Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have fully encrypted my laptop using dm-crypt and luks. So If I start my laptop I was prompted for a password before init will start. This works just fine.

The problem

A possible attacker will know if he types in a password (i.e by trying) that his guessed password is wrong because luks refuses to decrypt that device. So I'm wondering if there is a way to circumvent this.

If someone enters a wrong password (read: Any literal that was not defined), a fake block device should get mounted (maybe I have to format and install another plain-unix there before) and booted, so that no one can determine (without inspecting the hard-disk any further) if the password was correct or not.

If this is not possible, it can also be another literal which is predefined to mount another block-device.

share|improve this question
    
It would be possible with a custom initramfs, but there's no point in security by obscurity. A possible attacker would already have your password at that point (the password is easily obtained by modifying the initramfs and then waiting until you enter the password yourself). –  frostschutz Jul 5 '13 at 17:52

1 Answer 1

There's only one way I can see accomplishing what you want. Modify the source code to put this failure condition in place yourself.

This though only works for the machine you have the disks on. If someone were trying to break into your disks though they wouldn't be using the boot procedure, they would boot on a flash or such and run a brute force that way.

Going through this trouble really doesn't buy you any more security.

share|improve this answer
    
it does. Ie. customs is forcing you to enter a password on laptop if you plan entering the USA. You could simply enter your wrong one, without notice... –  Rafael T Jul 5 '13 at 13:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.