Data Encryption Impact on Boot Times

On the first boot, after flashing, setting up the encrypted partition takes about 30 seconds. These steps are executed by nv_cpu_encrypt_run_once.service systemd service. The setup involves:

  • Creating and encrypting VEK (Volume Encryption key) using PKCS#11 app. VEK is stored in /etc/nvidia/efs/
  • Decrypting VEK using PKCS#11 app.
  • Setup encrypted partition using dmsetup passing VEK and other information.
  • Initializing the encrypted partition with random data
  • Creating ext4 filesystem on encrypted partition
  • Copying the contents from /home to encrypted partition
  • Mounting the encrypted partition on /home directory

After the first boot, subsequent reboots do NOT have an impact on boot times.

These steps are executed by nv_cpu_encrypted_user_partition.service systemd service Steps involved in subsequent boot for EFS are as follows:

  • Decrypting VEK using PKCS#11 app.
  • Mounting the encrypted partition on /home directory