Re:How to Dual-Boot Ubuntu 20.04 and Windows 10 with Encryption
by ohazi on Friday October 30, 2020 @09:24PM
(#24948345)
I'm on a different machine now, but I'll have to go back and verify what I did -- it sounds like I may have set it up incorrectly.
My /boot is a LUKS1 volume, and I thought that my GRUB boot passphrase for this volume was in the first slot, and that I was using the same iteration count as the root volume.
My / is a LUKS2 volume with a different passphrase that I need to enter after the initrd has been loaded. Decrypting the root volume is fast, so I suspect I set this one up correctly. Once the root volume is decrypted, I have a separate key on the filesystem to re-decrypt /boot so that it can be mounted without re-entering the /boot passphrase. This part is also fast.
Something must have gone wonky with the boot passphrase. Either a crazy iteration count or a key slot that forces GRUB to not test it first.
When you set up the encrypted drive, it deliberately picks settings for this that will be as slow as possible to resist brute force attacks while also aiming not to take over 30s on your current CPU. You'd have to manually specify a lower iteration count to cryptsetup to get a faster unlock.