From http://manpages.ubuntu.com/manpages/trusty/man5/crypttab.5.html http://manpages.ubuntu.com/manpages/trusty/man5/crypttab.5.h... The second field, sour

From http://manpages.ubuntu.com/manpages/trusty/man5/crypttab.5.html http://manpages.ubuntu.com/manpages/trusty/man5/crypttab.5.h... The second field, source device, describes either the block special device or file that contains the encrypted data. Instead of giving the source device explicitly, the UUID is supported as well, using UUID=<luks_uuid>. That covers the init scripts, and it looks like recent versions of cryptsetup will "do the right thing" if pointed at a file rather than a block device.