Re: Slow unlock of the LUKS device at boot

Lamy Geier <[email protected]>
Newsgroups dev.linux.lists.cryptsetup
Message-ID <[email protected]>
# Observation

For the slow partition (that uses LUKS2 and has LVM) takes about 6 
minutes to test passphrase as follows and returns a warning "No usable 
token is available."

```bash
sudo cryptsetup -v open --test-passphrase --type luks /dev/nvme0n1p5 
--key-file /etc/luks/boot_os.keyfile
sudo cryptsetup -v open --test-passphrase --type luks /dev/nvme0n1p5
```

For the boot partition (LUKS1), which used the same passphrase and 
keyfile as the above partition it takes just 5 seconds to test passphrase


```bash
sudo cryptsetup -v open --test-passphrase --type luks /dev/nvme0n1p1 
--key-file /etc/luks/boot_os.keyfile
sudo cryptsetup -v open --test-passphrase --type luks /dev/nvme0n1p1
```

---

Also, I did cryptsetup benchmark as follows

   ``` bash
   $ cryptsetup benchmark
   # Tests are approximate using memory only (no storage IO).
   PBKDF2-sha1      2631307 iterations per second for 256-bit key
   PBKDF2-sha256    5637505 iterations per second for 256-bit key
   PBKDF2-sha512    2118335 iterations per second for 256-bit key
   PBKDF2-ripemd160 1115506 iterations per second for 256-bit key
   PBKDF2-whirlpool 1006310 iterations per second for 256-bit key
   argon2i       9 iterations, 1048576 memory, 4 parallel threads (CPUs) 
for 256-bit key (requested 2000 ms time)
   argon2id      9 iterations, 1048576 memory, 4 parallel threads (CPUs) 
for 256-bit key (requested 2000 ms time)
   #     Algorithm |       Key |      Encryption |      Decryption
           aes-cbc        128b      1727.7 MiB/s      6931.8 MiB/s
       serpent-cbc        128b       116.2 MiB/s       868.9 MiB/s
       twofish-cbc        128b       252.9 MiB/s       566.7 MiB/s
           aes-cbc        256b      1313.0 MiB/s      5684.8 MiB/s
       serpent-cbc        256b       120.3 MiB/s       867.2 MiB/s
       twofish-cbc        256b       257.5 MiB/s       563.5 MiB/s
           aes-xts        256b      5342.5 MiB/s      5333.8 MiB/s
       serpent-xts        256b       748.8 MiB/s       783.1 MiB/s
       twofish-xts        256b       517.7 MiB/s       530.6 MiB/s
           aes-xts        512b      4779.9 MiB/s      4819.2 MiB/s
       serpent-xts        512b       756.1 MiB/s       779.9 MiB/s
       twofish-xts        512b       521.5 MiB/s       529.2 MiB/s
   ```



- Is the warning responsible for this slow behavior: "No usable token is 
available." Or can you suggest if I should tweak some key parameters or 
change the order of keys in keyslots.


-- 
Thanks and Regards

Lamy
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.