[SOLVED] How to decrypt from either a file or a password?

vcmota · Guru Joined: 19 Jun 2017 Posts: 377

Lets say I am going to encrypt a partition or a disk. There seems to be multiple ways, but lets focus on those two:

First, typing the password from stdin:

Hu · Administrator Joined: 06 Mar 2007 Posts: 23014

LUKS supports having multiple independent passwords that unlock the same device. Any one of the passwords is sufficient to unlock. Use luksFormat to create the control information and assign the first password. Use luksAddKey to assign additional passwords. Make one of those passwords the one you type, and another one the one in the file.

wwdev16 · n00b Joined: 29 Aug 2018 Posts: 53

Note that the key file must not contain a trailing new-line if you are trying to match
a typed password. So if you typed secret as the password during luksFormat
and then used an editor to create a file containing secret, the file would not work
because it has a trailing new-line.

As Hu said you can have multiple passwords. What I do is create the container with a typed
password, create a key-file with random binary data and then luksAddKey using the key-file.

vcmota · Guru Joined: 19 Jun 2017 Posts: 377

Thank you Hu and wwdev16 for your replies. I am definitely going to implement the password+separate key file, it seems to be the most robust solution. But just out of curiosity:

Hu · Administrator Joined: 06 Mar 2007 Posts: 23014

printf would work, as would echo -n, or configuring your editor not to add a trailing newline to the end of the file. Unless you plan to manually type the password from the key file, it doesn't matter. Make a random blob for the key file, and never try to type it. Always let LUKS read from that file when it needs that password.