Unlock LUKS volume with Yubikey without pin or presence

Help
1

At the moment, FIDO2-HMAC doesn’t seem to allow unlocking with a Yubikey without user pin or user presence. Is there a way to patch the systemd package to allow it, or do I have to switch to PKCS#11? If the latter, will the following steps (taken from here) wipe out the age-plugin-yubikey identities currently on the Yubikey?

ykman piv reset
ykman piv generate-key -a RSA2048 9d pubkey.pem
ykman piv generate-certificate --subject "Knobelei" 9d pubkey.pem
rm pubkey.pem
1 Like
2

Another idea was to use age-plugin-yubikey to decrypt the password, but since setting up pcscd in stage 1 is a little complicated, I thought I could set up the LUKS passwordFile as follows, as mentioned in this issue:

"<(set +x; echo -n \"$(age-plugin-yubikey -i | age -d -i - /path/to/secret/file/in/nix/store)\"; set -x)"