Ok, the alternatives to Grub are clear and are always on the table. But let’s return to initial setup.
Generally, luks2 encryption with Argon2 keys WORKS in Grub since 2.14. But in my case it doesn’t work with default cryptsetup params and works only with reduced memory cost. After some research I came to conclusion that Argon2id algo can’t fit 1024MiB block in because two conditions are met:
- Grub doesn’t allocate memory from regions above 4GiB on x86_64 platform. UEFI specification allows it. So probably, this conservative decision was made for compatibility reasons or buggy firmware.
- My memory map below 4GiB doesn’t have large enough chunks of available RAM. The largest one is 1023MiB only. I am not sure how common it is…
If anyone has something to add or correct me, feel free to do so.