I have an encrypted volume for which I had initially set up a passphrase interactively, which works just fine to decrypt the partition. I added more keys using a keyfile in both the following ways:
cryptsetup --keyfile=passphrase luksAddKey /dev/sdax cryptsetup --luksAddKey /dev/sdax passphrase
where passphrase is the file containing the key and /dev/sdax is the encrypted volume.
I then checked if the passphrase was valid using
cat passphrase | cryptsetup --test-passphrase luksOpen /dev/sdax dd if=passphrase bs=1 count=256 | cryptsetup --test-passphrase luksOpen /dev/sdax
but both of them failed: "No key available with this passphrase." The following command using the --key-file option worked:
cryptsetup --test-passphrase --key-file passphrase luksOpen /dev/sdax
At this point I tried to see if the method of piping the passphrase content worked with the only working passphrase (set up interactively).
echo "manually written working passphrase" > interactive_pass cat interactive_pass | cryptsetup luksAddKey /dev/sdax
This time it worked just fine. What is the difference between the two methods and the two key files? I would need the first method of piping the file content to work also with passphrases added from key files, since it seems the only possible method when using a script in crypttab. Is it possible?