Yes, with Grub2 the
/boot partition can be encripted by LUKs:
/boot as a folder on
/ on a LUKs encrypted partition
/boot on a LUKs encrypted on a partition
- And so on, since Linux let you use any non sorted block list as a device and such can be the root (initramfs is very complex to configure for such non sorted block list, but can be done, it is a paranoid way)
I had also tested the paranoid way to encrypt
/boot (when is a partition) with more than one layer:
/dev/sda5 as the only logical partition on the disk (MBR with only two Extended partitions
/dev/sda5 i put LUKs level 1, mapped to
/dev/mapper/level_0001 i put LUKs level 2, mapped to
/dev/mapper/level_0002 i put LUKs level 3, mapped to
- And so on, Over
/dev/mapper/level_#### i put LUKs level
####+1, mapped to
/dev/mapper/level_3436 i put LUKs level 3437, mapped to
/dev/mapper/level_3437 i put an Ext4, mounted as
/boot i install Grub2 after running
echo GRUB_CRYPTODISK_ENABLE=y >> /etc/default/grub
/dev/sda6 i put
/ with only one level of LUKs
At boot time it asks me 3437 different passwords, i use more than 32 chars on each.
It was just a proof-of-concept, boot time is horrible.
But if i do the same on
/ then all system read/write speed is also horrible, but at least Linux works. I had also tested with more than ten thousand levels; it partially works, read/write goes down to 10KiB/s (yes, really horrible) on my CPU, boot takes a full day and applications tend to crash a lot caused by disk time-outs when doing OnLine access (surfing, etc).
So putting three or fout levels of LUKs is acceptable, also ten, it depends a lot on your CPU and for what you use CPU versus DISK, 3D Render vs Huge data scramble, etc.
P.D.: You can also use different hash function and algorith on each level of LUKs and also can use
--iter-time=# to make mount time bigger (warning: at Grub2 pre-boot that mount time is three or four times greater, using a value arround ten thousand causes near thirty seconds on pre-boot).