When using full disk encryption with Ubuntu (opposed to homedir encryption), dm-crypt with LUKS is used for encrypting the volume. In the installer (at least on 12.04 alternate) you can choose between setting it up using a passphrase or a keyfile. I'd like to use a combination of the two; not either, but require both.
Why? Because this enhances security (two-factor); you'll need to have something and you need to know something to unlock it. Then I want to put the keyfile on a small removable storage device (USB flash drive) and only plug it in during boot time. The result should be that it is required to put in the right flash drive and provide the right passphrase to unlock the root partition.
So, put in other words, I want to be asked during boot for the passphrase to which the keyfile on an external drive is encrypted.
I see a
/usr/share/initramfs-tools/hooks/cryptgnupg helper script that may help to accomplish it, but I have no clue how to use it.
Just to avoid confusion: I am not asking for a way to add an additional key to the volume to unlock it.