Linux Unified Key Setup (LUKS) is the standard format for full-disk encryption on Linux. It stores a header on the encrypted drive containing several key slots, and each slot can unlock the disk’s master key with a different passphrase or key file. At startup, the system asks for a passphrase and tries it against each slot. The disk only becomes readable if one of them matches. Most major distributions, including Debian, Ubuntu, Arch and Manjaro, offer LUKS encryption during installation.
So what? Disk encryption protects data if a device is lost or stolen, but it adds a step to startup that can fail in confusing ways. A mistyped passphrase can produce errors that look like a failed hard drive.
Example: In GRUB, “Attempting to decrypt master key” followed by “access denied” means no key slot accepted the passphrase. Running cryptomount and seeing “Slot 0 opened” means the first slot accepted it and the disk can now be accessed.
