Skip to main content
Server Fault

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

2
  • It would be insecure to actually write the unencrypted key to your HDD. You would pipe the output directly to luks so that it is only ever decypted in memory: 'pkcs15-crypt --decipher --input /tmp/encryptedkey.pkcs1 --pkcs1 --raw | cryptsetup --key-file=- luksOpen /dev/sdb1' Commented Jan 26, 2018 at 17:15
  • Instead of using a key file you could use a "password". This way invoking cryptsetup isn't much different from using an ordinary password. Obviously the password should be long and random and doesn't need to be rememberable. Hence, you could get it from /dev/random. You would store the encrypted password as you describe storing an encrypted key file. Commented Jan 29, 2018 at 19:45