Re: Can AddKey not use stdin for the new key?

[Chris X Edwards <chris@xed.ch>]

Hi,
These are two very interesting suggestions! I think you're right that
decrypting a volume that contains the secrets is a pretty rational
approach. The Bash process redirect looks fun but I couldn't get it to
work and it would be pretty extraordinary if the options parsing
handled that well.

Another approach I thought might work is to set up the second slot
with luksAddKey and just put in a nonce passphrase normally; then
immediately try a luksChangeKey to swap it for a file. 

The cryptsetup-luksChangeKey 8 man page (under -d option) says:

  If you want to set a new passphrase via key file, you have to use a
  positional argument or parameter --new-keyfile.

And that would be exactly what would be required. Unfortunately, I
think this might be a man page error since that option produces:

    cryptsetup: Option --new-keyfile is not allowed with luksChangeKey action

It definitely seems like all the options are kind of in place to do
this (especially `--new-keyfile=-` in luksAddKey) but they're just not
quite doing what I'd hope. Not a big deal. Just thought I'd run it by
this list and see if anyone could spot an obvious error in my
thinking. 

Thanks for all the suggestions!
Cheers,
Chris

On 2023-08-24 17:27 +0000, Michael Kj??rling wrote:
> On 24 Aug 2023 05:51 -0400, from chris@xed.ch (Chris X Edwards):
> > I create an encrypted secret that I only have to unlock once:
> > 
> If you are willing to unlock once, you can also use a small LUKS
> container to hold a file system holding passphrase or key files for
> other LUKS containers. Or you can derive further keys from contents or
> metadata of another LUKS container; I've seen suggestions for how to
> do this scattered about the Web.
> 
> 
> > Now I'd like to add that to a LUKS keyslot so that the following
> > works.
> > 
> >     gpg --decrypt drivekey.gpg | cryptsetup luksOpen --key-file=- /dev/sdb backup
> 
> Assuming bash, you might want to try:
> 
>     cryptsetup luksOpen --key-file=<(gpg --decrypt drivekey.gpg) /dev/sdb backup
> 
> and corresponding variations of your other commands as well.

-- 
++++++++++[>++++++++++++<-]>-...<++++++[>>+++++++<<-]>>++++.<+.<++++[>
Chris X Edwards-----<-]>+.- Have a nice day. >.<-.+++++><chris@xed.ch>