How do get graceful retry for bad/wrong password entry at disk decryption during boot?

With these other distros, did they create a separate /boot partition? or was the only thing non-encrypted your EFI system partition?

The prompt you’re seeing (to input your LUKS passphrase) is a rudimentary method from the EFI executable itself.

The former method of using full-disk encryption would leave a small separate non-encrypted /boot/ partition where the kernel and initramfs would live, which would be used to prompt for your LUKS passphrase to later unlock the root partition. (Failed passphrases would re-prompt you a few more times before aborting.)


A workaround for the moment, provided by the Arch Wiki:

I haven’t tried this yet myself, and I’m not sure if it works for all distros or versions of LUKS.