I'm trying to use a Yubikey 4 as a second factor to access a LUKS-encrypted USB HDD. Here's how far I've gotten:

I'm using yubikey-luks to add my HMAC-SHA1 hashed password to slot 7 of the device.

  • Problem: cryptsetup only challenges the yubikey on boot, and I'm opening the device once logged in.

However, I can use ykchalresp to manually challenge my Yubikey.

  • Problem:
  • That involves inputing my passphrase in plain text into a terminal.
  • Even if I get past that, I don't know a way to conveniently pipe/input that to cryptsetup.

I've thought of writing the hashed passphrase to a file and using it as --key-file, but that sounds like a bad idea since I'll have the key to my device laying around.

Please let me know if I'm formatting a command wrong, or if you have a way around any of my problems!


i suggest you to use this small nice project: yubikey-full-disk-encryption on GitHub,

It is a collection of scripts to enroll and open an encrypted device. The README.md documents fairly well what you need to do. It also has the instruction to setup auto-decrypt with a Yubikey on boot.

Basically, you need to do the following:

  • git clone/download the project and cd to its folder
  • sudo make install installs the project
  • you should modify the configuration file in /etc/ykdfe.con, in particular I modified the following options
    • YKFDE_DISK_UUID (required, you can get it with the command blkid /dev/sdX, where /dev/sdX is the name of your external device)
    • YKFDE_LUKS_NAME(required, a good name is luks-<uuid-of-the encrypted-volume>)
    • YKFDE_CHALLENGE(optional, but you need it to enable 2FA)
    • YKFDE_CHALLENGE_SLOT (optional, by default it is set to 1, but remember that slot 1 contains the configuration for Yubikey OTP
    • YKFDE_CHALLENGE_PASSWORD_NEEDED, if you want to also input your password (so that the Yubikey acts as second-factor authentication, instead of being enough to unlock the volume by itself)

Then you can follow the instruction in the README.md to set up the Yubikey challenge response and add it to the encrypted volume as an additional passphrase.

In the end I advise you to do a make test that will test the configuration.

I've got my Yubikey working with an encrypted loop device, so I think it should also work with external HDD.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.