Encrypt HDD with keyfile and password and allow backing up the keyfile with secret sharing
Is /dev/urandom fine for my use-case or should I use /dev/random?
  


Theoretically, there is no security difference as both are regarded to be cryptographically secure RNGs. Practically, you’ll want to use /dev/urandom as that is “non-blocking” since it re-uses it’s entropy-pool whenever it runs out of random data, while /dev/random may make your program “stall” if it runs out of entropy. Simpler said: /dev/random can be a bottleneck, /dev/urandom fixes the issue.


  
  Some people told me that I should use a key derivation function because otherwise, the effect of the password isn't spread. But do I need the effect of the password to be spread? The way I see it, cryptsetup will already use a key derivation function on my key to increase computation time and try to spread the effect of each bit.
  


I am not familiar with cryptsetup, and I don’t want to judge its internal workings by just taking a short glimpse at the related website… but if you’re sure it implements its own key derivation function (which I think it does as the site talks about using cryptsetup to generate dedicated key-files), it indeed wouldn’t make much sense to run that through another KDF after that. Yet, if you’re not sure if cryptsetup indeed provides a KDF (again: I am not 100% sure about that), or if you have any doubts about the quality of its KDF, I would certainly advise to opt-in for a dedicated KDF tool.

Oh, and one more thing – in case you don’t know about it…


  … I could use dm-crypt directly …


“Word on the street” has it that there are some weaknesses to watch out for when using dm-crypt. Meaning: whenever you’re thinking about dm-crypt, remember to choose your settings wisely.


(screenshot source)