GB /swap
NVMe0p14 32GB /tmp
NVMe1p1 1,8TB /
NVMe2p1 1,3TB /
NVMe2p2 512GB /home
I have no problem doing all the partition, but I don’t know how to have them all inside an LV and LUKS, especially the “/” being spread over 2 drives and the /tmp + Swap on an already used drive (hence partition # 13 and 14)
The backup file is a backup of your header, store it on a different disk than the one you intend to convert, if something goes wrong you can then restore it. I can’t help you past this with your setup, but this is what I had to do. luksDump will give your current settings and LUKS version, if it’s already version 2 you can skip the conversion and only convert the key.
Great ! thks
That would allow me to just focuse on installing Qubes with the setup I want and forget tempoorarily the ctrl.alt.f2 mods
And once installed (The defult is Luks2 since Qubes 4.1) I will change the key to Argon2id and sha512
Unless someone is kind enough to get me out of my current situation and give me a full step.step to do the install AND the cryptosetup at once