Is using decrypt_derived more secure than a keyfile?

Question

Say I have two partitions on a Linux system, a root partition (/) and a /home partition. Both of them are encrypted with LUKS.

The /home partition needs only to be decrypted if / is unlocked and mounted. At boot time, I enter the passphrase for the root partition. Now I have found several possibilities to avoid having to enter multiple passphrases:

• Use decrypt_derived from Debian. This retrieves the (master?) key from (secure?) memory and uses that as passphrase for the second partition. It has been mentioned on Unix.SE.
• Create a key file from random data, store it on the main partition and use it as passphrase for the second partition. This is easy to setup.
• Somehow read the passphrase and write it to the standard input of cryptsetup. This means that the passphrases need to be the same for both partitions.

What are the security implications of each method and which method is recommended?

Answer 1

decrypt_derived is slightly better than the keyfile approach for these reasons:

1. You could accidentally store the keyfile with the incorrect permissions and thereby leak the contents to non-root users on the system, whereas the master key for a LUKS permission can only be accessed by root.
2. You could accidentally delete the keyfile, whereas the master key can't be accidentally changed or removed.
3. If the root filesystem gets corrupted you could lose the contents of the keyfile, whereas the master key would not be affected by this.

Basically, I would use decrypt_derived if it is available (i.e. I'm using Debian/Ubuntu), but wouldn't go to the effort of installing it manually if it's not. In either case I would still add an additional passphrase key to the home partition in case the root partition gets corrupted and the master key is lost.

I certainly wouldn't use the third method you suggested, since it is more work and you want to avoid storing the passphrase anywhere.