Upstream installer take full 1-2 minutes to decrypt

[azzamsa]

Hi,

I recently installed Debian using the default (upstream) installer, and I've noticed that the disk decryption process at boot takes a significant amount of time — around 1–2 minutes.

Based on this post it seems the issue might be due to the entire system — including /boot — being encrypted.

🙊 sudo lsblk
NAME                                          MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
sda                                             8:0    0 232.9G  0 disk
├─sda1                                          8:1    0   300M  0 part  /boot/efi
├─sda2                                          8:2    0 202.6G  0 part
│ └─luks-d080ce8d-...                         253:0    0 202.6G  0 crypt /
└─sda3                                          8:3    0    30G  0 part
  └─luks-dc88ad7a-...                         253:1    0    30G  0 crypt [SWAP]

For comparison, I’ve used full disk encryption with Fedora and EndeavourOS, and in both cases, the decryption process was significantly faster. Just a couple seconds.

Does this installer use a different volume layout that avoids this slow decryption issue?

Thanks in advance! 🧁

[r0b0]

I think the slow decryption is caused by grub. It is not really optimized for encryption algorithms and so takes a very long time to unlock the encrypted /root, read the kernel and initrd.

The opinionated installer completely bypasses the issue. The kernel and initrd (or UKI, which is the 2 combined) are stored unencrypted in the UEFI system partition. The UEFI firmware reads them, boots the linux kernel and the kernel is doing the LUKS decryption.

[azzamsa]

Yes, In Vanilla Debian, I am able to make the decryption faster using the command explained in Full Disk Encryption (FDE) with LUKS and GRUB: one way to speed it up · SpiralLinux · Discussion #497.

The opinionated installer completely bypasses the issue. The kernel and initrd (or UKI, which is the 2 combined) are stored unencrypted in the UEFI system partition. The UEFI firmware reads them, boots the linux kernel and the kernel is doing the LUKS decryption.

This is my first time trying TPM, and I’m honestly amazed. It only took about 23 seconds to reach the login screen from a cold boot. Awesome! It does take a bit longer for GNOME to fully load after login, but I think that’s just the decryption at work (?).

I don’t usually have issues with a normal setup, and I know my way around the nuts and bolts. But even after 12 years on Linux, I’ve never played around with TPM, so I just hope it doesn’t break or lock me out during a major upgrade. Worst case, a fresh install only costs me about an hour, even with slow internet, since I’ve got a post-install script that sets everything up.

By the way, huge thanks for ODIN! 🧁