Arch Linux

My current disk setup requires my laptop root and swap drives to be on different LUKS partitions. That makes it impossible to use the resume hook in mkinitcpio, since I won't have any /dev/unencrypted_device to point resume to on the grub kernel line. It looks like the existing encrypt hook can be used to decrypt root or (undocumented, but should work) the swap/resume volume, but not both.

I've seen this discussed before, e.g.: http://bbs.archlinux.org/viewtopic.php?id=63011.

Based on those discussions, what seems to me to be the most robust solution is decrypting + mounting one partition, which contains the keyfiles for your root and/or swap/suspend volume, then umounting the partition with the keyfiles. It works best if this partition is unjournaled and/or never mounted when one hibernates the machine. Though you may be able to work around that; see the above forum post. In my case, I just shrunk my boot partition a bit and made a tiny small new partition to hold the keyfiles for root and swap. This partition is only ever decrypted and mounted during the bootup sequence.

I wrote and am successfully using the attached initcpio hook. From its help():
This hook allows for multiple encrypted root devices
(for example, root and swap) to be opened at init time.
It uses a kernel argument cryptkey= in same way as the encrypt
hook (it can be left empty, or supplied as dev:fstype:path,
or supplied as dev:raw_numeric_offset:length).
Instead of the encrypt hook's required cryptdevice= argument,
it instead uses a cryptdevices= argument, whose format must be:

cryptdevices=dev_holding_keyfiles:fstype[:path],\\
dev1_to_decrypt:alias_for_it,\\
dev2_to_decrypt:alias_for_it,...

The code is based on the encrypt hook code. I just removed the handling of legacy encryption, parsed the more complex cryptdevices instead of cryptdevice, and used a cascade of calls to cryptSetup luksOpen...