Two passwords to LUKS slots

[Swekkerooni]

While research and testing ODIN, I noticed that there are two passwords enrolled to the LUKS header/volume in slot 0 and slot 1.
I already skimmed over the installation script, but didn't notice anything particular that would lead to this outcome.

I'm curious what causes this, and if it can't be just the one password as chosen during installation...

Installed 030826 KDE Plasma with MOK. No changes in that behaviour related to the other thread btw, but I didn't want to discuss this in that thread.

[r0b0]

You are right, the installer creates a random 512B file and uses it to initialize the luks device. This is most probably what you see in slot 0.

Initially I thought of exposing this file for the user to serve as a 'recovery' but I never got around to actually implement this.

I will make a note to clean up the slot 0 after a successful installation.

This is the variable $KEYFILE in installer.sh

[Swekkerooni]

Alright, thanks for the reply, makes sense. But personally I'd rather use systemd-cryptenroll /dev/disk/ --recovery-key post-install and keep the installation itself as clean as possible.
I'm gonna close this discussion for now if that's alright.
Looking forward to get back in the MOK testing saddle soon, will report back.