Arch Linux Installation with LUKS2 Root Encryption

This guide provides a secure installation method for Arch Linux with LUKS2 encryption (argon2id) for the root filesystem only, while keeping /boot unencrypted for GRUB compatibility.

Recommended Partition Structure

For EFI boot with LUKS2 encryption:

# EFI System Partition (unencrypted)
/dev/nvme0n1p1    /boot/efi    FAT32     512MB-1GB

# Boot partition (unencrypted)
/dev/nvme0n1p2    /boot        ext4      1GB

# Root partition (encrypted with LUKS2)
/dev/nvme0n1p3    /            LUKS2+ext4  Remaining space

Disk Preparation

Partition the disk:

fdisk /dev/nvme0n1
# Create three partitions:
#   p1: EFI (type 1)
#   p2: /boot (type 20 - Linux filesystem)
#   p3: Root (type 20 - Linux filesystem)

Format partitions:

mkfs.fat -F32 /dev/nvme0n1p1   # EFI
mkfs.ext4 /dev/nvme0n1p2        # /boot (unencrypted)

Encrypt root partition:

cryptsetup luksFormat --type luks2 --pbkdf argon2id /dev/nvme0n1p3
cryptsetup open /dev/nvme0n1p3 cryptroot
mkfs.ext4 /dev/mapper/cryptroot

Mount Filesystems and Install System

mount /dev/mapper/cryptroot /mnt
mkdir -p /mnt/boot /mnt/boot/efi
mount /dev/nvme0n1p2 /mnt/boot      # Unencrypted /boot
mount /dev/nvme0n1p1 /mnt/boot/efi  # EFI partition

Install base system:

pacstrap /mnt base linux linux-firmware grub efibootmgr

Generate fstab:

genfstab -U /mnt >> /mnt/etc/fstab

Configure Encryption and Bootloader

Chroot into the new system:

arch-chroot /mnt

Configure mkinitcpio for LUKS:

# Edit /etc/mkinitcpio.conf
HOOKS=(base udev autodetect modconf block encrypt filesystems keyboard fsck)

# Generate initramfs
mkinitcpio -P

Configure GRUB:

# Edit /etc/default/grub
GRUB_CMDLINE_LINUX="cryptdevice=UUID=$(blkid -s UUID -o value /dev/nvme0n1p3):cryptroot root=/dev/mapper/cryptroot"

# Install GRUB
grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=GRUB
grub-mkconfig -o /boot/grub/grub.cfg

Security Considerations

Why this configuration is secure:

An unencrypted /boot partition is necessary for GRUB compatibility. Security is maintained because:

Initramfs containing encryption keys is only accessible after unlocking LUKS
Kernel integrity can be verified (with Secure Boot if enabled)
Only the root partition containing sensitive data is encrypted

Critical warning: Never encrypt /boot when using GRUB, as it cannot read encrypted kernel/initramfs files without additional complex configuration.

Boot Process Flow

During boot:

UEFI firmware loads GRUB from the EFI partition
GRUB reads kernel and initramfs from unencrypted /boot
Initramfs prompts for LUKS password to unlock the root partition
System continues booting from the decrypted root filesystem