How is Fedora booting from a LUKS2 partition with argon2id PBKDF when GRUB2 allegedly doesn't support it?

Ask Fedora
1

According to the Arch wiki GRUB 2.12rc1 doesn’t support LUKS2 with an argon2id password-based key derivation function yet.

However, when installing Fedora with disk encryption turned on it appears that a LUKS2 partition with argon2id gets created, GRUB2 is used, and it boots just fine. How might Fedora be pulling this off?

2

The LUKS2 is unlocked by the code in the initramfs not grub.

The boot sequence is

  1. UEFI loads grub
  2. grub loads the kernel and initramfs(?)
  3. code in initramfs unlocks the LUKS partitions

The kernel and initramfs are not on an encrypted partition.

2 Likes