diff --git a/0002-Cryptomount-support-key-files.patch b/0002-Cryptomount-support-key-files.patch
new file mode 100644
index 00000000000..43af5ff3cbf
--- /dev/null
+++ b/0002-Cryptomount-support-key-files.patch
@@ -0,0 +1,205 @@
+From df3aa34cc68b128c5441ee25ef092e6c2c87392e Mon Sep 17 00:00:00 2001
+From: John Lane <john@lane.uk.net>
+Date: Fri, 26 Jun 2015 13:37:10 +0100
+Subject: [PATCH 2/7] Cryptomount support key files
+
+---
+ grub-core/disk/cryptodisk.c | 46 ++++++++++++++++++++++++++++++++++++++++++++-
+ grub-core/disk/geli.c       |  4 +++-
+ grub-core/disk/luks.c       | 44 +++++++++++++++++++++++++++++--------------
+ include/grub/cryptodisk.h   |  5 ++++-
+ 4 files changed, 82 insertions(+), 17 deletions(-)
+
+diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
+index 5230a5a9a..5261af547 100644
+--- a/grub-core/disk/cryptodisk.c
++++ b/grub-core/disk/cryptodisk.c
+@@ -42,6 +42,9 @@ static const struct grub_arg_option options[] =
+     {"all", 'a', 0, N_("Mount all."), 0, 0},
+     {"boot", 'b', 0, N_("Mount all volumes with `boot' flag set."), 0, 0},
+     {"header", 'H', 0, N_("Read LUKS header from file"), 0, ARG_TYPE_STRING},
++    {"keyfile", 'k', 0, N_("Key file"), 0, ARG_TYPE_STRING},
++    {"keyfile-offset", 'O', 0, N_("Key file offset (bytes)"), 0, ARG_TYPE_INT},
++    {"keyfile-size", 'S', 0, N_("Key file data size (bytes)"), 0, ARG_TYPE_INT},
+     {0, 0, 0, 0, 0, 0}
+   };
+ 
+@@ -811,6 +814,8 @@ grub_util_cryptodisk_get_uuid (grub_disk_t disk)
+ static int check_boot, have_it;
+ static char *search_uuid;
+ static grub_file_t hdr;
++static grub_uint8_t *key, keyfile_buffer[GRUB_CRYPTODISK_MAX_KEYFILE_SIZE];
++static grub_size_t keyfile_size;
+ 
+ static void
+ cryptodisk_close (grub_cryptodisk_t dev)
+@@ -841,7 +846,7 @@ grub_cryptodisk_scan_device_real (const char *name, grub_disk_t source)
+     if (!dev)
+       continue;
+     
+-    err = cr->recover_key (source, dev, hdr);
++    err = cr->recover_key (source, dev, hdr, key, keyfile_size);
+     if (err)
+     {
+       cryptodisk_close (dev);
+@@ -949,6 +954,45 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
+     hdr = NULL;
+ 
+   have_it = 0;
++  key = NULL;
++
++  if (state[4].set) /* Key file; fails back to passphrase entry */
++    {
++      grub_file_t keyfile;
++      int keyfile_offset;
++      grub_size_t requested_keyfile_size;
++
++      requested_keyfile_size = state[6].set ? grub_strtoul(state[6].arg, 0, 0) : 0;
++
++      if (requested_keyfile_size > GRUB_CRYPTODISK_MAX_KEYFILE_SIZE)
++        grub_printf (N_("Key file size exceeds maximum (%llu)\n"), \
++	                     (unsigned long long) GRUB_CRYPTODISK_MAX_KEYFILE_SIZE);
++      else
++        {
++          keyfile_offset = state[5].set ? grub_strtoul (state[5].arg, 0, 0) : 0;
++          keyfile_size = requested_keyfile_size ? requested_keyfile_size : \
++		                             GRUB_CRYPTODISK_MAX_KEYFILE_SIZE;
++
++          keyfile = grub_file_open (state[4].arg, GRUB_FILE_TYPE_NONE);
++          if (!keyfile)
++            grub_printf (N_("Unable to open key file %s\n"), state[4].arg);
++          else if (grub_file_seek (keyfile, keyfile_offset) == (grub_off_t)-1)
++            grub_printf (N_("Unable to seek to offset %d in key file\n"), keyfile_offset);
++          else
++            {
++              keyfile_size = grub_file_read (keyfile, keyfile_buffer, keyfile_size);
++              if (keyfile_size == (grub_size_t)-1)
++                 grub_printf (N_("Error reading key file\n"));
++	      else if (requested_keyfile_size && (keyfile_size != requested_keyfile_size))
++                 grub_printf (N_("Cannot read %llu bytes for key file (read %llu bytes)\n"),
++                                                (unsigned long long) requested_keyfile_size,
++						(unsigned long long) keyfile_size);
++              else
++                key = keyfile_buffer;
++	    }
++        }
++    }
++
+   if (state[0].set)
+     {
+       grub_cryptodisk_t dev;
+diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c
+index f4394eb42..da6aa6a63 100644
+--- a/grub-core/disk/geli.c
++++ b/grub-core/disk/geli.c
+@@ -401,7 +401,9 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
+ 
+ static grub_err_t
+ recover_key (grub_disk_t source, grub_cryptodisk_t dev,
+-	     grub_file_t hdr __attribute__ ((unused)) )
++	     grub_file_t hdr __attribute__ ((unused)),
++	     grub_uint8_t *key __attribute__ ((unused)),
++	     grub_size_t keyfile_size __attribute__ ((unused)) )
+ {
+   grub_size_t keysize;
+   grub_uint8_t digest[GRUB_CRYPTO_MAX_MDLEN];
+diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
+index 66e64c0e0..588236888 100644
+--- a/grub-core/disk/luks.c
++++ b/grub-core/disk/luks.c
+@@ -322,12 +322,16 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
+ static grub_err_t
+ luks_recover_key (grub_disk_t source,
+ 		  grub_cryptodisk_t dev,
+-	          grub_file_t hdr)
++		  grub_file_t hdr,
++		  grub_uint8_t *keyfile_bytes,
++		  grub_size_t keyfile_bytes_size)
+ {
+   struct grub_luks_phdr header;
+   grub_size_t keysize;
+   grub_uint8_t *split_key = NULL;
+-  char passphrase[MAX_PASSPHRASE] = "";
++  char interactive_passphrase[MAX_PASSPHRASE] = "";
++  grub_uint8_t *passphrase;
++  grub_size_t passphrase_length;
+   grub_uint8_t candidate_digest[sizeof (header.mkDigest)];
+   unsigned i;
+   grub_size_t length;
+@@ -364,18 +368,30 @@ luks_recover_key (grub_disk_t source,
+   if (!split_key)
+     return grub_errno;
+ 
+-  /* Get the passphrase from the user.  */
+-  tmp = NULL;
+-  if (source->partition)
+-    tmp = grub_partition_get_name (source->partition);
+-  grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
+-	       source->partition ? "," : "", tmp ? : "",
+-	       dev->uuid);
+-  grub_free (tmp);
+-  if (!grub_password_get (passphrase, MAX_PASSPHRASE))
++  if (keyfile_bytes)
+     {
+-      grub_free (split_key);
+-      return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
++      /* Use bytestring from key file as passphrase */
++      passphrase = keyfile_bytes;
++      passphrase_length = keyfile_bytes_size;
++    }
++  else
++    {
++      /* Get the passphrase from the user.  */
++      tmp = NULL;
++      if (source->partition)
++        tmp = grub_partition_get_name (source->partition);
++      grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
++		    source->partition ? "," : "", tmp ? : "", dev->uuid);
++      grub_free (tmp);
++      if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE))
++        {
++          grub_free (split_key);
++          return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
++        }
++
++      passphrase = (grub_uint8_t *)interactive_passphrase;
++      passphrase_length = grub_strlen (interactive_passphrase);
++
+     }
+ 
+   /* Try to recover master key from each active keyslot.  */
+@@ -393,7 +409,7 @@ luks_recover_key (grub_disk_t source,
+ 
+       /* Calculate the PBKDF2 of the user supplied passphrase.  */
+       gcry_err = grub_crypto_pbkdf2 (dev->hash, (grub_uint8_t *) passphrase,
+-				     grub_strlen (passphrase),
++				     passphrase_length,
+ 				     header.keyblock[i].passwordSalt,
+ 				     sizeof (header.keyblock[i].passwordSalt),
+ 				     grub_be_to_cpu32 (header.keyblock[i].
+diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
+index 4e6e89a93..67f6b0b59 100644
+--- a/include/grub/cryptodisk.h
++++ b/include/grub/cryptodisk.h
+@@ -55,6 +55,8 @@ typedef enum
+ #define GRUB_CRYPTODISK_GF_BYTES (1U << GRUB_CRYPTODISK_GF_LOG_BYTES)
+ #define GRUB_CRYPTODISK_MAX_KEYLEN 128
+ 
++#define GRUB_CRYPTODISK_MAX_KEYFILE_SIZE 8192
++
+ struct grub_cryptodisk;
+ 
+ typedef gcry_err_code_t
+@@ -109,7 +111,8 @@ struct grub_cryptodisk_dev
+ 
+   grub_cryptodisk_t (*scan) (grub_disk_t disk, const char *check_uuid,
+ 			     int boot_only, grub_file_t hdr);
+-  grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev, grub_file_t hdr);
++  grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev,
++			    grub_file_t hdr, grub_uint8_t *key, grub_size_t keyfile_size);
+ };
+ typedef struct grub_cryptodisk_dev *grub_cryptodisk_dev_t;
+ 
+-- 
+2.16.2
+
