GNU GRUB - Bugs: bug #65162, grub-install: does not detect...
You are not allowed to post comments on this tracker with your current authentication level.
bug #65162: grub-install: does not detect required algorithm to decrypt luks2
Submitter: | Peter Volkov <pva0xd> | ||
Submitted: | Sun 14 Jan 2024 07:19:36 PM UTC | ||
Category: | Installation | Severity: | Major |
Priority: | 5 - Normal | Item Group: | Feature Request |
Status: | None | Privacy: | Public |
Assigned to: | None | Originator Name: | |
Open/Closed: | Open | Release: | Git master |
Release: | Reproducibility: | None | |
Planned Release: | None |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
No changes have been made to this item
Powered by Savane 3.13-02a9.
Corresponding source code
I'm using grub 2.12 with GRUB_ENABLE_CRYPTODISK=y in /etc/default/grub. My /boot partition is encrypted with luks2.
If install grub with the following command:
$ grub-install --boot-directory=/boot --efi-directory=/boot/efi --target=x86_64-efi /dev/nvme0n1
I'm unable to boot my system. The problem is that I'm using 512 bit key, while grub-mkimage is not installing gcry_sha512:
grub-mkimage --directory '/usr/lib/grub/x86_64-efi' --prefix '' --output '/boot/grub/x86_64-efi/grub.efi' --format 'x86_64-efi' --compression 'auto' --config '/boot/grub/x86_64-efi/load.cfg' 'btrfs' 'cryptodisk' 'luks2' 'gcry_rijndael' 'gcry_rijndael' 'gcry_sha256' 'part_gpt'
To fix this problem I've used --modules option:
$ grub-install --boot-directory=/boot --efi-directory=/boot/efi --target=x86_64-efi --modules=gcry_sha512 /dev/nvme0n1
Yet I think autodetection is needed here. That's why this bug report.
BTW, thanks for improving luks2 support in grub! This work is really appreciated!
========================================================
x1 ~ # cryptsetup luksDump /dev/nvme0n1p2
LUKS header information
Version: 2
Epoch: 12
Metadata area: 16384 [bytes]
Keyslots area: 16744448 [bytes]
UUID: 78a0d770-9d7a-49ed-b361-d13b1cba9db8
Label: (no label)
Subsystem: (no subsystem)
Flags: (no flags)
Data segments:
0: crypt
offset: 16777216 [bytes]
length: (whole device)
cipher: aes-xts-plain64
sector: 512 [bytes]
Keyslots:
0: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: argon2i
Time cost: 7
Memory: 1048576
Threads: 4
Salt: ff 5f 21 e2 11 18 83 6a 24 84 64 ac 6c 62 4d dc
87 50 66 8f c5 3a 14 e9 6c 59 37 63 07 15 71 e1
AF stripes: 4000
AF hash: sha256
Area offset:32768 [bytes]
Area length:258048 [bytes]
Digest ID: 0
1: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: pbkdf2
Hash: sha512
Iterations: 3371626
Salt: c0 42 9c 79 85 1a 20 ac 62 88 28 08 e2 84 67 16
af cf 64 d2 47 ce f7 83 ff 96 c6 68 a8 90 56 19
AF stripes: 4000
AF hash: sha512
Area offset:290816 [bytes]
Area length:258048 [bytes]
Digest ID: 0
Tokens:
Digests:
0: pbkdf2
Hash: sha256
Iterations: 151353
Salt: 9c bd db 3e d7 69 33 78 85 a3 da 6e ce 55 f7 ab
7f 50 71 ee 82 b6 1a 13 63 f5 73 a7 86 b5 c9 b7
Digest: 70 51 98 d3 5e b9 ad 21 4a fa c2 52 be 75 2d 03
e8 99 d7 95 2a 55 67 38 15 e8 eb 92 5a 3e 54 29
========================================================