Say I have two partitions on a Linux system, a root partition (
/) and a
/home partition. Both of them are encrypted with LUKS.
/home partition needs only to be decrypted if
/ is unlocked and mounted. At boot time, I enter the passphrase for the root partition. Now I have found several possibilities to avoid having to enter multiple passphrases:
decrypt_derivedfrom Debian. This retrieves the (master?) key from (secure?) memory and uses that as passphrase for the second partition. It has been mentioned on Unix.SE.
- Create a key file from random data, store it on the main partition and use it as passphrase for the second partition. This is easy to setup.
- Somehow read the passphrase and write it to the standard input of
cryptsetup. This means that the passphrases need to be the same for both partitions.
What are the security implications of each method and which method is recommended?