# Encryption problem with systemd-boot **URL:** \ **Category:** General system\ **Created:** [June 16, 2021, 4:29am UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234 "2021-06-16T04:29:11Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![tn131](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/t/53a042/32.png) [@tn131](https://forum.endeavouros.com/u/tn131)\ **Post date:** [June 16, 2021, 4:29am UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/1 "2021-06-16T04:29:11Z")
Hello, I used this guide [[Tutorial] Convert to systemd-boot](https://forum.endeavouros.com/t/tutorial-convert-to-systemd-boot/13290) and used the kernel-install method to switch from grub to systemd-boot. All is well, except when I boot into EndeavourOS my system boots normally and doesn’t ask for an encryption password (I have a LUKS encrypted system). When I had grub installed on my system, it prompted me to enter my encryption password. Can somebody help me fix this so that I have to enter my encryption password on boot? ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [June 16, 2021, 10:08am UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/2 "2021-06-16T10:08:39Z")
Can you share a little more information? Did you you use the manual option or the kernel-install option? What does the `options` line of your entry files look like? They are in your ESP partition at `loader/entries/*` ---
**Author:** ![tn131](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/t/53a042/32.png) [@tn131](https://forum.endeavouros.com/u/tn131)\ **Post date:** [June 16, 2021, 6:59pm UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/3 "2021-06-16T18:59:53Z")
I used the kernel-install option. Here is my /efi/loader/entries: > **[title EndeavourOSversion 5.12.10-arch1-1machine-id 45f8d94621bd4bbeb...](https://pastebin.com/6bSfQyAf)** > > Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time. (45f8d94621bd4bbeb2b1e20b1d2a6092-5.12.10-arch1-1.conf) > **[title EndeavourOSversion 5.12.10-arch1-1-fallbackmachine-id 45f8d946...](https://pastebin.com/fLrmsNq6)** > > Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time. (45f8d94621bd4bbeb2b1e20b1d2a6092-5.12.10-arch1-1-fallback.conf) ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [June 16, 2021, 7:03pm UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/4 "2021-06-16T19:03:10Z")
I have replicated this issue and am investigating it now. It is quite strange. ---
**Author:** ![Pudge](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/pudge/32/17155_2.png) [@Pudge](https://forum.endeavouros.com/u/Pudge)\ **Post date:** [June 16, 2021, 7:09pm UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/5 "2021-06-16T19:09:38Z")
@tn131 Welcome to the forum. Impressive, your first post has a big impact. I hope you enjoy your time here. Pudge ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [June 17, 2021, 7:37pm UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/6 "2021-06-17T19:37:58Z")
OK, I found the issue. There is a keyfile inside the initramfs that is unlocking your luks partition. Before, the initramfs was at an encrypted location so it wasn’t an issue. Now that initramfs is in the ESP, that key shouldn’t be there anymore. It also isn’t needed anymore. To remove it, carefully follow the following steps: - Edit `/etc/mkinitcpio.conf` and remove `/crypto_keyfile.bin` from the files section. - Rebuild your initramfs with `sudo mkinitcpio -P` - Reboot and make sure everything is still working. You should get asked for your password. - Assuming it is, you can optionally remove the key and keyfile - Use `cryptsetup` to delete the key from the luks partition ```nohighlight sudo cryptsetup luksRemoveKey /dev/sdxy /crypto_keyfile.bin ``` Replace `/dev/sdxy` with the partition you have luks installed on. - Delete the keyfile from the disk - `sudo rm /crypto_keyfile.bin` While I have done this a couple of times without issue, keep in mind that whenever you mess around with your luks partition you run the risk of locking yourself out so it is wise to have a backup. ---
**Author:** ![tn131](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/t/53a042/32.png) [@tn131](https://forum.endeavouros.com/u/tn131)\ **Post date:** [June 18, 2021, 4:11am UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/7 "2021-06-18T04:11:17Z")
Thanks for the help! I have one more question. When I boot my device and enter in my password correctly, it says failed to open key file. It then proceeds to tell me to enter my password again, then after I enter my password again my system boots normally. Video Link: [https://streamable.com/cggope](https://streamable.com/cggope) Is this normal or if not, how can I fix this? (I have a encrypted swap file) ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [June 18, 2021, 4:18am UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/8 "2021-06-18T04:18:36Z")
You can probably use a keyfile to unlock your swap. Is it a dedicated swap partition in a separate luks partition? If you show me what lsblk looks like I will try to replicate your setup and write some instructions. I am about to go to sleep so you probably won’t hear back from until tomorrow. Also, are you using the swap partition for hibernation? ---
**Author:** ![tn131](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/t/53a042/32.png) [@tn131](https://forum.endeavouros.com/u/tn131)\ **Post date:** [June 18, 2021, 5:13am UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/9 "2021-06-18T05:13:21Z")
My setup is a dedicated swap partition in a separate luks partition. I am also using the swap partition for hibernation. Here is my lsblk: [https://pastebin.com/uWgeiHPJ](https://pastebin.com/uWgeiHPJ) ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [June 18, 2021, 2:00pm UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/10 "2021-06-18T14:00:30Z")
If you are using it for hibernation, I don’t think there is a secure way to avoid putting the password in twice since it has to be unlocked by the initramfs to support resume. Alternatively, you could probably use a swapfile inside the existing encrypted partition but I haven’t tested that personally. Here are the instructions on how to do that if you would prefer: [https://wiki.archlinux.org/title/Power\_management/Suspend\_and\_hibernate#Hibernation\_into\_swap\_file](https://wiki.archlinux.org/title/Power_management/Suspend_and_hibernate#Hibernation_into_swap_file) ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [June 18, 2021, 10:45pm UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/11 "2021-06-18T22:45:00Z")
Thanks for identifying this issue. I have updated the tutorial with the information about LUKS for others to see. ---
**Author:** ![system](https://forum.endeavouros.com/uploads/default/original/2X/9/9ea52f9fd5ef8e609e593c362d61a36295f48be8.png) [@system](https://forum.endeavouros.com/u/system)\ **Post date:** [June 20, 2021, 10:45pm UTC](https://forum.endeavouros.com/t/encryption-problem-with-systemd-boot/15234/12 "2021-06-20T22:45:07Z")
This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.