Re: Can AddKey not use stdin for the new key?

[Milan Broz <gmazyland@gmail.com>]

On 8/24/23 21:16, Arno Wagner wrote:
> Ah, luksAddKey has two key arguments and you can only read
> one from stdin. Somwetimes the most obvious mistakes are
> hard to spot ;-)
> 
> You need:
> 1. The existing passprase from --key-file or interactively
> 2. The new passprase from positional argument or interactively

Yes, the terminal input is tricky because it support
all compatible option since cryptsetup 1.x :)
(If you check tests in sourcecode, you will see various tricky options
we run in CI.)

For the second item there is also --new-keyfile option.

Initially, I thought you just need

cryptsetup luksAddKey <dev> --key-file /key [-q]

- that will ask for the new passphrase only.

You can also send both passphrases from pipe
(but note, this cannot be done for binary input as it rely on
processing \n - do not use "-" as keyfile spec as it switch
to binary processing!):

echo -e "$PWD1\n$PWD2" | cryptsetup luksAddKey <dev>

For LUKS2 you can also add token that will try to read it
from kernel keyring.

Milan