On my system, I have two encrypted disks:
- crypt containing the root partition of raspbian stretch
- usb-crypt is an external usb disk. LVM is used on that disk.
Both disks are protected using the same passphrase, but the master key is different according to "cryptsetup luksDump". Neither of the two disks are configured using a key file (only one key slot is used for each LUKS container).
When the system is booting, it is asking for the passphrase of "crypt", but usb-crypt is automatically mounted without asking for a passphrase. Note: I started with an unencrypted root partition, and with that setup, I was asked for the passphrase of usb-crypt during boot.
Here is the detailed setup:
$ sudo dmsetup ls --target crypt crypt (254, 0) usb-crypt (254, 1) $ sudo cat /etc/fstab /dev/mmcblk0p1 /boot vfat defaults 0 2 /dev/mapper/crypt / ext4 defaults,noatime 0 1 # ... UUID=b9fb061f-0877-4d2c-bd3c-9c155b8f88a5 /mountpoint ext4 rw,auto 0 0 $ sudo cat /etc/crypttab # <target name> <source device> <key file> <options> crypt /dev/mmcblk0p2 none luks usb-crypt UUID=31fb8df7-6148-4408-90a2-93b8ec752fa0 none luks
While having only to type the passphrase once is convenient, I am surprised seeing this behaviour. I'd have expected to be asked for both passphrases.
Is this related to using the same passphrase on both disks? Or is the master key of the usb disk automatically saved somewhere in the encrypted root partition of "crypt"? I'd appreciate if someone could explain what's going on here and maybe give some hints to relevant log files, etc.
Thanks in advance!