3

I have a Raspberry Pi4 (4GB) with a 250GB SSD connected via USB3. The SSD has a write speed of about 70MB/s, which is very nice. The SSD is mounted via fstab and the following settings:

LABEL=DATA /media/extStorage   exfat-fuse nofail,auto,sync,gid=www-data,rw,umask=007 0 0

But I have a VeraCrypt encrypted file container which is about 95% of the SSD volume size. When I mount the container with the command

sudo -u root veracrypt /media/extStorage/data.hc /mnt/data/ --pim=230 -k "" --protect-hidden=no --fs-options "gid=www-data,umask=007"

the write speed is only about 3MB/s, which is 1/18th of the originally speed... When mounted and while writing the process "/sbin/mount.exfat-fuse /dev/sda1 ..." has a very high CPU usage: CPU usage while mounted and write operation

The command lsof for /media/extStorage shows that only VeraCrypt is accessing.

As far as I understand VeraCrypt, the CPU load should not be that high after mounting... I also tried using a much lower PIM, which was only faster when mounting.

So do I do somthing wrong when mounting the drive or the encrypted container (e.g. wrong or mising commands)? What could cause that kind of problems?

Thank you in advance for your answers.

EDIT: Just to mention: I downloaded the source code of VeraCrypt and compiled it myself on my Raspberry, if that could include an error...

I found that may the lack of a hardware AES module could be the problem... so the Raspberry have to use software AES which is CPU intense and therefore slower... I don't know how to solve this problem, because the RPi does not seem to have that module on the chip... (https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=207888&p=1568740&hilit=aes#p1568740) I never had that kind of problems before, because my Notebook and my Tablet support hardware AES. Maybe another encryption software (like dm-crypt) is more convenient?

EDIT2: This problem was solved by using EXT4 formatting instead of exfat. See my first comment under the first answer.

Improve this question
11
  • 2
    I can't read the text on the picture. Please don't use pictures of text. Instead paste the text direct into the question.
    – Ingo
    Nov 21, 2019 at 10:54
  • It says that the PID 274 with the user root uses 100% of a single CPU core with the command "/sbin/mount.exfat-fuse /dev/sda1 /media/data -o rw,sync,gid=33,umask=007".
    – Florian
    Nov 22, 2019 at 7:36
  • @Florian Your post refers to /media/storage, your comment says /media/data and the screenshot states /media/extStorage. Are you sure you have mounted the right file?
    – Dmitry Grigoryev
    Nov 22, 2019 at 8:46
  • 1
    Yes the paths are absolutely right. I am sorry for the confusion. To clearify: /media/extStorage is the mountpoint for the USB drive, /mnt/data is the mountpoint for VeraCrypt. I changed the OP...
    – Florian
    Nov 22, 2019 at 9:33
  • Can you run the benchmark of the encryption algorithm you're using and add the number to your post?
    – Dmitry Grigoryev
    Nov 22, 2019 at 10:10

1 Answer 1

Reset to default
3

I just have tried to write to an encrypted volume: TrueCrypt, AES encryption, the container is a partition on a USB3 drive, encrypted drive formatted as EXT4. I see a data rates between 45 and 52 MB/s (according to my file manager), with CPU load hovering around 65%: about 30% used by TrueCrypt and another 30% used by USB XHCI driver.

My TrueCrypt encryption benchmark (with 50MB RAM buffers) reports 121 MB/s encryption speed and 117 MB/s decryption speed for AES. As in your case, AES hardware support is N/A.

My advice would be that you try different encryption algorithms, e.g. Twofish. Perhaps AES encryption implemented in VeraCrypt performs poorly on RPi hardware. Or try a different encryption software.

PS. I assume that your RPi 4 is not throttled due to overheat or low power supply voltage. For instance, if I power my RPi by 4.8V instead of 5, the data rate drops from 52 MB/s to 12.

Improve this answer
5
  • 1
    Thank you very much for your effort! The voltage topic seems to be very relevant for me, I measured down to 4.7V when the CPU is on full run. I consider to buy a new power supply... I also had success with different mount options: now I use the following options to mount my ext4 formatted drive: LABEL=EXTSTORAGE /media/extStorage ext4 nofail,defaults 0 0 and my VC mount options are veracrypt /media/extStorage/data.hc /mnt/data/ -k "" --protect-hidden=no -> now I have 45MB/s write speed which is very nice!
    – Florian
    Nov 24, 2019 at 13:10
  • @Florian So, you have changed the format of the disc containing the encrypted container file from exFAT to EXT4? I would expect some performance improvement, but not 15-fold. I also have exFAT SD cards, and the RPi 4 writes them as fast as the card can go (which is around 25-30 MB/s)
    – Dmitry Grigoryev
    Nov 24, 2019 at 16:05
  • Yes I changed that and the mount options of the USB drive itself (removed "auto,sync,gid=www-data,rw,umask=007" while mounting and replaced it with "default"). Only that doubled or trippled the write speed! And the removed mount-permissions (command "--fs-options") from VC did the rest. I did add these permissions because exFAT doesn't support permissions so I had to do a Workaround which seems to need a lot of CPU power I guess... Now I am losing about 20-25% of the write speed because of encryption and while writing the CPU load is about 50%. So that's good enough for my applications.
    – Florian
    Nov 25, 2019 at 10:04
  • @Florian Now that you mentioned it, I see you have used sync. This is a known performance killer in Linux and there are very few reasons to use it. If you want to make sure you don't lose any data, use a journal (that has a performance penality too, but not as bad as sync).
    – Dmitry Grigoryev
    Nov 25, 2019 at 10:28
  • 1
    Oh I didn't know that and I don't even know why I used that option. But now it's working fine so I will use the default options...
    – Florian
    Nov 26, 2019 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.