Systemd Now Can Unlock Encrypted Boot Drives Using An External Password File
Written by Michael Larabel in systemd on 4 September 2018 at 07:27 PM EDT. 4 Comments
Merged today into systemd is basic keydev support for cryptsetup-generator to allow unlocking an encrypted drive by using a key file that is stored on an external drive.

The Dracut initramfs framework has already supported unlocking encrypted drives by relying upon a key file stored on an external HDD/SSD. But until now systemd hasn't supported key files being on external block devices (keydev).

The newly-added support to systemd allows specifying a keydev block device based upon its UUID and a path to the key, using the added luks.uuid boot parameter.

With that it's now possible to easily have your LUKS encrypted boot device encrypted and the key stored on an external block device. The change is present for the upcoming systemd 240 release.
Related News
About The Author
Author picture

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter or contacted via

Popular News This Week