1

On a Raspberry Pi, in order to use a VeraCrypt encrypted container/partition, which solution offers the best performance between installing VeraCrypt or using cryptsetup (that seems to support it)?

Context: I have an USB3 external HDD, that will contain:

  • a VeryCrypt 1 TB container, hosted inside an exFAT (1) or NTFS partition (2), to be able to read the HDD with Windows in the future if needed

  • or a Veracypt 1 TB partition (3)

I'll benchmark (1), (2), (3) to see which one offers the highest read/write performance from RPi.

Improve this question

1 Answer 1

Reset to default
2

I've run a big number of tests today on a RaspberryPi4 2GB (with official PSU, and checked that no throttling happened; standard RaspiOS).

I used an external USB3 HDD, tested to be able to both read and write from the RPi4 faster than 70 MB/s for sequential 1 GB file, when using a normal (unencrypted) ext4 partition (just to be sure the disk itself is not the weakest element in the chain).

The following results are to be taken in relative value to compare the FS, not in absolute value.

I tested both:

  • the RAW write speed on an encrypted partition

    dd if=/dev/zero of=/mnt/b/1000mb bs=1M count=1000 iflag=fullblock

    (even if constant zero bytes, AES algorithm has to re-encrypt each block, in order for the repetition not be identifiable, see crypto.SE for questions about this, it's common)

  • the speed of transfer with Samba when sending a 2.3 GB file from a Windows computer to the RPi encrypted partition/container (again I checked that networking, destination computer's disk, etc. were not a bottleneck)

As I want the disk containing encrypted data to be also openable on Windows (let's say my wife needs it), without Linux command-line commands, I tested only exFAT and NTFS.

Results

host ↓       FS inside container →   exFAT                       NTFS
Veracrypt part.                      dd:41 MB/s  samba:!! MB/s   dd:28 MB/s  samba: 25 MB/s
exFAT part. + Veracrypt container    dd:39 MB/s  samba:!! MB/s   dd:25 MB/s  samba: 20 MB/s
NTFS part. + Veracrypt container     dd:29 MB/s  samba:!! MB/s   dd:25 MB/s  samba: 15 MB/s

!!: unresponsive Windows Explorer at the beginning of the transfer of 2.3 GB file, for about ~ 30 seconds, and then it begins but quite slow. This seems to be a bug when using fuse-exfat + samba + 1 GB+ file tranfer from Windows, even without using VeraCrypt. It is even amplified when there is an additional Veracrypt layer.

As a conclusion, the best option if we want the encrypted disk to be readable on Windows too, and to be able to use it via Samba, is to use a Veracrypt partition, containing a NTFS partition.

Note: when not using encryption, using this little "big_writes" trick helps to speed up NTFS writes from 30 MB/s to more than 70 MB/s:

sudo mount /dev/sda4 /mnt/a -o big_writes

But again, after the additional Veracrypt layer, we fall again to ~ 20-30 MB/s.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.