Is it possible to set up a bootloader that automatically begins shredding the header.img file and then the encrypted partition itself upon X failed attempts at decrypting the partition?If this does not already exist - is it possible to create any such software without extensive work?Cheers,
Automatically shred LUKS partition upon X failed decryption attempts?
encryption;luks;shred
Yes (for your own bootloader / initramfs) and No (for a thief who tries to decrypt it from a Live CD and thus circumvents your trap). So the question is, which situation are you trying to cover here...From a security standpoint it's not a good idea since it doesn't work and the password should be impossible to bruteforce anyhow. Also there is a high risk of triggering that trap yourself.It's entirely possible to make mistakes when entering a passphrase. My favourite is the caps lock key, hit it accidentally and not notice (since the password is not echoed) and... in your case it goes boom.In order to implement it you'd have to see if your distro's flavour of initramfs has a hook system or similar. A normal cryptsetup call may look like this:cryptsetup -T 5 luksOpen /dev/sda1 luksrootTo boobytrap it you could simply do something like:cryptsetup -T 5 luksOpen /dev/sda1 luksroot || boobytrapAnd boobytrap would be a function that deletes your stuff while keeping the thief occupied. In addition to that you must absolutely check the error code of cryptsetup; so you don't delete because of wrong parameters or anything like that. Check the RETURN CODES section in the manpage.Pseudocode: (untested and not recommended)boobytrap() {    if [ $? -eq 2 ]    then        # kill the disk silently in the background...        dd bs=1M if=/dev/zero of=/dev/sda1 seek=2 2> /dev/null &        # ...while keeping the thief busy entering more passwords        cryptsetup -T 9999 luksOpen /dev/sda1 luksroot \        && echo Congrats, but I already deleted your data...    fi}I hope you have a good backup.