I feel a keyfile and a passphrase provide different benefits. They can not be obtained in the same way (one you need to physically acquire, the other one you need to know). Thus, I think there is great benefit in encrypting my data using BOTH of these. That way, if one gets compromised the encryption is still intact.

Using dm-crypt in plain mode, I want to use BOTH. By default, dm-crypt uses a passphrase, and I can change that to a keyfile easily. But they seem to be the same kind of input (as in, the keyfile becomes your passphrase if provided). Using both --key-file and --verify-passphrase therefore doesn't work.

Any workarounds here to use both?

  • 1
  • @frostschutz Thanks but that refers to LUKS use, no? I'm using plain dm-crypt... – User402841 May 30 '15 at 13:18
  • 1
    Of course it refers to LUKS. That's what everyone uses. But it's the same principle for plain mode. Or you could mix the ideas, a LUKS encrypted key can still open a plain encrypted disk. @yaegashi's answer is the same idea again, only it uses gpg instead of cryptsetup to encrypt the key. – frostschutz May 30 '15 at 13:23

You can store the actual passphrase for cryptsetup (possibly a very long and complicated string) in a file encrypted by GnuPG (or any other tool) with another passphrese you can remember.

First encrypt a passphrase string with gpg to get encrypted keyfile:

# echo 'long-long-passphrase-for-cryptsetup' | gpg -q -c --cipher-algo AES256 -o keyfile 
Enter passphrase: <- Enter another passphrase you can remember
# file keyfile 
keyfile: GPG symmetrically encrypted data (AES256 cipher)

Then decrypt keyfile to feed that passphrase to the stdin of cryptsetup --key-file -.

# gpg -qd keyfile | cryptsetup plainOpen --key-file - /path/to/image volname

The similar suggestion can be seen in the cryptsetup manual.

The example above uses the symmetric encryption (gpg -c) for simplicity. It would be much better and desirable if you could adopt the public key encryption!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.