vendor: move to snapshot-4c814e1 branch and set fixed KDF options #10591
Conversation
This commit moves our secboot code to the `snapshot-4c814e1` branch that contains fixes around the KDF benchmarking. This will improve the install performance.
|
Looks like we need to adapt our code, too. Let me know if you are busy and would like me to do it. |
mvo5
changed the title
| @@ -53,6 +53,10 @@ func (s *encryptSuite) TestFormatEncryptedDevice(c *C) { | |||
| c.Assert(opts, DeepEquals, &sb.InitializeLUKS2ContainerOptions{ | |||
| MetadataKiBSize: 2048, | |||
| KeyslotsAreaKiBSize: 2560, | |||
| KDFOptions: &sb.KDFOptions{ | |||
| MemoryKiB: 32768, TargetDuration: 0, | |||
| ForceIterations: 4, Parallel: 0, | |||
There was a problem hiding this comment.
from the cryptsetup docs is not super clear if Parallel must be set as well when setting ForceIterations or not. I suppose we need to test the effect of this
There was a problem hiding this comment.
It doesn't need to be set - it defaults to the maximum (4) if it's unset. In all cases, it's then adjusted down if there are fewer CPUs. The only requirement is that you can't try to set it to zero.
There was a problem hiding this comment.
Only for context:
which probably translates to 4 or 1 in real world I'd imagine. Apart of intel there are not many under 4 cores devices. On arm we either see 4+ or 1 in very low power devices.
| @@ -53,6 +53,10 @@ func (s *encryptSuite) TestFormatEncryptedDevice(c *C) { | |||
| c.Assert(opts, DeepEquals, &sb.InitializeLUKS2ContainerOptions{ | |||
| MetadataKiBSize: 2048, | |||
| KeyslotsAreaKiBSize: 2560, | |||
| KDFOptions: &sb.KDFOptions{ | |||
| MemoryKiB: 32768, TargetDuration: 0, | |||
| ForceIterations: 4, Parallel: 0, | |||
There was a problem hiding this comment.
Only for context:
which probably translates to 4 or 1 in real world I'd imagine. Apart of intel there are not many under 4 cores devices. On arm we either see 4+ or 1 in very low power devices.
This commit moves our secboot code to the
snapshot-4c814e1branchthat contains fixes around the KDF benchmarking. This will improve
the install performance.