ZFS passwords on USB "keys"

[winnielinnie]

@rcfa

That would essentially mean putting the masterkey in one more more keyvaults that are encrypted by one or more alternative methods.

Don’t forget about this last-ditch failsafe. It can work with any implementation and gives you at least one last chance to prevent being locked out of your own data.

@rcfa

That would actually my preferred scenario. If done right, then the masterkey can be encrypted by multiple passphrases, so a few trusted users could each have their own passwords without the need to share them, while the encrypted masterkey stays put, and only the passphrases travel. This has also the advantage that one can easily change passwords without actually affecting the pool itself.

That’s the reason for the feature request from 8 years ago that I linked in post 4. LUKS already does this. Shame that ZFS is way behind. The lead developer for native encryption in ZFS had since left the project.