anchor.diff:  
       # For Yubikey salt storage
       mkdir -p /crypt-storage
  +
  +    # Disable all input echo for the whole stage. We could use read -s
  +    # instead but that would ocasionally leak characters between read
  +    # invocations.
  +    stty -echo
     '';
   
     postCommands = ''
  +    stty echo
       umount /crypt-storage 2>/dev/null
       umount /crypt-ramfs 2>/dev/null
     '';
  
positive.code:         for try in $(seq 3); do
              ${optionalString yubikey.twoFactor ''
              echo -n "Enter two-factor passphrase: "
              read -rs k_user
              echo
              ''}
  
  
negative.code:                     # ask cryptsetup-askpass
                      echo -n "${device}" > /crypt-ramfs/device
  
                      # and try reading it from /dev/console with a timeout
                      IFS= read -t 1 -r passphrase
                      if [ -n "$passphrase" ]; then
                         ${if luks.reusePassphrases then ''
                           # remember it for the next device
  