I'm using dm-crypt (LUKS) on my Arch Linux machine to encrypt my root partition.
I added the cryptkey entry to the kernel parameters in the bootloader entry to automatically decrypt my device if a certain SD card (containing the keyfile) is plugged in. This is working as intended.
# /boot/loader/entries/arch-uefi.conf # (...) options cryptdevice=UUID=56147991-f3da-4356-9cb9-ff1fc7e4e1d5:cryptroot root=/dev/mapper/cryptroot rw cryptkey=/dev/mmcblk0p1:vfat:key.bin
I'd like to aditionally enable another device - in this instance a usb device which is permanently plugged into my laptop's dock - to decrypt the partition.
Is there a way to provide a list of devices (which may or may not be plugged in) that will be considered when decrypting my partition instead of only trying one device before falling back to password decryption.