I have multiple hard drives that should all be encrypted with the same keyfile or passphrase. Here's what I planned as an approach: I encrypt every hard disk with LUKS / cryptsetup and choose a keyfile. This keyfile should be encrypted with a passphrase (using gpg).
The question that pops up: Where do I store my unencrypted keyfile so LUKS can use it?
Well, since any encryption software stores its keys in the RAM, I figured: Why not store my keyfile on a ramdisk (note: I do not want to use
tempfs as it can be swapped). This way, whenever I want to mount my encrypted drives, I will load the keyfile into RAM (using a ramdisk) and then use that keyfile to mount all drives.
Upon any system shutdown / power outage, only the same risks apply that apply for the actual keys as well: Usual RAM attacks.
So my question is: Do you see any security issues involved in this scenario?
I know about the risks involved using the same passphrase for everything, but I want to make the tradeoff between security and functionality here. Also, all drives decrypted this way will be LVM drives that will be merged into one big partition anyway, so if one drive gets decrypted, I cannot rely on the data stored on the others to be secure (because it may be inferable).
Furthermore, the device should specifically not get mounted automatically at boot, because this is a headless machine. It will be running most of the time, but the mount should only occur when I request it.
I know most of the risks that are involved theoretically and I think I took precautions as far as possible in my scenario, so this question real is more of a technical question than a theoretical, although comments/critics about this approach are welcome as long as you take into account my notes.