dracut icon indicating copy to clipboard operation
dracut copied to clipboard

When using the same (symmetrically) PGP-encrypted keyfile for two (or more) separate LUKS volumes, the passphrase for the keyfile should only be asked once

Open NiklausHofer opened this issue 3 years ago • 0 comments

I need to decrypt two separate LUKS volumes to boot. Currently, I have to enter a LUKS passphrase for each one of them. To avoid having to do so, I created a keyfile and added it to a new keyslot on both LUKS volumes. Then I encrypted the keyfile using PGP symmetric encryption and placed it in my /boot. Finally, I referenced the keyfile through rd.luks.key.

Unfortunately, even though both LUKS volumes use the same keyfile, I'm asked for the password for that one keyfile twice. I think it would be greate if GPG agent could be used to cache the password.

Here are my crypto parameters.

root=UUID=bd4cd575-105b-4a98-a28a-407187bb8ec1 rd.luks.uuid=fe50fc64-0707-4aeb-b501-0561e305decc rd.luks.uuid=dcb67f26-6d2d-4652-83a6-09b6c5a5e0fb rd.luks.key=/keyfile.gpg:UUID=6fb9699b-279b-4297-a378-547a24038e2d

NiklausHofer avatar Dec 27 '22 13:12 NiklausHofer