# "Failed to open key file" at boot, after GRUB **URL:** \ **Category:** Newbie\ **Created:** [September 10, 2021, 11:52am UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473 "2021-09-10T11:52:19Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Moultipass](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/m/87869e/32.png) [@Moultipass](https://forum.endeavouros.com/u/Moultipass)\ **Post date:** [September 10, 2021, 11:52am UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/1 "2021-09-10T11:52:19Z")
Hello, I installed EndeavourOS on my DELL XPS 15 laptop, no dual boot, default BTRFS partition layout with swap & hibernate, and encrypted partition. At boot, after entering the correct partition encryption password, and choosing one of the boot options in GRUB, I see: ```auto Starting version 249.4-1-arch Failed to open key file. ``` And then a completely black screen… I don’t know if it’s related, but this happened after I ran `nvidia-installer-dkms`, without errors. Also, secure boot is disabled. This is probably fixable by chrooting into my system with the OS bootable key, but I have to know what’s wrong first. I looked on the Endeavour Wiki, Arch Wiki, but couldn’t find any mention of a similar error. Do you have any idea what is going on? How do I start debugging this issue? Thanks ---
**Author:** ![otherbarry](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/otherbarry/32/10801_2.png) [@otherbarry](https://forum.endeavouros.com/u/otherbarry)\ **Post date:** [September 10, 2021, 12:26pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/2 "2021-09-10T12:26:18Z")
The password you entered is used by grub to access `/boot/grub.cfg`, and get you to your grub menu. This is working. Good. At least we know you can decrypt and mount your root partition / subvolume. LUKS keyfiles are used to decrypt from that point on. Decrypt root, mount root and look in `/etc/crypttab`. You should have entries like this … ```auto luks-[UUID] UUID=[UUID] /crypto_keyfile.bin luks ``` The UUID is the partition UUID of a luks container, `/crypto_keyfile.bin` is the keyfile used to decrypt on boot. Make sure the path to this keyfile is correct and accessible. I don’t use btrfs, so not sure if that is causing the issue. ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [September 10, 2021, 12:34pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/3 "2021-09-10T12:34:54Z")
I suspect that message may not be related to your issue. I would revert your graphics driver changes first and then try to determine why you are getting that key error. ---
**Author:** ![Moultipass](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/m/87869e/32.png) [@Moultipass](https://forum.endeavouros.com/u/Moultipass)\ **Post date:** [September 10, 2021, 1:14pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/4 "2021-09-10T13:14:53Z")
Thanks for your reply. I don’t know how to decrypt the root partition however. Can this be done from the Live USB environment? If yes, do you have a resource explaining how to do this? I couldn’t find anything online. ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [September 10, 2021, 1:18pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/5 "2021-09-10T13:18:51Z")
> [@Moultipass](#): > > If yes, do you have a resource explaining how to do this? I couldn’t find anything online. ```plaintext sudo cryptsetup open /dev/path/to/device luksdevicename ``` Replace `/dev/path/to/device` with the actual path to your device. For example, `/dev/sda2`. You can use `lsblk` to find that if you don’t know it. Replace `luksdevicename` with whatever you want to call it. It shouldn’t matter. You can even leave it luksdevicename if you want to. ---
**Author:** ![otherbarry](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/otherbarry/32/10801_2.png) [@otherbarry](https://forum.endeavouros.com/u/otherbarry)\ **Post date:** [September 11, 2021, 8:44am UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/6 "2021-09-11T08:44:48Z")
> [@Moultipass](#): > > do you have a resource explaining how to do this? I couldn’t find anything online. Arch Wiki. [https://wiki.archlinux.org/title/Dm-crypt](https://wiki.archlinux.org/title/Dm-crypt) `cryptsetup` is the command you need to learn to manage luks / dm-crypt partition encryption. ---
**Author:** ![Moultipass](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/m/87869e/32.png) [@Moultipass](https://forum.endeavouros.com/u/Moultipass)\ **Post date:** [September 11, 2021, 9:06pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/7 "2021-09-11T21:06:15Z")
Thanks for your help. I decrypted the root partition of the system I’m trying to fix, and found the following directories at its root: `@ @cache @home @log` … which is weird, as I would expect to find the usual linux directory strucure there (`/usr /home ...`), but this directory structure is present in `/@/`. I found the `crypttab` file in `@/etc/crypttab` which references the `crypto_keyfile.bin` file with path `/crypto_keyfile.bin`, NOT `/@/crypto_keyfile.bin` (where the file actually is). So I guess I now need to figure out why my encrypted partition ended up so messed up. Does anybody know what’s going on here? ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [September 11, 2021, 9:09pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/8 "2021-09-11T21:09:17Z")
> [@Moultipass](#): > > So I guess I now need to figure out why my encrypted partition ended up so messed up. Does anybody know what’s going on here? It isn’t messed up. That is what a btrfs root looks like. The root filesystem is in `@`. To mount it so you can chroot, use `sudo mount /dev/path/to/device /mnt -o subvol=@` ---
**Author:** ![joekamprad](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/joekamprad/32/77608_2.png) [@joekamprad](https://forum.endeavouros.com/u/joekamprad)\ **Post date:** [September 11, 2021, 9:16pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/9 "2021-09-11T21:16:10Z")
> [@Moultipass](#): > > @ @cache @home @log these are your BTRFS subvols they got created from the scheme we set in calamares on autopartition with BTRFS: [https://github.com/endeavouros-team/calamares\_config\_next/blob/ea9aa66885b8abbc365b7a4d1f196dfda1053b53/calamares/modules/mount.conf#L31](https://github.com/endeavouros-team/calamares_config_next/blob/ea9aa66885b8abbc365b7a4d1f196dfda1053b53/calamares/modules/mount.conf#L31) A nice view will be produced with duf: ![Screenshot_2021-09-11_23-15-17](https://forum.endeavouros.com/uploads/default/original/3X/e/5/e550a3065f1d6326356d7631af1e78ac4c34ec46.png) `sudo pacman -S duf` ---
**Author:** ![Moultipass](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/m/87869e/32.png) [@Moultipass](https://forum.endeavouros.com/u/Moultipass)\ **Post date:** [September 11, 2021, 9:16pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/10 "2021-09-11T21:16:47Z")
Thank you, I didn’t know that. Using this mount command, the `crypto_keyfile.bin` file is present at the root of subvolume `@` and the file path in `/etc/crypttab` is correct. As for the contents of `crypto_keyfile.bin`, I don’t know how to check if they are correct or not. ---
**Author:** ![Moultipass](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/m/87869e/32.png) [@Moultipass](https://forum.endeavouros.com/u/Moultipass)\ **Post date:** [September 11, 2021, 9:33pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/11 "2021-09-11T21:33:52Z")
I see, any chance the system might be mounting the partition incorrectly as I did, thus prefixing the actual path of the `crypto_keyfile.bin` file with `/@`? ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [September 11, 2021, 9:44pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/12 "2021-09-11T21:44:25Z")
Not likely. Since this started when you installed video drivers I would recommend resolving that issue first. The key message you are seeing may have just been the last thing on the screen before the driver problem manifested. It may not even be an issue. If the initramfs can’t use your keyfile to unlock it should just ask you for a passphrase. ---
**Author:** ![BuZZ-dEE](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/b/e495f1/32.png) [@BuZZ-dEE](https://forum.endeavouros.com/u/BuZZ-dEE)\ **Post date:** [September 15, 2021, 7:54pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/13 "2021-09-15T19:54:24Z")
I can confirm this issue after a fresh install (endeavouros-2021.08.27-x86\_64.iso) with btrfs and encryption. ---
**Author:** ![QAP](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/qap/32/33263_2.png) [@QAP](https://forum.endeavouros.com/u/QAP)\ **Post date:** [September 15, 2021, 8:20pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/14 "2021-09-15T20:20:19Z")
> [@Moultipass](#): > > ```auto > Starting version 249.4-1-arch > Failed to open key file. > > ``` > [@BuZZ-dEE](#): > > I can confirm this issue after a fresh install (endeavouros-2021.08.27-x86\_64.iso) with btrfs and encryption. BTRFS and encryption. Fresh install too. “Failed to open keyfile” However causes no problem and I can still continue as normal, so I have ignored for now. ---
**Author:** ![BuZZ-dEE](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/b/e495f1/32.png) [@BuZZ-dEE](https://forum.endeavouros.com/u/BuZZ-dEE)\ **Post date:** [September 15, 2021, 8:26pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/15 "2021-09-15T20:26:26Z")
> [@QAP](#): > > However causes no problem and I can still continue as normal, so I have ignored for now. I can also confirm this, but the boot process is **really slow** after entering the password. ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [September 15, 2021, 8:43pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/16 "2021-09-15T20:43:01Z")
> [@BuZZ-dEE](#): > > but the boot process is **really slow** after entering the password. That is normal. Grub is very slow at unlocking the luks volume. The kernel isn’t loaded yet and it does pure software decryption. ---
**Author:** ![BuZZ-dEE](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/b/e495f1/32.png) [@BuZZ-dEE](https://forum.endeavouros.com/u/BuZZ-dEE)\ **Post date:** [September 15, 2021, 8:44pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/17 "2021-09-15T20:44:41Z")
@dalto thx for clarification ---
**Author:** ![QAP](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/qap/32/33263_2.png) [@QAP](https://forum.endeavouros.com/u/QAP)\ **Post date:** [September 15, 2021, 8:48pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/18 "2021-09-15T20:48:09Z")
Ah “Failed to open keyfile” is normal then, so can safely ignore. Many thanks for confirming. ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [September 15, 2021, 8:57pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/19 "2021-09-15T20:57:58Z")
> [@QAP](#): > > Ah “Failed to open keyfile” is normal then It is likely harmless but I am not sure that is normal. I would look at the keys on your luks volume and make sure there isn’t an extra one. There should be only 2. ---
**Author:** ![QAP](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/qap/32/33263_2.png) [@QAP](https://forum.endeavouros.com/u/QAP)\ **Post date:** [September 15, 2021, 9:26pm UTC](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473/20 "2021-09-15T21:26:37Z")
Yup only 2. Thanks, just going to leave as it is as not production mac > [@dalto](#): > > It is likely harmless but I am not sure that is normal. I would look at the keys on your luks volume and make sure there isn’t an extra one. There should be only 2. Yup. 2 key slots per luks volume. Not a big deal I’ll deal with it if it becomes a real problem. As they say… “Don’t fix unless its broken” 😃 ![Screenshot_2021-09-15_22-04-57](https://forum.endeavouros.com/uploads/default/original/3X/a/0/a08adb93908cb266b7ca20fd0bbcea4b0d8a712a.png) [Next page](https://forum.endeavouros.com/t/failed-to-open-key-file-at-boot-after-grub/17473.md?page=2)