Using hardware key to decrypt disk and login to user

[apparatus]

LUKS with Yubikey 2FA (chal-resp) on Qubes 4.2.0

Using a YubiKey can help protect your system from an attack that knows your LUKS password. The YubiKey Challenge-Response authentication doesn’t use a time component, if the attacker has access to both the key and your password they will be able to extract the permanent LUKS password. Make sure you have a full backup of your system before you try to modify your LUKS authentication, if you mess something up, there might be no way to recover without a backup. I will be using Debian 12, the yubik…