diff --git a/src/cryptsetup.c b/src/cryptsetup.c
index 8ec3cca8..5c2b610c 100644
--- a/src/cryptsetup.c
+++ b/src/cryptsetup.c
@@ -817,32 +817,6 @@ static int action_benchmark(void)
 	return r;
 }
 
-static int _read_mk(const char *file, char **key, int keysize)
-{
-	int fd;
-
-	*key = crypt_safe_alloc(keysize);
-	if (!*key)
-		return -ENOMEM;
-
-	fd = open(file, O_RDONLY);
-	if (fd == -1) {
-		log_err(_("Cannot read keyfile %s.\n"), file);
-		goto fail;
-	}
-	if ((read(fd, *key, keysize) != keysize)) {
-		log_err(_("Cannot read %d bytes from keyfile %s.\n"), keysize, file);
-		close(fd);
-		goto fail;
-	}
-	close(fd);
-	return 0;
-fail:
-	crypt_safe_free(*key);
-	*key = NULL;
-	return -EINVAL;
-}
-
 static int set_pbkdf_params(struct crypt_device *cd, const char *dev_type)
 {
 	struct crypt_pbkdf_type pbkdf = {};
@@ -1044,7 +1018,7 @@ static int action_luksFormat(void)
 		goto out;
 
 	if (opt_master_key_file) {
-		r = _read_mk(opt_master_key_file, &key, keysize);
+		r = tools_read_mk(opt_master_key_file, &key, keysize);
 		if (r < 0)
 			goto out;
 	}
@@ -1119,7 +1093,7 @@ static int action_open_luks(void)
 
 	if (opt_master_key_file) {
 		keysize = crypt_get_volume_key_size(cd);
-		r = _read_mk(opt_master_key_file, &key, keysize);
+		r = tools_read_mk(opt_master_key_file, &key, keysize);
 		if (r < 0)
 			goto out;
 		r = crypt_activate_by_volume_key(cd, activated_name,
@@ -1335,7 +1309,7 @@ static int action_luksAddKey(void)
 	}
 
 	if (opt_master_key_file) {
-		r = _read_mk(opt_master_key_file, &key, keysize);
+		r = tools_read_mk(opt_master_key_file, &key, keysize);
 		if (r < 0)
 			goto out;
 
diff --git a/src/cryptsetup.h b/src/cryptsetup.h
index 718b5083..125a3ac7 100644
--- a/src/cryptsetup.h
+++ b/src/cryptsetup.h
@@ -98,6 +98,8 @@ void tools_time_progress(uint64_t device_size, uint64_t bytes,
 			 struct timeval *start_time, struct timeval *end_time);
 int tools_wipe_progress(uint64_t size, uint64_t offset, void *usrptr);
 
+int tools_read_mk(const char *file, char **key, int keysize);
+
 /* Log */
 #define log_dbg(x...) clogger(NULL, CRYPT_LOG_DEBUG, __FILE__, __LINE__, x)
 #define log_std(x...) clogger(NULL, CRYPT_LOG_NORMAL, __FILE__, __LINE__, x)
diff --git a/src/utils_password.c b/src/utils_password.c
index 09ccc898..c0d5a1f8 100644
--- a/src/utils_password.c
+++ b/src/utils_password.c
@@ -303,3 +303,29 @@ void tools_passphrase_msg(int r)
 	if (r == -EPERM)
 		log_err(_("No key available with this passphrase.\n"));
 }
+
+int tools_read_mk(const char *file, char **key, int keysize)
+{
+	int fd;
+
+	*key = crypt_safe_alloc(keysize);
+	if (!*key)
+		return -ENOMEM;
+
+	fd = open(file, O_RDONLY);
+	if (fd == -1) {
+		log_err(_("Cannot read keyfile %s.\n"), file);
+		goto fail;
+	}
+	if ((read(fd, *key, keysize) != keysize)) {
+		log_err(_("Cannot read %d bytes from keyfile %s.\n"), keysize, file);
+		close(fd);
+		goto fail;
+	}
+	close(fd);
+	return 0;
+fail:
+	crypt_safe_free(*key);
+	*key = NULL;
+	return -EINVAL;
+}