It seems like the two main LUKS encryption options are:USB keyfile (see https://superuser.com/questions/149578/how-can-i-use-a-keyfile-on-a-removable-usb-drive-for-my-encrypted-root-in-debian)Typing in a passwordThese both have weaknesses. The first can be overcome by stealing the USB drive. In the second case, a keylogger could be used, or I could be forced to give over the password.Would it be possible to create an encryption scheme that required both of the options? Then, if I was given an injuction to provide the password, I could destroy the USB drive (e.g. burn it on the stovetop); conversely, if someone stole my USB drive, they would need to get my password as well.It seems the existing LUKS key slot idea is that providing a key for any key slot will unlock the device, not that one has to provide a key for all, or say 2 of 3 key slots (iirc the latter can be accomplished in a cryptographically secure manner using a Galois field).(Also, I happen to be on an OpenSuSE system, so please keep answers distro-agnostic or something that can work on SuSE.)
Are there more advanced LUKS key schemes, e.g. 2 of 3 keys needed?
linux;encryption;luks