@@ -56,7 +56,7 @@ let
5656
5757 ykinfo -v 1>/dev/null 2>&1
5858 if [ $? != 0 ]; then
59− echo -n "Waiting $secs seconds for Yubikey to appear..."
59+ echo -n "Waiting $secs seconds for YubiKey to appear..."
6060 local success=false
6161 for try in $(seq $secs); do
6262 echo -n .
@@ -118,7 +118,7 @@ let
118118 # Cryptsetup locking directory
119119 mkdir -p /run/cryptsetup
120120
121− # For Yubikey salt storage
121+ # For YubiKey salt storage
122122 mkdir -p /crypt-storage
123123
124124 ${optionalString luks.gpgSupport ''
@@ -218,7 +218,7 @@ let
218218 }
219219
220220 ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
221− # Yubikey
221+ # YubiKey
222222 rbtohex() {
223223 ( od -An -vtx1 | tr -d ' \n' )
224224 }
@@ -244,7 +244,7 @@ let
244244 local new_k_luks
245245
246246 mount -t ${yubikey.storage.fsType} ${yubikey.storage.device} /crypt-storage || \
247− die "Failed to mount Yubikey salt storage device"
247+ die "Failed to mount YubiKey salt storage device"
248248
249249 salt="$(cat /crypt-storage${yubikey.storage.path} | sed -n 1p | tr -d '\n')"
250250 iterations="$(cat /crypt-storage${yubikey.storage.path} | sed -n 2p | tr -d '\n')"
@@ -254,8 +254,27 @@ let
254254 for try in $(seq 3); do
255255 ${optionalString yubikey.twoFactor ''
256256 echo -n "Enter two-factor passphrase: "
257− read -r k_user
258− echo
257+ k_user=
258+ while true; do
259+ if [ -e /crypt-ramfs/passphrase ]; then
260+ echo "reused"
261+ k_user=$(cat /crypt-ramfs/passphrase)
262+ break
263+ else
264+ # Try reading it from /dev/console with a timeout
265+ IFS= read -t 1 -r k_user
266+ if [ -n "$k_user" ]; then
267+ ${if luks.reusePassphrases then ''
268+ # Remember it for the next device
269+ echo -n "$k_user" > /crypt-ramfs/passphrase
270+ '' else ''
271+ # Don't save it to ramfs. We are very paranoid
272+ ''}
273+ echo
274+ break
275+ fi
276+ fi
277+ done
259278 ''}
260279
261280 if [ ! -z "$k_user" ]; then
@@ -268,6 +287,11 @@ let
268287
269288 if [ $? == 0 ]; then
270289 opened=true
290+ ${if luks.reusePassphrases then ''
291+ # We don't rm here because we might reuse it for the next device
292+ '' else ''
293+ rm -f /crypt-ramfs/passphrase
294+ ''}
271295 break
272296 else
273297 opened=false
@@ -317,7 +341,7 @@ let
317341 if wait_yubikey ${toString yubikey.gracePeriod}; then
318342 do_open_yubikey
319343 else
320− echo "No yubikey found, falling back to non-yubikey open procedure"
344+ echo "No YubiKey found, falling back to non-YubiKey open procedure"
321345 open_normally
322346 fi
323347 }
@@ -665,8 +689,8 @@ in
665689 yubikey = mkOption {
666690 default = null;
667691 description = ''
668− The options to use for this LUKS device in Yubikey-PBA.
669− If null (the default), Yubikey-PBA will be disabled for this device.
692+ The options to use for this LUKS device in YubiKey-PBA.
693+ If null (the default), YubiKey-PBA will be disabled for this device.
670694 '';
671695
672696 type = with types; nullOr (submodule {
@@ -674,13 +698,13 @@ in
674698 twoFactor = mkOption {
675699 default = true;
676700 type = types.bool;
677− description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
701+ description = "Whether to use a passphrase and a YubiKey (true), or only a YubiKey (false).";
678702 };
679703
680704 slot = mkOption {
681705 default = 2;
682706 type = types.int;
683− description = "Which slot on the Yubikey to challenge.";
707+ description = "Which slot on the YubiKey to challenge.";
684708 };
685709
686710 saltLength = mkOption {
@@ -704,7 +728,7 @@ in
704728 gracePeriod = mkOption {
705729 default = 10;
706730 type = types.int;
707− description = "Time in seconds to wait for the Yubikey.";
731+ description = "Time in seconds to wait for the YubiKey.";
708732 };
709733
710734 /* TODO: Add to the documentation of the current module:
@@ -779,9 +803,9 @@ in
779803 default = false;
780804 type = types.bool;
781805 description = ''
782− Enables support for authenticating with a Yubikey on LUKS devices.
806+ Enables support for authenticating with a YubiKey on LUKS devices.
783807 See the NixOS wiki for information on how to properly setup a LUKS device
784− and a Yubikey to work with this feature.
808+ and a YubiKey to work with this feature.
785809 '';
786810 };
787811
@@ -799,7 +823,7 @@ in
799823
800824 assertions =
801825 [ { assertion = !(luks.gpgSupport && luks.yubikeySupport);
802− message = "Yubikey and GPG Card may not be used at the same time.";
826+ message = "YubiKey and GPG Card may not be used at the same time.";
803827 }
804828
805829 { assertion = !(luks.gpgSupport && luks.fido2Support);
@@ -807,7 +831,7 @@ in
807831 }
808832
809833 { assertion = !(luks.fido2Support && luks.yubikeySupport);
810− message = "FIDO2 and Yubikey may not be used at the same time.";
834+ message = "FIDO2 and YubiKey may not be used at the same time.";
811835 }
812836 ];
813837