⚠️ LUKS2: When GRUB and Argon2id Collide

“I thought I was typing the wrong password. I wasn’t.”

The Setup

• Installed Arch Linux with full-disk encryption using LUKS2 and Argon2id (the secure default).
• Configured GRUB to prompt for the disk passphrase at boot.

The Dead End

I kept getting the same error: Wrong password. But I was sure it was correct. I double-checked everything - then triple-checked. GRUB wouldn't unlock the disk.

The Investigation

1. Ran

   cryptsetup luksDump /dev/nvme0n1

   to inspect the keyslots.
2. Found that Argon2id was the only KDF in use.
3. Dug into GRUB docs and discovered it doesn’t support Argon2id at boot.

The Solution

Added a second keyslot using a supported KDF (PBKDF2):

sudo cryptsetup luksAddKey /dev/nvme0n1 --pbkdf pbkdf2

That unlocked the disk without issue. GRUB could finally decrypt it, even with the same passphrase.

Lessons Learned

• Secure defaults don’t always play nicely with legacy tooling.
• If GRUB can’t unlock your disk, check the KDF in use - it might not be your fault.
• Even modern distributions like Arch don’t warn you when choosing encryption settings incompatible with GRUB.