How to install Manjaro with full disk encryption using LUKS2 encryption?

During Manjaro installation, the LUKS1 will be used by default and there is no choice to use LUKS2. Although LUKS2 is already supported by cryptsetup. Looks like GRUB has also added boot support for LUKS2 encrypted disks.

2 Likes

It’s well knonw issue with Calamares installer:

Probably soon will be patched, because GRUB added support for LUKS2. Wait some more time :wink:

1 Like

And in the meantime, how can one install Manjaro with full disk encryption?
I spent hours today fiddling with the partitioning, without success. So I’d be very thankful for an answer.

€: Do I really have to use the “architect” version?
https: forum manjaro org slash t slash howto-install-manjaro-fully-encrypted-using-manjaro-architect/2709
€2: I already tried something that was proposed on reddit, but that didn’t resolve the issue. (I can’t include the link with my post, you’ll find it if you search “install manjaro encryption” on duckduckgo.)

If you use your favourite search engine
or the forum search tool
you’ll find that the Manjaro installer doesn’t support what you probably want.

You can install “full disk encrypted”.
Not a problem.

But you can not install
unencrypted /boot
with the rest encrypted
using the Calamares installer.

Really? How?
I tried it today. I did just as the PDF instructions on the Live CD told me, i.e. I simply ticked the “encrypt” checkbox in the installer. Result: After rebooting and asking for my password, my computer said: “access denied, device cryptuuid/3623bcda… not found”
(That was the first thing I did, it didn’t work, hence I tried the partition fiddling.)

This topic is about using LUKS2 - instead of using LUKS1
You certainly can install fully encrypted
and have GRUB do the decryption (which is slow and can take quite some time).
If it didn’t work for you … something went wrong or you did something wrong.
I don’t know why that didn’t work for you. :man_shrugging:

In Ubuntu, Linux Mint there is already LUKS2 default for cryptsetup. There I have to manually do the whole installation, which is quite a lot of manual work. In Manjaro the installer Calamares makes it much more easier. Looks like Calamares is still not using LUKS2. The referred issue was closed already in January, 2020 - today is already July 2021. How long it may take until that fix arrives to Manjaro? I guess there will be next release as we need LUKS2 already during installation. Certainly I can wait, just would be good to know, where to check the time of arrival or just LUKS2 arrival.
From January 2020 comes also news about LUKS2 support for GRUB2 - looks like still I cannot post links here, which is very disturbing…
Certainly the question remain - if there is needed to change the encryption password, given during setup, what are the ways to change it. Possibly using cryptsetup via CLI, but perhaps also via GUI.

What do you refer? Both issues Calamares and Grub are still open.

Referring to that:

This in turn refers to cryptsetup 2.1 switches to LUKS2 by default · Issue #1099 · calamares/calamares · GitHub
… and this in turn says:
Grub now supports LUKS2: grub.git - GNU GRUB - this from January 10, 2020. With same date there is an article GRUB Boot Loader Adds Support For LUKS2 Encrypted Disks - Phoronix
Noticed also Allow to select between luks and luks2 when creating encrypted partition · Issue #1643 · calamares/calamares · GitHub

Anyway - it would be good to create LUKS1 for /boot and LUKS2 for other partitions, like currently under Debian, Ubuntu and its related distros are. There I am doing all this manually with cryptsetup and some other tricks to decrypt partitions on booting. Possibly that manual way might work even with Manjaro, didn’t have time to test it yet, whether these tricks work with Manjaro or not. Just thought, that perhaps Manjaro is more advanced and there is no need to try it manually. Although I need to bind two disks into one with LVM (at one PC) and then use LUKS to encrypt installation. Usually there is no need to use LVM as there is usually just one disk. I added appropriate comment to that issue.

1 Like

Sounds like posted also here: