Authenticated Boot and Disk Encryption on Linux
An option that wasn&#x27;t at all considered in the article is to have the initrd and (optionally) the secret key used for decrypting the disk on a separate device (or devices), for example on an 1 GB USB drive. This way the big disk can have full, real FDE (not LUKS). To an attacker not in possesion of the USB drive the big disk just looks like random data. And the USB drive can be kept on one&#x27;s own person and easily destroyed if necessary.<p>The main part is having the initrd on an external, small, device. The secret can be either a regular passphrase, or stored somewhere on the small device.<p>Works fine on my Archlinux. I mount the initrd file system to &#x2F;boot when I need to update it.