You should see a line like: sda3_crypt UUID=b9570e0f-3bd3-40b0-801f-ee20ac460207 none luks,discard This does not affect the existing hand-entered passphrase from the installer (in slot 0).Ħ) Delete the key file (it is loaded in LUKS and copied to the USB drive): rm 85125e5e-7bc4-11ec-afea-67650910c179.lekħ) Edit /etc/crypttab. └─sdb1 8:1 1 14,7G 0 part /media/maurits/B54D-B744ĥ) Copy the key file to the USB drive: cp 85125e5e-7bc4-11ec-afea-67650910c179.lek /media/maurits/B54D-B744Ħ) Find the encrypted volume: sudo blkid -match-token TYPE=crypto_LUKS -o deviceĥ) Add the key file to the LUKS volume: sudo cryptsetup luksAddKey /dev/sda3 85125e5e-7bc4-11ec-afea-67650910c179.lek Will show that the 16GB USB stick is mounted as '/media/maurits/B54D-B744': NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT It gets mounted somewhere in '/media', let's find it: lsblk I have tested the below steps on Ubuntu 22.04 and these are expected to be correct for any recent Debian based distribution.ġ) Install the 'uuid' tool sudo apt install uuidĢ) Create a random key name using the 'uuid' tool: uuid

At the end of the post we describe how to conveniently hide the USB drive in Windows and Linux. This post will explain how to unlock your computer by inserting a USB drive containing a key file, while still allowing to unlock using a passphrase.

Entering a long passphrase is not very convenient, especially when you are sharing the device with multiple people. Not to protect against attacks with physical access (to the unencrypted boot loader or unprotected BIOS), but to avoid leaking data when the laptop is either lost or stolen. I feel that using full disk encryption of laptops is a must.

Unlock pc with usb