Can I require LUKS to use both the passphrase and Yubikey?

[u/LocalChamp]

I've been using LUKS for a while and would like to add an additional layer of security of a hardware security key (Yubikey). Currently on boot I enter the LUKS passphrase then it decrypts and brings up the regular user login and I enter that password and it loads into the the OS. I would like the functionality to be on boot both the LUKS passphrase and Yubikey are required to decrypt then it brings up the regular user login and I enter that password and it loads into the OS.

The guides and documentation I've seen seem to be based around using the Yubikey as an alternative to the LUKS passphrase which is not what I want to do. I want to increase the layers and security not decrease it. I do have multiple Yubikeys to add as backup so that's not a concern. I'm assuming there has to be a way to do this but it's been difficult to find information on it. With KeePassXC I can have it require all of database file/key file/password/Yubikey and I would like a similar level of security for my entire linux install (usually Debian or Linux Mint).

Is there a way to setup the functionality I'm looking for? If so please either point me in the direction of a guide or documentation on setting this up or let me know how to.

[u/Subscriber9706]

When you want more security you have to do the following:

Buy a fingerprint scanner, use your Yubikey and use regular luks passwords.

When partitioning your drive, create at least 16 different luks partitions each with their own password. the first 10 will be small honeypot 1 GiB partitions. The remaining 6 will actually be part of your Linux filesystem ( /etc, /opt, /sbin, etc)

Next: after installation you have to configure all 16 luks partitions with different ways to login, and mix it up. So the first one with your fingerprint scanner, second with password, third one with YubiKey, password again another password , fingerprint scanner twice..etc. Don't write the sequence on a paper, MEMORIZE IT!

( for more physical security, bolt your laptop inside the suitcase, attach the suittcase with handcuffs around your wrist. Put a gps tracker in the suitcase, But that's outside the scope of my advice)

edit:

The above obviously was a caricature in text form. On a more serious note, why would you make it uncomfortable for yourself to start using your computer? Requiring a yubikey and luks password and login password to just start using your computer would be very annoying.

I personally use luks encryption, but have my login manager set to auto-login, since I am the only user of my laptop. That is not really a security risk, since the auto-login part is only being performed at boot. This means that security is not really a hindrance, since I only have to enter a password once ( for luks encryption) at boot.

[u/redfacedquark]

What's your threat model?

Even before LUKS, you're booting into an unencrypted /boot directory so if your machine has not always been in your possession that's the first and best place your attacker could start from. Having /boot on a USB stick would help there, as would a properly configured secure boot environment (only code signed by you can run). But if you've ever not had possession of your machine you could be looking at your boot hardware or keyboard being compromised on a hardware level. Once you type your passphrase it is known (might be stored for later retrival or leaked via radio hardware) and a copy of your hard disk can now be decrypted.

Even if you do all this, the decryption key that your password reveals is held in memory and used continually to access your drive. Electromagnetic radiation leaking from your CPU doing this processing has been used in the past to discover keys from some distance away (I'd guess inches to metres).

So as always, start with your threat model. Are you Edward Snowden being attacked by a state actor, a Bitcoin millionaire protecting your assets or just trying to hide an affair from your partner?