Long boot time when using Full Disk Encryption from standard install

Support
,
1

On a fresh install of manjaro (manjaro-kde-25.0.10-251013-linux612), I checked the option for “Encrypt System” because I plan on using this laptop for travel. This has resulted in the computer taking ~1.5 min to boot.

I understand that having the /boot partition encrypted can take longer because of grub, but ~1.5 min seems a bit high for a recent computer. Other forum posts suggest that full disk encryption should only increase boot time by ~15 sec, which sounds reasonable.

What kind of boot time should I expect for full disk encryption in 2025? Is there some additional configuration needed? Is using an unencrypted /boot still the only option to get a reasonable boot time?

The computer is a Samsung Galaxy Book 3 360 13", with 13th Gen Intel Core i7-1355U, 16GB ram and a Samsung 990 pro 4TB ssd (ssd firmware is up to date)

Output from systemd-analyze

$ systemd-analyze
Startup finished in 6.263s (firmware) + 1min 23.263s (loader) + 8.367s (kernel) + 5.104s (userspace) = 1min 42.998s 
graphical.target reached after 5.104s in userspace.

I checked that my key is in slot 0

$ sudo cryptsetup luksOpen --test-passphrase --verbose /dev/nvme0n1p2 
Enter passphrase for /dev/nvme0n1p2: 
Key slot 0 unlocked.
Command successful.

lsblk for reference. It’s the default layout from the installer

$ lsblk
NAME                                          MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINTS
nvme0n1                                       259:0    0  3.6T  0 disk  
├─nvme0n1p1                                   259:1    0  300M  0 part  /boot/efi
└─nvme0n1p2                                   259:2    0  3.6T  0 part  
  └─-fc7289e2-0895-465b-a497-62b 254:0    0  3.6T  0 crypt /home
                                                                        /var/cache
                                                                        /var/log
                                                                        /

Edit: Before someone asks for this:

$ sudo cryptsetup luksDump /dev/nvme0n1p2
LUKS header information for /dev/nvme0n1p2

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha256
Payload offset: 4096
MK bits:        512
MK digest:      ******** 
MK salt:        ******** 
MK iterations:  482769
UUID:           ********

Key Slot 0: ENABLED
        Iterations:             7724316
        Salt:                   ****** 
        Key material offset:    8
        AF stripes:             4000
Key Slot 1: ENABLED
        Iterations:             7825194
        Salt:                   ****** 
        Key material offset:    512
        AF stripes:             4000
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED
2

Yes - that is normal.

The Calamares installer uses luks1 because GRUB for many years had no support for luks2.

You can change this if you do not rely on grub for other things.

3

Thanks for clarifying

I ended up dropping the iterations down to 500000, which gave me a loader time of 22 seconds.

Much better than >1m loader time and closer to what I originally expected.

As much as grub is the bottle neck, I don’t want to put the work into figuring out how to remove it.

4

A while ago I wrote this guide → [How To] PoC dual-boot Manjaro LUKS / Windows BitLocker

5

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.