On Fri, 21 Apr 2023 at 12:25:29 +0200, Guilhem Moulin wrote: > Bookworm (debian-bookworm-DI-rc1-amd64-netinst.iso + cryptsetup > 2:2.6.1-4~deb12u1, > graphical install), 1024M RAM: > > root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF > PBKDF: argon2id > Time cost: 10 > Memory: 223780 > Threads: 2 > root@debian:~# cryptsetup luksConvertKey /dev/vda5 <<<test > root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF > PBKDF: argon2id > Time cost: 8 > Memory: 490598 > Threads: 2 > > Bookworm (debian-bookworm-DI-rc1-amd64-netinst.iso + cryptsetup > 2:2.6.1-4~deb12u1, > text install), 1024M RAM: > > root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF > PBKDF: argon2id > Time cost: 8 > Memory: 294302 > Threads: 2 > root@debian:~# cryptsetup luksConvertKey /dev/vda5 <<<test > root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF > PBKDF: argon2id > Time cost: 8 > Memory: 490598 > Threads: 2 > > Bookworm (debian-bookworm-DI-rc1-amd64-netinst.iso + cryptsetup > 2:2.6.1-4~deb12u1, > text install), 2048M RAM: > > root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF > PBKDF: argon2id > Time cost: 4 > Memory: 590553 > Threads: 2 > root@debian:~# cryptsetup luksConvertKey /dev/vda5 <<<test > root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF > PBKDF: argon2id > Time cost: 4 > Memory: 1005926 > Threads: 2 > > Bookworm (debian-bookworm-DI-rc1-amd64-netinst.iso + cryptsetup > 2:2.6.1-4~deb12u1, > text install), 4096M RAM: > > root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF > PBKDF: argon2id > Time cost: 4 > Memory: 613826 > Threads: 2 > root@debian:~# cryptsetup luksConvertKey /dev/vda5 <<<test > root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF > PBKDF: argon2id > Time cost: 4 > Memory: 1048576 > Threads: 2 > > […] > * I was surprised to see the memory cost settle at ~550-600M on systems > with a decent amount of RAM in d-i. Would have expected to see 1G > here just like after running `cryptsetup luksConvertKey` in the > normal system.
libargon2-1-udeb bug filed at #1034696. For the sake of completion, here are
updated benchmark results after injecting src:argon2=0~20171227-0.3+deb12u1
(debdiff attached to the aforementioned bug) into the ISO:
Bookworm (debian-bookworm-DI-rc1-amd64-netinst.iso + cryptsetup
2:2.6.1-4~deb12u1
+ argon2 0~20171227-0.3+deb12u1, graphical install), 1024M RAM:
root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF
PBKDF: argon2id
Time cost: 19
Memory: 219508
Threads: 2
root@debian:~# cryptsetup luksConvertKey /dev/vda5 <<<test
root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF
PBKDF: argon2id
Time cost: 8
Memory: 490598
Threads: 2
## higher memory cost expected: graphical install without swap vs.
## minimal headless target system
Bookworm (debian-bookworm-DI-rc1-amd64-netinst.iso + cryptsetup
2:2.6.1-4~deb12u1
+ argon2 0~20171227-0.3+deb12u1, text install), 1024M RAM:
root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF
PBKDF: argon2id
Time cost: 14
Memory: 293158
Threads: 2
root@debian:~# cryptsetup luksConvertKey /dev/vda5 <<<test
root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF
PBKDF: argon2id
Time cost: 8
Memory: 490598
Threads: 2
## higher memory cost expected: install without swap vs. minimal
headless
## target system
Bookworm (debian-bookworm-DI-rc1-amd64-netinst.iso + cryptsetup
2:2.6.1-4~deb12u1
+ argon2 0~20171227-0.3+deb12u1, text install), 2048M RAM:
root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF
PBKDF: argon2id
Time cost: 5
Memory: 801560
Threads: 2
root@debian:~# cryptsetup luksConvertKey /dev/vda5 <<<test
root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF
PBKDF: argon2id
Time cost: 4
Memory: 1005926
Threads: 2
Bookworm (debian-bookworm-DI-rc1-amd64-netinst.iso + cryptsetup
2:2.6.1-4~deb12u1
+ argon2 0~20171227-0.3+deb12u1, text install), 4096M RAM:
root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF
PBKDF: argon2id
Time cost: 4
Memory: 1048576
Threads: 2
root@debian:~# cryptsetup luksConvertKey /dev/vda5 <<<test
root@debian:~# cryptsetup luksDump /dev/vda5 | grep -A3 PBKDF
PBKDF: argon2id
Time cost: 4
Memory: 1048576
Threads: 2
As one can see the benchmark results are now in line with expectations,
both in and outside d-i :-) (For the 2G case setting the memory cost to
1G would actually be viable, but it's a bit lower since the limit is
half the amount of available memory rather than “if there is more than
1G RAM available then set the max cost to 1G, otherwise set it to
$FREE_MEM/2”.)
--
Guilhem.
signature.asc
Description: PGP signature
