Re: Slow unlock of the LUKS device at boot
Lamy Geier <[email protected]>
| Newsgroups | dev.linux.lists.cryptsetup |
|---|---|
| Message-ID | <[email protected]> |
# Observation
For the slow partition (that uses LUKS2 and has LVM) takes about 6
minutes to test passphrase as follows and returns a warning "No usable
token is available."
```bash
sudo cryptsetup -v open --test-passphrase --type luks /dev/nvme0n1p5
--key-file /etc/luks/boot_os.keyfile
sudo cryptsetup -v open --test-passphrase --type luks /dev/nvme0n1p5
```
For the boot partition (LUKS1), which used the same passphrase and
keyfile as the above partition it takes just 5 seconds to test passphrase
```bash
sudo cryptsetup -v open --test-passphrase --type luks /dev/nvme0n1p1
--key-file /etc/luks/boot_os.keyfile
sudo cryptsetup -v open --test-passphrase --type luks /dev/nvme0n1p1
```
---
Also, I did cryptsetup benchmark as follows
``` bash
$ cryptsetup benchmark
# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1 2631307 iterations per second for 256-bit key
PBKDF2-sha256 5637505 iterations per second for 256-bit key
PBKDF2-sha512 2118335 iterations per second for 256-bit key
PBKDF2-ripemd160 1115506 iterations per second for 256-bit key
PBKDF2-whirlpool 1006310 iterations per second for 256-bit key
argon2i 9 iterations, 1048576 memory, 4 parallel threads (CPUs)
for 256-bit key (requested 2000 ms time)
argon2id 9 iterations, 1048576 memory, 4 parallel threads (CPUs)
for 256-bit key (requested 2000 ms time)
# Algorithm | Key | Encryption | Decryption
aes-cbc 128b 1727.7 MiB/s 6931.8 MiB/s
serpent-cbc 128b 116.2 MiB/s 868.9 MiB/s
twofish-cbc 128b 252.9 MiB/s 566.7 MiB/s
aes-cbc 256b 1313.0 MiB/s 5684.8 MiB/s
serpent-cbc 256b 120.3 MiB/s 867.2 MiB/s
twofish-cbc 256b 257.5 MiB/s 563.5 MiB/s
aes-xts 256b 5342.5 MiB/s 5333.8 MiB/s
serpent-xts 256b 748.8 MiB/s 783.1 MiB/s
twofish-xts 256b 517.7 MiB/s 530.6 MiB/s
aes-xts 512b 4779.9 MiB/s 4819.2 MiB/s
serpent-xts 512b 756.1 MiB/s 779.9 MiB/s
twofish-xts 512b 521.5 MiB/s 529.2 MiB/s
```
- Is the warning responsible for this slow behavior: "No usable token is
available." Or can you suggest if I should tweak some key parameters or
change the order of keys in keyslots.
--
Thanks and Regards
Lamy