I have fully encrypted my laptop using dm-crypt and luks. So If I start my laptop I was prompted for a password before init will start. This works just fine.

The problem

A possible attacker will know if he types in a password (i.e by trying) that his guessed password is wrong because luks refuses to decrypt that device. So I'm wondering if there is a way to circumvent this.

If someone enters a wrong password (read: Any literal that was not defined), a fake block device should get mounted (maybe I have to format and install another plain-unix there before) and booted, so that no one can determine (without inspecting the hard-disk any further) if the password was correct or not.

If this is not possible, it can also be another literal which is predefined to mount another block-device.

  • It would be possible with a custom initramfs, but there's no point in security by obscurity. A possible attacker would already have your password at that point (the password is easily obtained by modifying the initramfs and then waiting until you enter the password yourself). Commented Jul 5, 2013 at 17:52

1 Answer 1


There's only one way I can see accomplishing what you want. Modify the source code to put this failure condition in place yourself.

This though only works for the machine you have the disks on. If someone were trying to break into your disks though they wouldn't be using the boot procedure, they would boot on a flash or such and run a brute force that way.

Going through this trouble really doesn't buy you any more security.

  • 1
    it does. Ie. customs is forcing you to enter a password on laptop if you plan entering the USA. You could simply enter your wrong one, without notice...
    – Rafael T
    Commented Jul 5, 2013 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .