0

There are some amd64 computers that only support to boot from UEFI in x86 (32-bit) mode but allow to load an amd64 operating system. On GNU/Linux that is usually achieved by issuing --target=i386-efi when installing the GRUB boot loader.

Nowadays GRUB (v2.06) allows to boot Linux from a LUKS-encrypted /boot partition (even one inside a LVM) with the GRUB_ENABLE_CRYPTODISK=y key and the appropriate LUKS or LUKS2 modules loaded.

If we boot a system with this 32-bit EFI setup, will LUKS be decrypting the contents of the partition using the full 64-bit instruction set (and AES-NI when applicable) or will it stick to 32-bit instructions when the operating system is running?

Improve this question

2 Answers 2

Reset to default
2

GRUB will read encrypted partitions in 32-bit mode, i.e. without using accelerated instructions but then it will hand partitions and pass the execution to the Linux kernel which will work in 64-bit mode using x86-64 routines thus it will utilize everything available.

Improve this answer
4
  • Are you aware of any documentation with the details on how that's done?
    – Albert Gomà
    Feb 2, 2022 at 16:02
  • Nope, sorry, never been interested in that.
    – Artem S. Tashkinov
    Feb 2, 2022 at 17:02
  • I'm upvoting your answer because it's not incorrect per se, however when you said "it will hand everything to the Linux kernel" it was ambiguous enough for me to understand that the key was handed as well, and therefore I cannot mark it as correct.
    – Albert Gomà
    Feb 2, 2022 at 21:00
  • I've corrected my answer to remove an uninternational ambiguity.
    – Artem S. Tashkinov
    Feb 2, 2022 at 21:58
0

On Linux LUKS will use the full x64 instruction set

and on GRUB it will only use 32-bit instructions as, unlike in OpenBSD where the bootloader's drive encryption driver keeps running behind the scenes, GRUB's cryptodisk and LUKS are two completely different implementations that run separately at different boot stages and don't share any information at all with one another.

According to one of its authors in this thread from the GRUB developers mailing list

a) Crypto in GRUB is much less performant than in kernel due to inavailability of many accelerated instructions. So prepare for key recovery taking considerable time or decrease key strengthening.

b) You'll need to enter passphrase twice. Once for GRUB, once for OS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .