My computer is FDE with Luks2, NO passphrase, keyslot deleted for passphrase, Yubikey + PIN + Touch enforced. Yubikkey has an 8 guess you strike out and the key bricks for unlocking the Luks2 FDE.
I asked 4 AI’s if that was true and all said yes. One person here said that was not true. They said the wrong guesses never count down on the Yubikey. So I am here to clarify.
Does a wrong pin guess subtract from the 8 strikes your out PIN?
Yes. After three incorrect PIN entries you need to power cycle the key (unplug and replug), and after eight the FIDO2 application becomes locked.
- To re-attempt to enter the PIN after you have entered an incorrect PIN three times in succession, power-cycle the FIDO2 application.
- Once a FIDO2 PIN is set, it can be changed but removal of a FIDO2 PIN requires a FIDO2 reset.
- If the PIN is entered incorrectly eight times in succession, the FIDO2 application locks and FIDO2 authentication is no longer possible. To unlock the FIDO2 application, a FIDO2 reset is required.
Note
Resetting the FIDO2 application also resets the U2F application. This means the YubiKey must be re-registered not only with all the FIDO2 sites, but also with all the U2F sites.
As a point of clarification, this does not brick the Yubikey by any means but will require that FIDO2 is reset before you can use that feature again. Your computer, however, will be bricked if that is the only unlock mechanism you have configured.
Yeah, I got that part. But being able to thwart luks header brute forcing makes me feel good. 
On a side not I have AppArmor running in complain mode now, will look at logs and switch it on soon. Then I will tie a nano touch Yubikey to “sudo”. If I ever get infected they will have fun trying to get root.
Most privilege escalation attacks do not occur via bruteforcing. They occur via security vulnerabilities.
The amount of malware for Linux desktop is very small and unless you’re installing weird shit from the AUR, you would be more than fine. So… I find it a pretty extreme measure if you’re a home user and don’t share the computer with someone. You do you, though. I would 100% do something similar if I had a Yubikey, at least once, just to see how it is done.
How do you use FIDO2 for a disk encryption? I thought that is purely for internet authentication (because it is based on certificate exchange between you and the website and some nonce tokens → always a different data bits).
For the decryption you need a stable “password” (cypher). So that you can decrypt the file each time.
Yubikey has other cryptographic features as well. I expect LUKS2 to use challenge-response mechanism that uses HMAC-SHA1 of the yubikey to always generate the same cypher. And this can require a physical touch of the key but no pin. Pin can be a feature of LUKS2 though but then there is no yubikey harware limit for the number of failed attempts.
I am not an expert on this subject but I would like to try to implement it in the future so I am interested in the way how you can setup this scenario.
You can use systemd-cryptenroll to enroll a Yubikey for unlocking a LUKS volume. https://wiki.archlinux.org/title/Systemd-cryptenroll
systemd has native support for unlocking a LUKS volume with a FIDO2 device, including requiring the PIN be validated if the device supports it.
–fido2-with-client-pin= BOOL
When enrolling a FIDO2 security token, controls whether to require the user to enter a PIN when unlocking the volume (the FIDO2 “clientPin” feature). Defaults to “yes”. (Note: this setting is without effect if the security token does not support the “clientPin” feature at all, or does not allow enabling or disabling it.)Added in version 249.