# genkernel + tuxonice + encrypted /home + swap

## redwood

I'm trying to make a kernel+initramfs using genkernel for linux-2.6.28-tuxonice-r3 

which has support for an encrypted /home partition and a persistent encrypted swap partition

I've installed cryptsetup and 

created an encrypted /home:

```

# initialize partition with random data

dd if=/dev/urandom of=/dev/vg/private

# create key & encrypt with gpg

head -c 45 /dev/random | uuencode -m - | head -n 2 | tail -n 1 | gpg --symmetric -a > ./hk.gpg

# luksFormat partition using unencrypted key

gpg --quiet --decrypt hk.gpg | cryptsetup -v --cipher aes-cbc-essiv:sha256 --key-size 256 luksFormat /dev/vg/private

# open encrypted volume

gpg --quiet --decrypt hk.gpg | cryptsetup luksOpen /dev/vg/private crypt-home

# format crypt-home

mkfs.ext3 /dev/mapper/crypt-home

# mount

mount /dev/mapper/crypt-home /home

```

added entries to /etc/conf.d/dmcrypt 

```

swap=crypt-swap

source='/dev/disk/by-id/ata-WDC_WD2500BEVE-00WZT0_WD-WXC908078765-part3'

target=crypt-home

source='/dev/vg/private'

key='/path/to/hk.gpg:gpg'

```

and I emerged gnupg-1.4 and copied the binaries from /usr/bin to /bin

This all works fine. I'm able to boot my kernel with a freshly-made encrypted swap and

an encrypted /dev/mapper/crypt-home mounted on /home

Now I'd like to get suspend2 (tuxonice) working so that I can suspend a RAM image to a 

persistent encrypted swap partition.

So I followed the same procedure as I did for my encrypted home partition

and created an encrypted resume partition on my /dev/sda10, e.g.

gpg --decrypt --quiet  swapkey.gpg | cryptsetup luksOpen /dev/sda10 swap

and then formatted it as swap:

mkswap -L swap /dev/mapper/swap

I created a kernel/initramfs with luks support:

genkernel --mountboot --disklabel --splash=tuxonice --lvm --dmraid --luks --no-clean --no-mrproper --install --menuconfig --save-config all

and added an entry to my /etc/grub/grub.conf

```

title=LUKS Gentoo Linux (2.6.28-tuxonice-r3)

root (hd0,1)

kernel /boot/kernel-genkernel-x86_64-2.6.28-tuxonice-r3 root=/dev/ram0 init=/linuxrc ramdisk=8192 real_root=LABEL=root crypt_swap=/dev/disk/by-id/ata-WDC_WD2500BEVE-00WZT0_WD-WXC908078765-part10 swap_key=/root/LUKS/swapkey.gpg real_resume=/dev/mapper/swap tuxonice_resume=/dev/mapper/swap  pci=assign-busses vga=791 video=vesafb:ywrap,mtrr:3 splash=silent,theme:tuxonice,tty:12 quiet CONSOLE=/dev/tty1 dolvm

initrd /boot/initramfs-genkernel-x86_64-2.6.28-tuxonice-r3

```

When I boot up this new kernel, I get a message that there is no LUKS header on /dev/sda10

and that I need to specify another partition or 'q' to skip over an encrypted swap resume or

'b' to get a bash shell.

So I shell out  and try to luksOpen the /dev/sda10:

/mnt/key/bin/gpg --decrypt --quiet /mnt/key/root/LUKS/swapkey.gpg | cryptsetup luksOpen /dev/sda10 swap

but I get a message about an invalid key.

So I've also tried just specifying the unencrypted key "swapkey"

cat /mnt/key/root/LUKS/swapkey | cryptsetup luksOpen /dev/sda10 swap

but this results in the same "invalid key" message.

If I go ahead and then resume booting after skipping trying to open this encrypted swap-resume

then /etc/init.d/dmcrypt luksOpen both /dev/mapper/crypt-home and /dev/mapper/swap without

any problems.

So how to I get my kernel/initramfs to luksOpen the encrypted swap-resume, and resume from a tuxonice

suspend2 image there? I'm using the default /usr/share/genkernel/{generic,x86_64} scripts.

THANKS for any info.

----------

