anchor.diff:                description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false)";
               };
   
  +            multiUser = mkOption {
  +              default = false;
  +              type = types.bool;
  +              description = "Whether to allow multiple users to authenticate with a Yubikey";
  +            };
  +
               slot = mkOption {
                 default = 2;
                 type = types.int;
  
positive.code:             local new_k_blob
              new_k_blob="$(echo -n $new_challenge | hextorb | openssl-wrap dgst -binary -sha1 -mac HMAC -macopt hexkey:$k_yubi | rbtohex)"
  
              echo -n "$new_uuid_r" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
              echo -n "$k_yubi$k_luks$checksum" | hextorb | openssl-wrap enc -e -aes-256-ctr -K "$new_k_blob" -iv "$new_uuid_r" | rbtohex >> ${yubikey.storage.mountPoint}${yubikey.storage.path}
          else
              echo "Warning: Could not obtain new UUID, current challenge persists!"
          fi
  
negative.code:         mount -t ${yubikey.storage.fsType} ${toString yubikey.storage.device} ${yubikey.storage.mountPoint}
  
          local uuid_r
          local k_user
          local challenge
          local k_blob
          local aes_blob_decrypted
          local checksum_correct
          local checksum
          local uuid_luks
          local user_record
  
          uuid_luks="$(cryptsetup luksUUID ${device} | take 36 | tr -d '-')"
  
          ${optionalString (!yubikey.multiUser) ''
          user_record="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path})"
          uuid_r="$(echo -n $user_record | take 32)"
          ''}
  
          for try in $(seq 3); do
  
              ${optionalString yubikey.multiUser ''
              local user_id
              echo -n "Enter user id: "
              read -s user_id
              echo
              ''}
  
              ${optionalString yubikey.twoFactor ''
              echo -n "Enter two-factor passphrase: "
              read -s k_user
              echo
              ''}
  
              ${optionalString yubikey.multiUser ''
              local user_id_hash
              user_id_hash="$(echo -n $user_id | openssl-wrap dgst -binary -sha512 | rbtohex)"
  
              user_record="$(sed -n -e /^$user_id_hash[^$]*$/p ${yubikey.storage.mountPoint}${yubikey.storage.path} | tr -d '\n')"
  
              if [ ! -z "$user_record" ]; then
                  user_record="$(echo -n $user_record | drop 128)"
                  uuid_r="$(echo -n $user_record | take 32)"
              ''}
  
                  challenge="$(echo -n $k_user$uuid_r$uuid_luks | openssl-wrap dgst -binary -sha1 | rbtohex)"
  
                  k_blob="$(ykchalresp -${toString yubikey.slot} -x $challenge 2>/dev/null)"
  
                  aes_blob_decrypted="$(echo -n $user_record | drop 32 | hextorb | openssl-wrap enc -d -aes-256-ctr -K $k_blob -iv $uuid_r | rbtohex)"
  
                  checksum="$(echo -n $aes_blob_decrypted | drop 168)"
                  if [ "$(echo -n $aes_blob_decrypted | hextorb | take 84 | openssl-wrap dgst -binary -sha512 | rbtohex)" == "$checksum" ]; then
                      checksum_correct=1
                      break
                  else
                      checksum_correct=0
                      echo "Authentication failed!"
                  fi
  
              ${optionalString yubikey.multiUser ''
              else
                  checksum_correct=0
                  echo "Authentication failed!"
              fi
              ''}
          done
  
          if [ "$checksum_correct" != "1" ]; then
  