Two factor authentication. How secure will be this setup?

Question

I want to be able to have a passphrase + keyfile (on a usb stick) combination. So whoever is going to unlock the system has to HAVE something AND KNOW something to get access. Of course, this way, if the stick is lost, then the disk can't be decrypted. That's why there has to be a back-up usb stick. But if you merely duplicate the same key stored on stick (1) to stick (2), then whoever finds/steals stick (1) now knows your current keyfile. I want to make it so that loosing a usb stick will not weaken the security in any way, by making so that the keyfile stored on that usb stick can be easily made useless. So my plan is to do the following:
HDD
    partition 1 | Contains encrypted keyfiles `Ke1`, `Ke2`
    partition 2 | Luks device, encrypted using the key `Ka`
Usb Stick 1
    boot
    keyfile K1
Usb Stick 2 (backup)
    boot
    keyfile K2
where
passphrase is `P`
`Ke1`          is  `Ka` encrypted using K1 and P
`Ke2`          is  `Ka` encrypted using K2 and P
K1 and K2 are different. Both are randomly generated keyfiles.
During the boot the following happens:
1) It boots from the usb stick (1)
2) It asks for a passphrase `P` in initrd. User types the passhprase.
3) It read keyfile `K1` from the USB stick (1)
3) It decrypts `Ke1` (which is encrypted using AES-256). It first decrypts it using `P`, then it decrypts it using K1. In the end you get the original `Ka`.
4) It uses `Ka` to unlock the luks device on partition 2 and then runs the system from there. Of course, Ka is only in memory.
If stick (1) is lost:
Then you can nuke (e.g. using shred) `Ke1` and now the K1 which is on that stick (1) is useless. But you can now use stick (2) instead since there is another version of encrypted `Ka` stored (`Ke2`).
If HDD is lost:
Although the keyfile (`Ka`) that decrypts the luks partition is stored on the drive itself, nobody can use that keyfile, because it's encrypted. I.e. they will only find `Ke1` and `Ke2` there, which will be useless without a usb stick and a passphrase.
Basic evil maid attacks (like infecting the MBR, which is what e.g. FinFisher does) should be impossible with this, because it boots from a flash that you carry with yourself.
Any comments?
P.S.
The real system will look like this:
HDD
    partition 1 | encrypted keyfiles
    partition 2 | luks device with LVM
        LVM swap
        LVM cryptdevice
            btrfs
                   /current-homeroot
                       /home
                       /root
                   /snapshot1
                       /home
                       /root
                   /snapshopt2 and etc
USB Stick
    /boot
    Keyfile 1
Then one can do incremental snapshots of the system.

Answer 1

I use the Google Authenticator app on my phone as two-factor authentication when SSH'ing to my VPS.
https://wiki.archlinux.org/index.php/Go … henticator
You get emergency codes to write down so you don't need a backup device.
I've not looked into whether or not you can use it to unlock a LUKS setup, but it's a PAM module so it might not be that difficult. It's worth searching for as an alternative to USB sticks.
Last edited by slithery (2015-01-10 20:21:13)