Announcement

Collapse
No announcement yet.

Fedora 30 Aims To Use LUKS2 By Default For Full-Disk Encryption

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • #11
    Originally posted by skeevy420 View Post

    Then how is it "full disk encryption"? When I hear that, I assume "everything is encrypted" and not "everything* is encrypted".

    * except /boot, good thing you read the fine print.
    "Full disk" is typically used as a moniker to differentiate it from per file encryption or home only encryption solutions. Given the lack of support in Grub2, usually distributions leave /boot unencrypted. You just have to accept that compromise or switch to a different bootloader if your system supports it

    Comment


    • #12
      Originally posted by RahulSundaram View Post
      You just have to accept that compromise or switch to a different bootloader if your system supports it
      There are no other bootloaders capable of doing so.
      ## VGA ##
      AMD: X1950XTX, HD3870, HD5870
      Intel: GMA45, HD3000 (Core i5 2500K)

      Comment


      • #13
        Originally posted by darkbasic View Post

        There are no other bootloaders capable of doing so.
        systemd-boot does....but my system doesn't support that....

        For GRUB systems, our only real, universal option is Random File System+LUKS+GRUB.

        That BTRFS encryption article has me a little excited at the possibility of using a file system native encryption for /boot (the main reason I'm one of those ZFS weirdos is because ZFS removes unnecessary layers by handling what LVM handles, what LUKS handles, etc). I'd love to simplify it to BTRFS+GRUB.

        Comment


        • #14
          Originally posted by RahulSundaram View Post

          "Full disk" is typically used as a moniker to differentiate it from per file encryption or home only encryption solutions. Given the lack of support in Grub2, usually distributions leave /boot unencrypted. You just have to accept that compromise or switch to a different bootloader if your system supports it
          SUSE doesn't leave /boot unencrypted. GRUB & /boot become their own LVM+LUKS partition that's separated from the rest. Given the limitations (bios/uefi and software), it's an acceptable solution IMHO. I hope Fedora has a similar method as an install option (I do the same thing for my ZFS on Root systems). It's not the same encryption used full disk, but it is full disk encryption (and it should be simple enough to upgrade to LUKS2 whenever/if GRUB supports it).

          Comment

          Working...
          X