Full Encryption Setup with /home on it's own partition

systemd caches passphrases and tries to reuse them. For root it is grub2 that prompts for passphrase, but it forwards decrypted key itself, not the passphrase, to the loaded operating system, so this passphrase is not reused.

That is why we have login screen where users need to enter a valid password (and know the valid user name to start with). Of course, if you use automatic login then automatic LUKS unlock is not desirable, although it again depends on your threat model.

No. Then you will be prompted for the passphrase for cr_home.

1 Like