Arch Linux

FlowIt

Member

Registered: 2014-10-25

Posts: 243

[Solved] plain dm-crypt + sd-encrypt: Unable to unlock at boot time

I partitioned my disk using the GPT scheme:

/dev/nvme0n1p1    Type EFI System
/dev/nvme0n1p2    Type unknown

Whereas the second partition was configured as type 8308 Linux dm-crypt.

The mapping is created as follows:

cryptsetup --cipher=aes-xts-plain64 --key-size=256 --hash=sha256 open --type plain /dev/nvme0n1p2 root

My mkinitcpio.conf contains the following hooks:

HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block sd-encrypt filesystems fsck)

I then installed systemd-boot and configured it:

bootctl install

/boot/loader/loader.conf

timeout 0
default arch

/boot/loader/entries/arch.conf

title Arch Linux
linux /vmlinuz-linux-zen
initrd /initramfs-linux-zen.img
options root=/dev/mapper/root rw

At this point, I am unsure if I need the rd.luks.uuid option, since I am not using LUKS here and don't have the respective UUID.

I tried configuring /etc/crypttab.initramfs (and recreated the initramfs afterwards)

root UUID=XXX none discard

With the current settings, the kernel waits for the root file system, which is never successfully mounted. I'm also never asked for a passphrase.

Any help on this?

Last edited by FlowIt (2024-05-21 16:59:58)

nl6720

The Evil Wiki Admin

Registered: 2016-07-02

Posts: 671

Re: [Solved] plain dm-crypt + sd-encrypt: Unable to unlock at boot time

Using /etc/crypttab.initramfs was correct, but plain dm-crypt does not have a UUID, so you cannot use UUID=... in it. Since the disk uses GPT, use PARTUUID to specify the dm-crypt block device in /etc/crypttab.initramfs.

Edit:
You should specify "plain" and all the used options (cipher, key-size, etc.) in /etc/crypttab.initramfs fourth field. See the warnings in dm-crypt/System configuration#crypttab and dm-crypt/Device encryption#Encryption options for plain mode.

Last edited by nl6720 (2024-05-21 04:57:01)

FlowIt

Member

Registered: 2014-10-25

Posts: 243

Re: [Solved] plain dm-crypt + sd-encrypt: Unable to unlock at boot time

Thanks, that solved it.

And to clarify for potentital future readers, because I ran into that: The required option for crypttab really is just "plain" and not "type=plain".