I'm trying to use a Yubikey 4 as a second factor to access a LUKS-encrypted USB HDD. Here's how far I've gotten:

I'm using [yubikey-luks](https://github.com/cornelinux/yubikey-luks) to add my HMAC-SHA1 hashed password to slot 7 of the device.

* **Problem**: cryptsetup only challenges the yubikey on boot, and I'm opening the device once logged in.

However, I can use `ykchalresp` to manually challenge my Yubikey.

* **Problem**:
* That involves inputing my passphrase in plain text into a terminal.
* Even if I get past that, I don't know a way to conveniently pipe/input that to cryptsetup.

I've thought of writing the hashed passphrase to a file and using it as `--key-file`, but that sounds like a bad idea since I'll have the key to my device laying around.

Please let me know if I'm formatting a command wrong, or if you have a way around any of my problems!