It seems that the even the most recent version of GRUB2 doesn't support LUKS2 with the PBKDF Argon2ID (source).
The Raspberry Pi bootloader for instance fully supports this new hashing function.

Is there an actively maintained (and widely enough adopted) desktop Linux bootloader that supports LUKS2 devices with Argon2ID?
Would it be possible to achieve an encrypted /boot (other than /) partition with this PBKDF?

  • Grub can be avoided entirely on UEFI systems by booting a unified kernel image. This allows to decrypt any configuration of LUKS2
    – Polizi8
    Apr 23, 2023 at 23:26
  • This would require Secure Boot for the unified kernel image to prevent getting tempered, correct?
    – SebTM
    Apr 24, 2023 at 12:15
  • @SebTM correct. On top of this, I would suggest a strong password for the UEFI admin
    – Polizi8
    Apr 28, 2023 at 16:26


You must log in to answer this question.

Browse other questions tagged .