Status? This seems really useful.

I'd like to test this but I don't have a Yubikey (that was a problem for me too when I made my changes to this code). Is there someone with the hardware who uses LUKS and doesn't mind to get pinged if a test is needed?

Rebased onto master.

I reworked the thing to resolve the input echo issue (turned out to be super-easy). I also added syntax checks to stage-1 build and checked that my Yubikey changes pass it. And tested booting, still works flawlessly for me.

I think this can now be merged, especially since I'm absolutely sure nobody uses that Yubikey code anyway because it is broken on master (see commit messages), hence unmarking this as [WIP].

ping @matthewbauer @rnhmjoj @abbradar

@oxij is there a reason why you are not using keyfiles? I currently have a 3MB partition encrypted with LUKS and once it's unlocked, the corresponding /dev/mapper device is used for the rest of my partitions. Relevant hardware section:

  boot.initrd.luks.devices = {
    cryptkey = {
      device = "/dev/disk/by-uuid/3830842b-a589-45e0-a51d-4ed516472575";
    };

    cryptroot = {
      device = "/dev/disk/by-uuid/ec133595-6294-4756-95ea-3891297f6477";
      keyFile = "/dev/mapper/cryptkey";
    };

    cryptswap = {
      device = "/dev/disk/by-uuid/71aab354-3872-4316-a26c-b4090d73275c";
      keyFile = "/dev/mapper/cryptkey";
    };
  };

With this technique, I only have to type my password once and the rest of the devices use the shared partition as the key-file.

Just validated, works on my machine™ when applied on top of current nixos-unstable (even though there were no doubts about it).

My setup is:

• One partition.
• Passphrase for decryption.

@oxij I first checked empirically whether ash verified with -n before adkin. It did, even though it's missing from its --help output.

Additionally, here's the part where it happens:

• https://github.com/mirror/busybox/blob/c2aa218f23a4e952746ebef7bb86668c6255471c/shell/hush.c#L9740-L9742

This is as described in The Open Group Base Specifications Issue 7, 2018 edition, as linked from the busybox shell's readme

-n

The shell shall read commands but does not execute them; this can be used to check for shell script syntax errors. An interactive shell may ignore this option.

• http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html

@oxij I can't say much because I don't use LUKS but this is a really useful feature and it has been verified to work so yes, I would just merge this. 👍 from me for what it's worth.

Also fixed a typo and a tiny bug. LGTM.

Aww, I hate to be the bearer of bad news:

• nixos/luksroot: Support keyfile offsets #41425
• luksroot: Add missing quote #44639

Two PRs were merged (one fixing an issue in the other :/) today, and the first one added a feature.

I don't think the merge will be too hard. Tell me if you won't or can't merge.

I was about to merge this to master since seemingly nobody will be able to test the Yubikey support (tried getting in touch with a possible user, they didn't reply).

Once updated, I'll do one last build+test to confirm everything's in working order and merge.

Sorry for that merge! I didn't see this PR until @samueldr told me about it.

Here's a patch for the feature in master, adapted to this PR:

diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index f44ff0bd3cc..27c1f891f48 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -91,7 +91,7 @@ let
     umount /crypt-ramfs 2>/dev/null
   '';
 
-  openCommand = name': { name, device, header, keyFile, keyFileSize, allowDiscards, yubikey, fallbackToPassword, ... }: assert name' == name;
+  openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, fallbackToPassword, ... }: assert name' == name;
   let
     csopen   = "cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} ${optionalString (header != null) "--header=${header}"}";
     cschange = "cryptsetup luksChangeKey ${device} ${optionalString (header != null) "--header=${header}"}";
@@ -155,7 +155,9 @@ let
     open_normally() {
         ${if (keyFile != null) then ''
         if wait_target "key file" ${keyFile}; then
-            ${csopen} --key-file=${keyFile} ${optionalString (keyFileSize != null) "--keyfile-size=${toString keyFileSize}"}
+            ${csopen} --key-file=${keyFile} \
+              ${optionalString (keyFileSize != null) "--keyfile-size=${toString keyFileSize}"} \
+              ${optionalString (keyFileOffset != null) "--keyfile-offset=${toString keyFileOffset}"}
         else
             ${if fallbackToPassword then "echo" else "die"} "${keyFile} is unavailable"
             echo " - failing back to interactive password prompt"
@@ -417,6 +419,19 @@ in
             '';
           };
 
+          keyFileOffset = mkOption {
+            default = null;
+            example = 4096;
+            type = types.nullOr types.int;
+            description = ''
+              The offset of the key file. Use this in combination with
+              <literal>keyFileSize</literal> to use part of a file as key file
+              (often the case if a raw device or partition is used as a key file).
+              If not specified, the key begins at the first byte of
+              <literal>keyFile</literal>.
+            '';
+          };
+
           # FIXME: get rid of this option.
           preLVM = mkOption {
             default = true;

I confirm, built overnight on top of master and worked.

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/disk-encryption-on-nixos-servers-how-when-to-unlock/5030/20