3 ms·

LUKS already supports keyfiles: https://wiki.archlinux.org/title/dm-crypt/Device_encryption#Keyfiles https://wiki.archlinux.org/title/dm-crypt/Device_encryption

LUKS already supports keyfiles: https://wiki.archlinux.org/title/dm-crypt/Device_encryption#Keyfiles https://wiki.archlinux.org/title/dm-crypt/Device_encryption#... However I don't recall if the keyfile is then used to decrypt a header stored on disk to get the key that's actually used to en/decrypt the drive contents in the same way that passwords are.

riceart 4y ago
Yes it is just another mechanism for header decryption. You can replace these keys just like a pass phrase.
tetha 4y ago
To be specific, LUKS supports up to 8 slots. Slots can be used by different decryption mechanisms such as passwords (either typed in, or read from a keyfile), or something like clevis+tang to decrypt the disk on the correct network. Each of these slots can then decrypt the main key to decrypt the drive data. This is done for a few reasons. This allows you to change "your disk encryption password" - or rather, passwords used for password based slots - without re-encrypting the (arbitrarily large) disk (for an arbitrarily long time). You just change an encrypted master key for a different ciphertext of the same master key.
- snowstormsun 4y ago
  The limit of 8 slots is only true for the older LUKS1 version