pbkdf2 calculation during boot takes too long

[loveydovey]

FreeBSD 14.3 installation on an encrypted Geli. It's supposed to choose iterations for pbkdf2 based on your CPU - choose as many iterations as your CPU can do in two seconds. But on my install, it takes 6 seconds to do the number of iterations it chose when booting.

Is this a known thing? Do others get this properly set up during installation?

 

[SirDice]

What CPU does it have?

 

[loveydovey]

i7-4700MQ

 

[SirDice]

That should be a CPU with various AES, SSE, AVX2, etc instructions. Is crypto(4)/cryptodev(4) loaded? It should be part of the GENERIC kernel, but maybe you have a custom kernel without them?

GENERIC « conf « amd64 « sys - src - FreeBSD source tree

cgit.freebsd.org

 

[loveydovey]

Is crypto(4)/cryptodev(4) loaded?

cryptodev.ko is loaded.

 

[loveydovey]

It's ~1.6 mil iterations, as seen in geli dump

 

[Espionage724]

cryptodev.ko is loaded.

I'd check lscpu to make sure AES is enabled (there's usually a hidden BIOS option implying some regions might disable it or something)

 

[loveydovey]

I'd check lscpu to make sure AES is enabled (there's usually a hidden BIOS option implying some regions might disable it or something)

Per lscpu, aes is there.

I wonder if 2 seconds is calculated based on average CPU or max CPU but at boot it's at min CPU probably.