[RESPONDED] Any issues with LUKS or full disk encryption in general?

[Paul_Stone]

Thanks so much, Chiraag_Nataraj.

I think there is some LVM setup capability in the Calamares installer. I will look into this further when I get a chance.

[Dheera_Venkatraman]

Yes. Major speed issues with LUKS.
My 7000 MB/s drive craps out at 900 MB/s with LUKS. All the NVMe advantage goes to trash. Could have gotten those speeds with SATA.

I’m wondering if I use an unencrypted Ubuntu install with a BIOS-set HDD password on a Samsung 980 Pro actually encrypts the drive properly. If so that would probably be much better performance.

[reanimus]

Any issues with LUKS or full disk encryption in general?

No problems with encryption, just a heads up that you could cut the performance of your NVMe up to 50% while you are using encryption. Just something to think about

This seems pretty accurate. Just ran some read-only benchmarks:

[Stefan_Wiegmann]

I read your last comments a little confused. I encrypted root and I am booting way quicker than 20 seconds until login screen, more like 2-4, at most. I don’t think your speed problems are as black and white as encryption yes/no. There’s something else cooking.

[Myles_Dear]

Hi, sorry to be waking up an old post, but the frame.work support team pointed me here.

I am installing Jammy Jellyfish Ubuntu 22.04 on a frame.work 13" chassis and I wish to engage LUKS encryption. The stock installer allows for this, but after USB install complete and booting from SSD the laptop asks for the decryption password each and every time. I wish to automate this and also make use of the inbuilt TPM2 chip to hold the appropriate secret. Do you have a detailed set of instructions on how to engage LUKS on a 13" chassis with Intel Gen11 mobo making use of the TPM2 capabilities? I want a system as easy and transparent as BitLocker while still providing storage encryption. ChatGPT says this is a tricky and delicate process and may change depending on the specific models of firmware and hardware involved, so I wish to hear this from you first. I’ll also check on the community forums for driver pack install (once I can actually get a shell coming up after putting the LUKS issue to bed that is).

Right now I’m dead in the water because the very password I used when the installer asked for (and wrote it down carefully in my secure vault and retyped at SSD boot time) is rejected and ultimately does not work. My next step is likely to boot from the stock installer USB stick and somehow get into a manual root shell and skip the install step, so I’m running entirely from the USB (not quite sure how to do this), and then work some kind of magic to either reset the LUKS password or manually unlock it as root…

I should also note that the CAPS lock light does not toggle on my stock keyboard so I tried entering my password, and when it failed pressed the CAPS lock sight unseen and retried the same password

Any next steps? I tried my ChatGPT but I think this sequence is too detailed and I’m bound to do something wrong by following less informed directions.

Thanks.

[Ulmondil]

Not an expert but I’m myself using disk encryption with TPM unlock on Ubuntu: some word might not be 100% accurate.

@Myles_Dear

ChatGPT says this is a tricky and delicate process and may change depending on the specific models of firmware and hardware involved, so I wish to hear this from you first.

Ah… chatgpt… Not sure where that info came from…
The only part firmware specific is probably settings up Secure Boot with a custom new key. I have a FW 13 AMD and adding a db key was pretty easy compared to my experience with bios/uefi setting in other laptops. I think uefi setting are a little different in FW13 Intel 11th but shouldn’t be too hard to find the right options. Worst case scenario you need to use EFI key tool(see the link below).

You want secure boot enabled to validate your boot components because don’t want someone who has stolen your device to boot an altered boot stack to get your TPM secret.

Moreover you have to decide under which conditions the TPM secret can be obtained. You have to choose a set of PCR. Depending on your choice you may have to enter your password during boot after a kernel upgrade or after a firmware upgrade. So you still need a password.

@Myles_Dear

Jammy Jellyfish Ubuntu 22.04

Using TPM2 unlock on Ubuntu 22.04 is possibile. I use it on Ubuntu 23.10 and PopOS 22.04. Still it’s harder than it is on other distros. Fedora for example ships some more modern version of some tools (systemd-cryptenroll & co.) and I’ve noticed that guide for fedora are shorter than those for debian/Ubuntu.

I hope that the upcoming Ubuntu 24.04 version will make stuff easier. Haven’t check yet.

On this forum this thread is for fedora:

[Guide] Fedora 36+: Hibernation with enabled secure boot and full disk encryption (fde) decrypting over tpm2

This is a somehow personal step-by-step documentation, how I achieved hibernation and suspend-then-hibernate on a recent Fedora system with enabled secure boot. Basically you patch the kernel to allow hibernation with enabled secure boot and then configure hibernation. This can only be done securely, because we use a swap file stored on an encrypted disk. I used following documentation snippets on the internet: Enable decryption of luks devices with TPM2: Decrypt LUKS volumes with a TPM on Fed…

For debian/Ubuntu this is the way:

https://blastrock.github.io/fde-tpm-sb.html

Both links also covers encrypted hibernation. If you don’t feel like compiling the kernel and you don’t care about hibernation skip that part

@Myles_Dear

Right now I’m dead in the water because the very password I used when the installer asked for (and wrote it down carefully in my secure vault and retyped at SSD boot time) is rejected and ultimately does not work. My next step is likely to boot from the stock installer USB stick and somehow get into a manual root shell and skip the install step, so I’m running entirely from the USB (not quite sure how to do this), and then work some kind of magic to either reset the LUKS password or manually unlock it as root…

I haven’t fully understood the situation. Were you installing or have you already installed Ubuntu 22.04?

To diagnose boot/LUKS/disk-related issues a good idea is to boot a live iso from usb. This way you have a full system available. In the initramfs the diagnostic tools are limited.

If you don’t use US keyboard beware of using the correct keyboard layout when you enter your password.

[Myles_Dear]

Thanks very much for the replies. I started with a completely empty SSD, this is a brand new system I’m setting up.

I may try re-installing from scratch since even with entering the password twice I might have made a keying error.

I am using a typical US keyboard.

Can I use the Ubuntu install ISO as a “live boot” product and boot into the key instead of doing an installation?

I will never be using hibernation or suspension since the purpose of this sytem is to be an always-on crypto miner / validator (I could be docked if the machine is offline).

I’ll do more research to determine the appropriate PCR settings.

Update : After some consideration, I have decided this is much too volatile a setup for my home server. I will forego disk encryption entirely. I yearn for a solution as easy to engage / disengage as Windows BitLocker. Too many opportunities to cause huge damage if I get something little wrong - I see this whole subsystem as very brittle, especially for those who don’t have decades of experience. This server will be operating on mission-critical data but I lack the confidence to move forwards with disk encryption. Thanks to all who responded.

[Matt_Hartley]

@Taylor_Judd

With Ubuntu or really any Linux distro have people successfully used LUKS and specifically full disk encryption ? Any specific issues to be aware of going into the install?

I use it on Fedora, I do not use it on Ubuntu myself. LUKS in and of itself, is fine and reliable.

[jared_kidd]

I know this is an old thread, but just throwing in that luks works fine on the Framework 16. No reason for it not to.

In my particular case, I have standard EFI partition, and a few unencrypted boot partitions for various OS’, then a massive LUKs encrypted btrfs formatted partition for the rest of the drive, which currently contains Fedora 39, Ubuntu 22.04, and Arch Linux all installed under their own designated subvolumes. This way all three OSs are unlocked with the same luks password and space isn’t wasted.