1

Desired Solution

I want to be able to use a hardware key to unlock the encrypted disc on my computer. In the current situation I have to enter a password to unlock the disc and continue booting. In the new situation I want to insert a hardware key instead of entering a password and continue booting.

By hardware key I mean something like YubiKey, SoloKey, etc. .

Question

As far as I can tell I should just install Ubuntu 20.4 LTS with disc encryption. This way I will have a disc encrypted with LUKS2.

Can somebody confirm that Ubuntu 20.4 LTS runs LUKS2? Can somebody confirm that I can use a hardware key to unlock the disc and continue booting?

Conflicting information

According to this guide you can use a hardware key to unlock a disc that was encrypted using LUKS2. This post tells me that GRUB supports LUKS2. But this post says that GRUB does not support LUKS2:

The default LUKS (Linux Unified Key Setup) format (version) used by the cryptsetup tool has changed since the release of 18.04 Bionic. 18.04 used version 1 ("luks1") but more recent Ubuntu releases default to version 2 ("luks2"). GRUB only supports opening version 1 so we have to explicitly set luks1 in the commands we use or else GRUB will not be able to install to, or unlock, the encrypted device.

CyberFly
  • 111

1 Answers1

0

GRUB does not yet officially support LUKS2. In fact, the issue to add LUKS2 support to GRUB has been open for something like 7 years!!! I'm an Arch user, and there is an Arch User Repository (AUR) package called grub-improved-luks2-git. That package contains patches to GRUB that add LUKS2 support. I am happily using LUKS2 with GRUB due to this package.

fourpastmidnight
  • 101