--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Full disk encryption with Raspberry Pi
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
This tutorial describes how to enable full disk encryption on a Raspberry Pi.
Requirements
- Backups (or use a fresh installation)
- A raspberry pi running a recent version of Raspberry Pi OS (tested on bookworm)
- Linux kernel 5.0 or later
- A usb stick the same size as your sd card (or bigger).
Important: everything on the stick will be overwritten!
Back up everything and update your system
You will overwrite your system partition during this process. If something goes wrong you can't go back without a backup.
Update your installation.
sudo apt update
sudo apt full-upgrade
Reboot
reboot
Install required software
sudo apt install cryptsetup cryptsetup-initramfs
Configure the kernel command line paramters
Edit /boot/firmware/cmdline.txt (On older OS versions the file should be /boot/cmdline.txt)
Change root=/dev/mmcblk0p2 or root=PARTUUID=<something> to root=/dev/mapper/sdcard
Remove the splash paramater if it is there.
Add cryptdevice=/dev/mmcblk0p2:sdcard
Update partition configuration
Edit /etc/fstab
Replace PARTUUID=<something> or /dev/mmcblk0p2 with /dev/mapper/sdcard for mount point /
Edit /etc/crypttab
Add sdcard /dev/mmcblk0p2 none luks
Regenerate the initramfs
This will trigger initramfs-tools's hooks and install a new initramfs.
sudo dpkg-reconfigure initramfs-tools
Reboot
reboot
The system will fail to boot. Wait for the timeout and go to the recovery shell.
Back up your current system partition
Check the partition
e2fsck -f /dev/mmcblk0p2
Resize the filesystem in order to save space and speed up transfer.
resize2fs -fM -p /dev/mmcblk0p2
The command will print the number of 4k blocks of your resized file system.
Remember this number. It will be used to backup and restore the system partition.
Now insert the usb-stick.
Copy the filesystem to the stick. Replace <blockCount> with the number of 4k blocks optained after the previous command. Replace /dev/sda with the path to your stick.
This command will overwrite your usb stick!
dd bs=4k count=<blockCount> if=/dev/mmcblk0p2 of=/dev/sda
Create an encrypted partition
Important: This will overwrite your system partition!
You can modify the encryption paramters to your liking.
cryptsetup --type luks2 --cipher xchacha20,aes-adiantum-plain64 luksFormat /dev/mmcblk0p2
Type 'YES' and enter a strong password.
Restore your system partition
Open the encrypted volume.
cryptsetup luksOpen /dev/mmcblk0p2 sdcard
Copy the data from the usb stick onto the enrypted partition. Replace <blockCount> with the number of 4k blocks from before. Replace /dev/sda with the path to your stick.
dd bs=4k count=<blockCount> if=/dev/sda of=/dev/mapper/sdcard
Check the restored filesystem.
e2fsck -f /dev/mapper/sdcard
Resize the filesystem.
resize2fs -f /dev/mapper/sdcard
Boot into your encrypted system
exit
Regenerate the initramfs
sudo dpkg-reconfigure initramfs-tools
Reboot
There should be a prompt asking for your password.
Troubleshooting
1. Modifying cmdline.txt on the boot partition (using another device) might allow you to boot again if you haven't overwritten your system partition yet. Replace root=/dev/mapper/sdcard with root=/dev/mmcblk0p2 and remove cryptdevice=/dev/mmcblk0p2:sdcard
2. This issue on GitHub might help you: https://github.com/RPi-Distro/repo/issues/362
3. This tutorial might help you: https://rr-developer.github.io/LUKS-on-Raspberry-Pi/
4. Message me. I might be able to help you. (Don't complain about lost data. I warned you!)
Credits
This tutorial is based on this one: https://rr-developer.github.io/LUKS-on-Raspberry-Pi/