Migrate LUKS Passphrase to File

on

cryptsetup can be invoked with the -d switch to read the passphrase from a file on disk rather than from stdin. However, if you want to migrate an existing passphrase to a file, you'll probably have to take an additional step to make it actually work.

When reading input from a file, cryptsetup does not discard the EOF byte. If you view your keyfile in hex, you'll notice the extra byte at the end.

ayleph@thisshitistemp$ echo "mysecretphrase" > keyfile
ayleph@thisshitistemp$ xxd keyfile
0000000: 6d79 7365 6372 6574 7068 7261 7365 0a    mysecretphrase.

If you try to open your LUKS container using this file, it will fail. Luckily, there's a really quick fix.

ayleph@thisshitistemp $ truncate -s-1 keyfile
ayleph@thisshitistemp$ xxd keyfile
0000000: 6d79 7365 6372 6574 7068 7261 7365       mysecretphrase