Hacker News Reader

> The attack is not applicable to LUKS1 format, but the attacker can update metadata in place to LUKS2 format as an additional step.

First time I'm glad grub cannot boot LUKS2.

Grub doesn't support LUKS2 encrypting the boot partition with Grub config files inside, but it can decrypt a LUKS2 root partition

I thought grub2 does support this now?

LUKS2 is supported with some know limitations [0]

Argon2id (cryptsetup default) and Argon2i PBKDFs are not supported, only PBKDF2 is.

grub-install does not support creating a core image that could be used for unlocking LUKS2.