Let us say I am creating a program that works offline so password information needs to be stored locally (I know, not optimal, but this is just a personal project of mine). In terms of keeping the password itself secure, I figured I could utilize a KDF such as PBKDF2 or scrypt to derive two keys from the password, one for authentication and another for encryption/decryption to keep the sensitive information inside the program itself safe.
Now let's say I wanted to add an additional feature that the user could limit the attempts at the password such that exceeding these limits would lock a potential attacker out of the program for some period time. My question would be how to keep information such as the number of attempts made at the password secure? For example, the program will log the number of attempts made in a file so that if a potential attacker was to close and reopen the program, the number of attempts already made was saved. What would be a method I could employ to secure this log such that an attacker wouldn't be able to go in and change the logged number of attempts to say 0 and go on for an unlimited number of attempts?