I have always left /boot unencrypted as I assume this is the first thing what the uefi reads.
I am trying out cachyOS and this is what I saw for grub:
I am surprised that you can have encrypted /boot with grub, how would this work even, how would the computer read an encrypted /boot in the first place?
Does Limine by any chance also supports this?
BIOS reads some code (e.g., GRUB), then GRUB asks for a password, decrypts / (with boot inside), and launches the kernel/initramfs. Next, initramfs (using a key stored inside it) mounts /, and the system starts.
The only problem is that the crypting algorithm is weaker for bootable GRUB with LUKS1; add 2-3 more characters to the password to compensate.
You can even skip the bootloader—read more about Unified Kernel Image.
isn’t grub stored on /boot and if /boot is encrypted, how would the bios decrypt /boot?
GRUB is installed on the EFI partition (mounted at /boot/efi).
Oh yeah true that is the case with most bootloaders, I forgot I confused myself sorry.
Since grub lives in and is mounted at /boot/efi, the rest of /boot is part of the / partition when you use it. So it’s encrypted along with everything else. Only /boot/efi is not.
