I'm using Arch Linux and setting up an USB-Stick as decryption key for my luks-encrypted root partition (boot is unencrypted). I described it already in this question.

Now, the key, that's used for dm-crypt is actually stored before the first partition on the stick, created this way:

sudo dd if=tempKey.bin of=/dev/sdd bs=512 seek=1 count=6

thus, 3072 are written into sector 1..6 (zero indexed). When I use the following kernel parameter in grub.cfg it works:


But I cannot rely on that stick always being mapped to sdd, thatswhy even Arch-Wiki recommends using the disks ID, namely:


BUT: USB-Sticks are getting IDs that contain colons and so the device is not found on boot, even if I try to escape the colon with a backslash. The system always seems to look for the ID before the colon.

Using cryptkey=UUID=... would only work, if I use space/sector inside a partition, not before or between.

So, I'm really stuck here. Someone any suggestions, how to solve this without rely on sdX and the possibility to accidentally overwrite/delete the key by putting it inside a partition? Would it be an option to manipulate rules.d of udev to change the way the IDs(and symlinks) for USB-Sticks are created?


If the device path you want to access contains the character :, you have to escape it with a backslash \. In that case the cryptkey parameter would be as follow: cryptkey=/dev/disk/by-id/usb-123456-0\:0:0:512 for a USB key with the id usb-123456-0:0.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.