< All posts

March 30, 2020, 8:52 p.m.

Raspbian LUKS Keyfile Boot

You want to automatically boot your encrypted root partition without any passphrase input, but want to use a keyfile. For testing purposes, the keyfile will be located on the /boot partition, which will make the system vulnerable, since if someone gets a hold of the microSD card, they will be able to decrypt our root partition. I suggest that you put that keyfile on a separate USB Flash Disk, in this way it will act like a key, you can unplug the drive after boot process is finished.

Please also read the previous post entitled Root LUKS Disk Encryption Raspberry Pi and install the packages needed. The steps are almost the same as in that post.

Identify our drive UUIDs:

$ sudo blkid

Generate a keyfile:

$ dd if=/dev/urandom of=./keyfile count=1024 bs=4

Add the keyfile to our existing LUKS encrypted partition:

$ sudo cryptsetup luksAddKey /dev/sda1 ./keyfile

Assume that /dev/sda/ is the encrypted root partition.

Edit /etc/crypttab to let the system know that we are using a keyfile:

sda1 UUID=981xxxx-xxxx-xxxx-xxxxx-xxxxx  /dev/disk/by-partuuid/63a3xxx-01:/keyfile luks,keyscript=/lib/cryptsetup/scripts/passdev

Assume that /dev/disk/by-partuuid/63a3xxx-01 is our /boot partition UUID. Replace this with your USB Flash Drive UUID or PARTUUID. /keyfile is the name of our keyfile. 981xxxx-xxxx-xxxx-xxxxx-xxxxx is our encrypted root partition UUID, in this case it is the /dev/sda1 UUID from the output of blkid.

Edit /boot/cmdline.txt append this text:

luks.crypttab=no

Generate a new initramfs:

$ sudo mkinitramfs -o /boot/initramfs.gz

Reboot the pi and check if it works.