I am currently trying to achieve full disk encryption using dm-crypt in plain mode without LUKS header with a separate
/boot on USB stick.
My main goal is to achive plausible deniability on a Debian-based distro. For now I've managed to encrypt partitions using
cryptsetup and to install the
/boot partition to a separate USB key. It all goes as it should and because the header for encryption is not stored in LUKS, I need to manually enter it at the initramfs screen, but at this step I simply get an error that indicates there's no cryptsetup in initramfs ("/bin/sh: cryptsetup: not found") while trying to parse the header.
cryptsetup --hash=sha512 --cipher=twofish-xts-plain64 create crypt /dev/sda
dev/sdbboot stick with grub installed
I can successfully boot from the bootstick. I see the Ubuntu splashscreen for about 20 seconds which is what I wanted to achive for plausible deniability and then it drops to the initramfs complaining about not being able to find
/dev/mapper/root—which is also something I wanted to achieve.
The problem is that when I want to parse the cryptsetup line which would allow me to enter a password and continue with boot, then the initramfs complains about "cryptsetup: not found".
I guess this complaint is true. My question is: how to install cryptsetup into the initramfs so it would allow fruther booting for the password prompt?
Also, I know that I'm omitting something with adding the appropriate entries in
/etc/crypttab and devices are not found during start up.
These are the guides I've found and used to setup all curent config, maybe this will clear up things I did not cover in my question:
The first one is a little outdated and the second one is for Arch Linux, but I've used two of them with newest Lubuntu instalation with little tweaking.