agregar particion Cypto - cifrada al BOOT

fuente :
http://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/

Configure GRUB

With /boot on an encrypted device, grub-mkconfig should have GRUB load the necessary modules to decrypt and mount it².
grub-install, on the other hand, will refuse to work, complain about /boot being encrypted, and demand that GRUB_ENABLE_CRYPTODISK=1 be added to the config. This is a bug (in the error message). Instead, add

GRUB_ENABLE_CRYPTODISK=y

to /etc/default/grub.
Now, before trying to find and load the initial ramdisk, GRUB will ask for a passphrase to decrypt /dev/sda1.
Finally, add the cryptdevice kernel parameter³

GRUB_CMDLINE_LINUX="cryptdevice=/dev/sda1:lvm"

and run

grub-mkconfig -o /boot/grub/grub.cfg
grub-install /dev/sda

Reboot, and that’s it. You now have a fully encrypted system.