anchor.diff:          fi
   
           if [ "$update_failed" == false ]; then
  -            new_uuid_r="$(echo -n $new_uuid_r | take 36 | tr -d '-')"
  +            new_uuid_r="$(echo -n $new_uuid_r | head -c 36 | tr -d '-')"
   
               local new_challenge
  -            new_challenge="$(echo -n $k_user$new_uuid_r$uuid_luks | openssl-wrap dgst -binary -sha1 | rbtohex)"
  -
  -            local new_k_blob
  -            new_k_blob="$(echo -n $new_challenge | hextorb | openssl-wrap dgst -binary -sha1 -mac HMAC -macopt hexkey:$k_yubi | rbtohex)"
  -
  -            local new_aes_blob
  -            new_aes_blob=$(echo -n "$k_yubi$k_luks$checksum" | hextorb | openssl-wrap enc -e -aes-256-ctr -K "$new_k_blob" -iv "$new_uuid_r" | rbtohex)
  -
  -            ${optionalString yubikey.multiUser ''
  -            sed -i -e "s|^$user_id_hash$user_record|$user_id_hash$new_uuid_r$new_aes_blob|1"
  -            ''}
  -
  -            ${optionalString (!yubikey.multiUser) ''
  -            echo -n "$new_uuid_r$new_aes_blob" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
  -            ''}
  +            new_challenge="$(echo -n $k_user$new_uuid_r | openssl-wrap dgst -binary -sha512 | rbtohex)"
  +
  +            local new_k_luks
  +            new_k_luks="$(ykchalresp -${toString yubikey.slot} -x $new_challenge 2>/dev/null)"
  +
  +            mkdir -p ${yubikey.ramfsMountPoint}
  +            # A ramfs is used here to ensure that the file used to update
  +            # the key slot with cryptsetup will never get swapped out.
  +            # Warning: Do NOT replace with tmpfs!
  +            mount -t ramfs none ${yubikey.ramfsMountPoint}
  +
  +            echo -n "$new_k_luks" | hextorb > ${yubikey.ramfsMountPoint}/new_key
  +            echo -n "$k_luks" | cryptsetup luksChangeKey ${device} --key-file=- ${yubikey.ramfsMountPoint}/new_key
  +
  +            if [ $? == "0" ]; then
  +                echo -n "$new_uuid_r" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
  +            else
  +                echo "Warning: Could not update LUKS key, current challenge persists!"
  +            fi
  +
  +            rm -f ${yubikey.ramfsMountPoint}/new_key
  +            umount ${yubikey.ramfsMountPoint}
  +            rm -rf ${yubikey.ramfsMountPoint}
           else
               echo "Warning: Could not obtain new UUID, current challenge persists!"
           fi
  
positive.code:               description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false)";
              };
  
              multiUser = mkOption {
                default = false;
                type = types.bool;
                description = "Whether to allow multiple users to authenticate with a Yubikey";
              };
  
              slot = mkOption {
                default = 2;
                type = types.int;
                description = "Which slot on the Yubikey to challenge";
              };
  
              storage = mkOption {
                type = types.optionSet;
                description = "Options related to the authentication record";
  
                options = {
                  device = mkOption {
  
negative.code:     ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
  
      rbtohex() {
          ( od -An -vtx1 | tr -d ' \n' )
      }
  
      hextorb() {
          ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf )
      }
  
      open_yubikey() {
  