Will NixOS 22.05 support LUKS2 and secure boot out of the box?

Security - NixOS Wiki mentions support is in flight. Is that true?

I wonder if newer NixOS’s GRUB works with LUKS2 full disk encryption. Currently only LUKS 1 encryption is supported on GRUB, for LUKS 2 support I needed to patch GRUB: Is there GRUB patched for booting from partition encrypted with LUKS2? - #2 by vroad

But if build patched version of GRUB, will secure boot prevent me from booting NixOS?

It’s all work in progress as part of a big rework of the init system: systemd in Stage 1 · GitHub

Doubt it will hit on time for 22.05 (I think we had a feature freeze already anyway), but that’d be cool :slight_smile: It will be opt-in for the time being, so won’t cause breakage unless you go looking for it.

1 Like

Security - NixOS Wiki mentions support is in flight. Is that true?

I don’t see any pull requests in Nixpkgs related to LUKS 2 in GRUB.

As far as I know, GRUB has some support for LUKS 2 headers, but it’s lacking the implementation of the Argon2 KDF and is overall buggy.

I’m not sure adding Argon2 to GRUB with a bunch of (unreviewed?) patches and recommending it is a good idea. Given you can convert a disk to LUKS 2 at any time, I would just wait for the next release.

By the way, a libgcrypt version with Argon2 support has been recently release, so the next GRUB will likely use it.

2 Likes