Data Encryption Impact on Boot Times#
On the first boot, after flashing, setting up the encrypted partition takes about 30 seconds. These steps are executed by nv_cpu_encrypt_run_once.service
systemd service. The setup involves:
Creating and encrypting VEK (Volume Encryption key) using PKCS#11 app. VEK is stored in /etc/nvidia/efs/
Decrypting VEK using PKCS#11 app.
Setup encrypted partition using dmsetup passing VEK and other information.
Initializing the encrypted partition with random data
Creating ext4 filesystem on encrypted partition
Copying the contents from /home to encrypted partition
Mounting the encrypted partition on /home directory
After the first boot, subsequent reboots do NOT have an impact on boot times.
These steps are executed by nv_cpu_encrypted_user_partition.service
systemd service Steps involved in subsequent boot for EFS are as follows:
Decrypting VEK using PKCS#11 app.
Mounting the encrypted partition on /home directory