2 files changed, 11 insertions, 6 deletions
diff --git a/internal/configfile/config_file.go b/internal/configfile/config_file.go
index a70a511..c856ad0 100644
--- a/internal/configfile/config_file.go
+++ b/internal/configfile/config_file.go
@@ -45,6 +45,10 @@ type ConfFile struct {
 	// mounting. This mechanism is analogous to the ext4 feature flags that are
 	// stored in the superblock.
 	FeatureFlags []string
+	// TrezorPayload stores 32 random bytes used for unlocking the master key using
+	// a Trezor security module. The randomness makes sure that a unique unlock
+	// value is used for each gocryptfs filesystem.
+	TrezorPayload []byte `json:",omitempty"`
 	// Filename is the name of the config file. Not exported to JSON.
 	filename string
 }
@@ -68,7 +72,7 @@ func randBytesDevRandom(n int) []byte {
 // "password" and write it to "filename".
 // Uses scrypt with cost parameter logN.
 func Create(filename string, password []byte, plaintextNames bool,
-	logN int, creator string, aessiv bool, devrandom bool, trezor bool) error {
+	logN int, creator string, aessiv bool, devrandom bool, trezorPayload []byte) error {
 	var cf ConfFile
 	cf.filename = filename
 	cf.Creator = creator
@@ -88,8 +92,9 @@ func Create(filename string, password []byte, plaintextNames bool,
 	if aessiv {
 		cf.FeatureFlags = append(cf.FeatureFlags, knownFlags[FlagAESSIV])
 	}
-	if trezor {
+	if len(trezorPayload) > 0 {
 		cf.FeatureFlags = append(cf.FeatureFlags, knownFlags[FlagTrezor])
+		cf.TrezorPayload = trezorPayload
 	}
 	{
 		// Generate new random master key
diff --git a/internal/configfile/config_test.go b/internal/configfile/config_test.go
index e130cfa..b8ee150 100644
--- a/internal/configfile/config_test.go
+++ b/internal/configfile/config_test.go
@@ -62,7 +62,7 @@ func TestLoadV2StrangeFeature(t *testing.T) {
 }
 
 func TestCreateConfDefault(t *testing.T) {
-	err := Create("config_test/tmp.conf", testPw, false, 10, "test", false, false, false)
+	err := Create("config_test/tmp.conf", testPw, false, 10, "test", false, false, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -83,14 +83,14 @@ func TestCreateConfDefault(t *testing.T) {
 }
 
 func TestCreateConfDevRandom(t *testing.T) {
-	err := Create("config_test/tmp.conf", testPw, false, 10, "test", false, true, false)
+	err := Create("config_test/tmp.conf", testPw, false, 10, "test", false, true, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 }
 
 func TestCreateConfPlaintextnames(t *testing.T) {
-	err := Create("config_test/tmp.conf", testPw, true, 10, "test", false, false, false)
+	err := Create("config_test/tmp.conf", testPw, true, 10, "test", false, false, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -111,7 +111,7 @@ func TestCreateConfPlaintextnames(t *testing.T) {
 
 // Reverse mode uses AESSIV
 func TestCreateConfFileAESSIV(t *testing.T) {
-	err := Create("config_test/tmp.conf", testPw, false, 10, "test", true, false, false)
+	err := Create("config_test/tmp.conf", testPw, false, 10, "test", true, false, nil)
 	if err != nil {
 		t.Fatal(err)
 	}