I have successfully installed Linux Mint on USB pen-drive with disc encryption from live CD (not by using universal USB installer). It asks for password during BIOS boot – it works perfectly.

However is it possible to do the same for UEFI boot ? I know that UEFI works with FAT32 and does not with NTFS. I can't confirm any Linux file system to be supported though. Eventually is it possible to install it without encryption?

Unfortunately my attempts at installing Linux Mint from Live CD to pen-drive failed. This is partition setup before installation and during installation.

partition setup

What is wrong? How should I properly set it? Should boot-loader be placed at dev/sdb1 or dev/sdb (what is the difference) ?


Only the EFI System Partition (ESP) must be FAT32-formatted. That's where UEFI will look for OS loaders. Once the loader is found and selected, UEFI will run it. The loader can implement support for whatever filesystem it needs.

For Linux, GRUB is typically used as a loader. For encrypted setups the easiest approach is to use a separate, non-encrypted /boot partition that uses encrypted / partition to boot.

One could argue that this setup is not secure because /boot is not encrypted, but at the end of the day ESP is not encrypted too and can be hijacked. If that's a weakness with your threat model, you have to:

  • Sign the kernel and initramfs
  • Build a self-contained GRUB loader that checks kernel signatures
  • Sign that GRUB loader
  • Add your key to UEFI key store
  • Remove other keys from UEFI key store

For a portable setup, this is not feasible, so unencrypted /boot isn't any more insecure than encrypted one. Your files still reside on the encrypted /.

  • If I understand correctly even if ESP and /boot partitions are not encrypted my other files still are secured. Am I right? – hal Sep 9 '19 at 9:34
  • 1
    That's correct. Your main partition (root, /) is still encrypted. In fact, that's probably how you have it configured now. UEFI loads GRUB, GRUB loads the unencrypted kernel and feeds it initramfs from /boot, you are asked for a password for / on a nice graphical screen and the booting proceeds. It is possible to encrypt /boot, but as I explained it's unnecessary complexity and you have to enter the password twice: once for GRUB to decrypt /boot and then to decrypt /. – gronostaj Sep 9 '19 at 9:41
  • How do I setup ESP? During installation (partition setup) you can manually configure partitions for ‘/boot/’ and for ‘/’) but there is no option for setting ESP. Should ‘/boot/’ be set for EXT4 or FAT32 ? – hal Sep 9 '19 at 16:43
  • @hal Yes, there's an option for creating ESP. This has nothing to do with /boot, do NOT confuse them. – user931000 Sep 9 '19 at 20:19
  • I don't know what exactly you're installing, but most likely it will pick up the existing ESP. You can use GParted to create one. It should be FAT32, with boot and esp flags enabled, preferably at least 500 MB. /boot should be ext4 most of the time and I'd recommend at least 1 GB. – gronostaj Sep 10 '19 at 4:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.