Full disk encryption

Also known as FDE for short.

If your device has a Y in the FDE column of the all devices table, you can enable full disk encryption with the --fde parameter.

Full disk encryption needs to be ported to devices individually following this guide.

Changing LUKS Password

To change your LUKS password, connect your phone's storage medium to a Linux computer with cryptsetup installed.

Run the following command:

# sudo cryptsetup luksChangeKey <target-device> -S 0

I can get the target device by running the lsblk command. For example, if my storage medium's partition table looked like:

sde                  8:64   1  14.7G  0 disk

├─sde1               8:65   1   110M  0 part

└─sde2               8:66   1  14.6G  0 part

To change my password, I would run:

# sudo cryptsetup luksChangeKey /dev/sde2 -S 0

Mounting Additional Encrypted Drives At Boot

As per the following from Alpine and pmOS: https://wiki.alpinelinux.org/wiki/LVM_on_LUKS#Mounting_additional_encrypted_filesystems_at_boot and https://wiki.postmarketos.org/wiki/Fstab

This process will need a Key File that has the password to the encrypted drive.

Generating and/or saving the Key File to be accessible for dmcrypt

Known password to the LUKS drive, below it is listed in /etc/ but the saving directory can be anywhere but needs to be only accessible to root, same with the storing folder for the key:

# mkdir /etc/luks-keys
# chmod +s /etc/luks-keys
# echo "<luks-password>" > /etc/luks-keys/<keyfile-name>
# chmod 400 /etc/luks-keys/<keyfile-name>

Randomly generated password (from Alpine):

# dd bs=512 count=4 if=/dev/urandom of=/root/crypt-home-keyfile.bin
# cryptsetup luksAddKey /dev/sdb1 /root/crypt-home-keyfile.bin

Mounting the encrypted drive

Alpine and pmOS, like Gentoo, uses the dmcrypt service rather than /etc/crypttab.

Install and enable the following:

# apk add cryptsetup cryptsetup-openrc
# rc-update add dmcrypt boot

Add the following lines to /etc/conf.d/dmcrypt:

target=<mounting-name>

source='/dev/<target-device>'

key='<location and name of saved key file from section above, eg /etc/luks-keys/<keyfile-name>>'

Now fstab needs to be enabled and the drive added to the list:

# rc-update add localmount default

Edit /etc/fstab with the information from dmcrypt:

/dev/mapper/<mounting-name> /<mounting-location, eg /home/> auto nosuid,nodev,nofail,x-gvfs-show 0 2

Reboot!

Troubleshooting

Blank screen

Touchscreen works but you can't see what you are typing. Use a keyboard and an OTG cable to enter the password and unlock it. You can also see the phone is still alive by switching with Ctrl + Alt + F1 ~ F6. FDE prompt is usually on second console(F2).

Install msm-fb-refresher to solve the issue:

# apk add msm-fb-refresher
# mkinitfs