I have installed GRUB2 to an encrypted boot partition, as detailed here.
The chosen hashing algorithm for my
luksFormat is sha512, with the default
iter-time (which is 2 seconds).
This encrypted partition takes a little over 2 seconds to unlock if done from the command line (either from archiso or from the running system), but GRUB takes 10.5 seconds, on average, to unlock it. This is slower than acceptable for my scenario.
1) The CPU might be running in power-saving mode during the early GRUB unlocking
2) GRUB might be using a hashing implementation which is much slower than the system. He did a benchmark which can be found here.
As encrypting the boot partition appears to be becoming more common, and there exists no satisfactory answer for this problem yet, I thought I'd ask about this. What can be done, apart from decreasing the iteration count (which substantially lowers security in an offline attack scenario), to counter this (much) slower decryption time by the GRUB bootloader?
I'd like to at least pinpoint the exact cause. Is there a way to check (and maybe alter) the CPU clock in the bootloader screen? I know GRUB has a shell; I opened it and tried
cat /proc/cpuinfo but it fails with "/proc not found" or something like that. I also tried
cpuid, and whilst it doesn't fail, it also returns nothing.
As additional information, I got these timings:
- GRUB takes 9 seconds or longer to unlock the boot partition (
/boot) after typing the password and pressing Enter.
- The Kernel appears to take about 7 seconds to unlock the root partition (
/). Again, this is timed after pressing Enter.
- The Kernel unlocks and mounts the boot partition (
crypttabin just over 2 seconds.
I tried SHA256 hashing and it took longer (13 seconds). This probably indicates that GRUB must be using 64bits, as can be deduced from here, https://security.stackexchange.com/a/40218/91904 and in frostschutz's answer.
Also tried SHA1 and it takes 11.5 seconds.
It doesn't seem to make a difference whether AES256 or AES512 is used
It also doesn't matter which filesystem is in use for the boot partition.