My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in secure place and restore it after critical situation. I tried add key file using command # cryptsetup luksAddKey /dev/<device> but I didn't achieve what I want. I want to cryptsetup require both key file and password, not to boot system if one is provided. How can I achieve this in cryptsetup?

  • LUKS stands for Linux Unified Key Storage, and is generally used as a layer over dm-crypt to store the dm-crypt keys. Maybe you can achieve what you want by using dm-crypt without LUKS? I'm not sure how key storage is even handled without LUKS so I'm not certain.
    – nbering
    Feb 17, 2019 at 1:22
  • Perhaps I'm confused about the specifics of what you're looking for. Do you want to keep the encryption key(s) offline at all times, or just if you get spooked and what to clear the keys temporarily and restore them later?
    – nbering
    Feb 17, 2019 at 1:27

1 Answer 1


LUKS does not support requiring both a keyfile and a passphrase to decrypt. The encrypted volume can be decrypted as long as you provide satisfactory credentials to any one of the configured keyslots. That's not to say that it's impossible to get what you want. You could use a detached LUKS header (where the encrypted master key and other key information is not kept on the same partition as the actual encrypted data) and treat that as the key file. The detached header for your hard drive could be kept on a USB flash drive. Decrypting the hard drive would require knowing the correct passphrase and having the flash drive with the header. Destroying the flash drive and thus the header would render your hard drive unreadable.

You must log in to answer this question.