I am working on a Raspberry Pi 3B v1.2, and I have already encrypted my root partition of the OS with LUKS.
The problem is that I would like to decrypt it or have the appropriate password to decrypt it using a Yubikey and use a challenge password at boot time.
I've being searching on Internet a lot about how to do it but everything I have found is that there is a bug that in new distros' systemd do not recognize the /etc/crypttab keyscript option (which refers to a bash script) that would create that challenge-password situation at a boot time and as a result, get the password to decrypt the root partition.
Every time I boot up the raspberry, appears one question that asks for the password (I think it is the askpass script that generates it, but I am not really sure about it) but the thing is that is not what it is expected to be. I don't know if the bug is fixed yet or not and if it is, I would really appreciate an answer on where is it and how to fix it.
By the way, I also try to use at kernel command line the cryptopts option to decrypt it with the script in bash I mentioned before, but nothing. The password needed is already saved in the yubikey and the yubikey is also configured to work on the challenge-response situation.
Also, every time I made a change on initramfs I use both sudo update-initramfs -u and sudo update-initramfs -c -k, which I know that these last one is not really recommended.
On the other hand, I've also read that there is a conflict between initramfs and the initramfs that systemd generates by itself. Something like, even if you specified to use the /etc/crypttab keyscript option it won't read it. By the way, I am using a Raspberry Pi OS, the one that offers their webpage: "Raspberry Pi OS with desktop and recommended software", debian version 11 (bullseye).
