Ubuntu – How to enable Ubuntu (using full disk encryption) to call LUKSsupend before sleeping/suspending to RAM

If Ubuntu asks for an encryption passphrase during boot (i.e. on the text console before the login screen is displayed), this indicates that a full disk encryption method was used. (There's more than one way to do this, but I'll keep the answer general.) The encryption is handled by an extra software layer between the file system and the physical hard drive, not the file system itself.

There is no simple method or tool to undo this. With some knowledge about how Linux systems work, it can be done. You'd have to move the whole file system (or all files) to another partition (with enough free space) or external HDD. Then, remove the encrypted container, and recreate the file system without encryption. Finally, make sure that the new file system is properly recognized by the boot loader and mount -a before rebooting.

If possible, it's best to avoid this time consuming and error-prone procedure. Just do a fresh install. For a new users, this is the quickest and safest option.

PS: Chances are that you can change the encryption passphrase, possibly to an empty string. Then decrypting only requires to press Enter. Maybe you can go further and supress to (now useless) passphrase prompt. However, this does not disable the encryption. The data would still be encrypted although the encryption would be useless since the key can be trivially guessed.

This is more a comment than an answer, sorry. But since you didn't get any replies yet, I wanted to write something anyway.

As for how does it even work:

In the Initramfs you usually have one master process (usually a busybox based /init shell script) which is responsible for making the root partition available before handing off the boot process to the real init system of your Ubuntu install.

In case of dropbear in Initramfs, that is a separate process started by /init. Logging into dropbear you get a shell which is yet another process. All the while the original /init has to be running and waiting for something, in this case the LUKS password.

So what the /init script most likely does here, once it started dropbear, is create a named pipe, or fifo, i.e. the /lib/cryptsetup/passfifo. And then it reads from that named pipe. This read will block until there actually is something to read, so that's how /init hangs and waits for input.

Then some years later you log into dropbear and do your echo passphrase > /lib/cryptsetup/passfifo, at which point /init wakes up from its slumber and resumes to unlock LUKS and go on with the rest of the boot process.

And that's basically the general idea of how it works. If there is no documentation for it you would have to read the shell script.

As for a GPG encrypted key in Initramfs, I'm sure this is the standard method in Ubuntu somehow, probably to be set up via /etc/crypttab. Did you check the wiki for a howto?

It certainly would require GPG to be included in the Initramfs. but I outlined an alternative approach here which could be made to work without additional dependencies:

How do I use dm-crypt (LUKS) with GnuPG to use two-factor for FDE?

The problem with this is of course that it is not standard, so while it could be simpler in theory it might actually be harder to set up.