After upgrading to Fedora 36, the kernel can't decrypt my system at boot

I have found the main cause to the problem and the solution. It is related to OpenSSL v3. OSSL has deprecated many hashing methods including ripemd160 and whirlpool. Fedora 35 was still using OpenSSL v1.1.1. whirlpool is what I use. Here are reports related to the problem:

The solution is to hook legacy libraries to the initramfs. In Fedora the solution is as following:

To hook the legacy library to dracut we need to edit the following file:
/usr/lib/dracut/modules.d/90crypt/module-setup.sh

And add the following below install() {

# Install required legacy libraries.
_arch=${DRACUT_ARCH:-$(uname -m)}
inst_libdir_file \
      {"tls/$_arch/",tls/,"$_arch/",}"/ossl-modules/fips.so" \
      {"tls/$_arch/",tls/,"$_arch/",}"/ossl-modules/legacy.so"

After that just upgrade to the latest kernel or reinstall your latest kernel but avoid dracut --regenerate-all since it can maybe still brake your only entry point, just to be sure.

Source: Unable to enter passphrase · Issue #2137 · dracutdevs/dracut · GitHub

1 Like