anchor.diff:          local new_response
           local new_k_luks
   
  -        mkdir -p ${yubikey.storage.mountPoint}
  -        mount -t ${yubikey.storage.fsType} ${toString yubikey.storage.device} ${yubikey.storage.mountPoint}
  -
  -        salt="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path} | sed -n 1p | tr -d '\n')"
  -        iterations="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path} | sed -n 2p | tr -d '\n')"
  +        mount -t ${yubikey.storage.fsType} ${yubikey.storage.device} /crypt-storage || \
  +          die "Failed to mount Yubikey salt storage device"
  +
  +        salt="$(cat /crypt-storage${yubikey.storage.path} | sed -n 1p | tr -d '\n')"
  +        iterations="$(cat /crypt-storage${yubikey.storage.path} | sed -n 2p | tr -d '\n')"
           challenge="$(echo -n $salt | openssl-wrap dgst -binary -sha512 | rbtohex)"
           response="$(ykchalresp -${toString yubikey.slot} -x $challenge 2>/dev/null)"
   
  
positive.code:     # Warning: Do NOT replace with tmpfs!
      mkdir -p /crypt-ramfs
      mount -t ramfs none /crypt-ramfs
    '';
  
    postCommands = ''
      umount /crypt-ramfs 2>/dev/null
    '';
  
  
negative.code:             new_k_luks="$(echo | pbkdf2-sha512 ${toString yubikey.keyLength} $new_iterations $new_response | rbtohex)"
          fi
  
          echo -n "$new_k_luks" | hextorb > /crypt-ramfs/new_key
          echo -n "$k_luks" | hextorb | ${cschange} --key-file=- /crypt-ramfs/new_key
  
          if [ $? == 0 ]; then
              echo -ne "$new_salt\n$new_iterations" > /crypt-storage${yubikey.storage.path}
          else
              echo "Warning: Could not update LUKS key, current challenge persists!"
          fi
  
          rm -f /crypt-ramfs/new_key
          umount /crypt-storage
      }
  
      open_yubikey() {
  