grub: cryptomount
16.3.19 cryptomount
-------------------
-- Command: cryptomount device|-u uuid|-a|-b
Setup access to encrypted device. If necessary, passphrase is
requested interactively. Option DEVICE configures specific grub
device (⇒Naming convention); option '-u' UUID configures
device with specified UUID; option '-a' configures all detected
encrypted devices; option '-b' configures all geli containers that
have boot flag set.
GRUB suports devices encrypted using LUKS, LUKS2 and geli. Note
that necessary modules (LUKS, LUKS2 and GELI) have to be loaded
manually before this command can be used. For LUKS2 only the
PBKDF2 key derivation function is supported, as Argon2 is not yet
supported.
Also, note that, unlike filesystem UUIDs, UUIDs for encrypted
devices must be specified without dash separators.