Re: LUKS decryption taking an unreasonably long time?

[Andrei Borzenkov]

25.09.2016 19:57, Aleksejs Popovs пишет:
> Hi,
> 
> Just installed GRUB on my new laptop and found the new cryptodisk
> feature. It seemed super convenient, so I enabled it, but what I noticed
> was that GRUB takes an unreasonably long time to actually decrypt the
> disk --- it takes approximately 10 seconds from the time I enter my
> passphrase until GRUB says "Slot 0 opened". For comparison, booting the
> system itself (which involves opening the slot again) takes less than a
> second.
> 
> Does anyone have any idea about why it is so slow and what I can do
> about it? I'd be happy to at least manage to profile it somehow, e.g. by
> enabling debugging output and looking at whether the slow part is the
> PBKDF, the key recovery, or something else, but I don't know how to
> enable debug mode, since this happens before grub.cfg can be read.
> 

You can set "debug" variable in embedded config using "grub-install
--debug-image=xxx" which results in "set debug=xxx" in embedded config.
Unfortunately I am not sure how exactly useful it will be in this case
because debug messages do not contain timestamps.

What you could do is to add calls to grub_boot_time() in crypto code
path. This records timestamps which can be displayed using boottime
command later. That could provide initial overview where time is spent.

Finally you can always build your own image using grub-mkimage and
define arbitrary embedded config.