3

I understand that a TrueCrypt volume may be encrypted with a password AND a keyfile.

As far as I can tell, A LUKS volume may use EITHER a password OR a keyfile, but not both simultaneously for the same user.

Can anyone confirm whether this is correct?

Can anyone offer an opinion on whether using a password-protected keyfile is better/worse/equivalent than the combination of a password and a keyfile?

Improve this question
2
  • 2
    I have several LUKS volumes which can hold up to 10 keys, and they may be mixed (keyfile or passphrase). It can be used either the by same or by different users.
    – ott--
    Commented Feb 9, 2015 at 16:22
  • Thanks, but my question concerns constructing a volume which requires BOTH a keyfile and a passphrase simultaneously.
    – SauceCode
    Commented Feb 9, 2015 at 16:48

2 Answers 2

Reset to default
1

A LUKS volume is protected by a volume master key. This key is generated when the encrypted volume is created, and is the maximum strength the chosen encryption algorithm permits. Access to this key is by means of a number of "key slots": the volume master key is encrypted using a user-supplied password and stored in the header.

Strictly speaking, LUKS does not support keyfiles. Instead, it supports reading the user-supplied password from a file -- something that is roughly equivalent to TrueCrypt's keyfile system.

A password-protected keyfile can be equivalent to a password+keyfile, or it can be worse. It all depends on how well your password protects the keyfile. I can't think of a situation where it would be better.

Improve this answer
0

You can add additional keyfiles using the cryptsetup luksAddKey command. There is a maximum of 8 keyslots per LUKS Volume.

Adding additional Keyfiles to password protected volumes:

cryptsetup luksAddKey /dev/<device> (/path/to/<additionalkeyfile>)

Adding additional Keyfiles to keyfile protected volumes:

cryptsetup luksAddKey /dev/<device> (/path/to/<additionalkeyfile>) -d /path/to/<keyfile>

Password protecting the keyfile is just necessary if you are not totaly sure to keep the multi-factor and if you plan to store the keyfile in the wild (any storage system that is not fully controlled by you).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .