Systemd Now Can Unlock Encrypted Boot Drives Using An External Password File

Merged today into systemd is basic keydev support for cryptsetup-generator to allow unlocking an encrypted drive by using a key file that is stored on an external drive.

The Dracut initramfs framework has already supported unlocking encrypted drives by relying upon a key file stored on an external HDD/SSD. But until now systemd hasn't supported key files being on external block devices (keydev).

The newly-added support to systemd allows specifying a keydev block device based upon its UUID and a path to the key, using the added luks.uuid boot parameter.

With that it's now possible to easily have your LUKS encrypted boot device encrypted and the key stored on an external block device. The change is present for the upcoming systemd 240 release.