The official disk encryption guide seems a bit lacking (detailed list of concrete improvement suggestions!)

[Ellie <el%horse64.org@localhost>]

Dear NetBSD folks,

I just thought I'd document the sort of things here I would have 
expected to find in the official NetBSD disk encryption guide:

 https://www.netbsd.org/docs/guide/en/chap-cgd.html

Please note I'm new to NetBSD. In anticipation of my switch however, and 
as a previously Linux user, I have tried my best to read multiple 
NetBSD encryption guides and to read up on the filesystem choices, and 
perhaps can suggest what a newcomer might miss.

Perhaps this will inspire somebody who knows how to fill in the gaps:



## 1st thing I missed, outgoing links to the partitioning stuff:

The disk preparation involves scrubbing the disk: 
https://www.netbsd.org/docs/guide/en/chap-cgd.html#chap-cgd-example-prepare

But it doesn't seem to involve any website link to the partition setup. 
(I'm sure it's covered somewhere else, but the text merely mentions it 
but doesn't link it!) For example, the actual command to create a fresh 
GPT table.


## 2nd thing I missed, GPT UEFI install and multiple partitions:

The disk preparation part also seems to not cover the disk encryption 
scenario where everything other than a boot partition, apparently often 
mounted to /etc/cgd/ later on, is meant to be encrypted.

In that case, I assume the typical more future-proof setup would involve 
three partitions: system partition, EFI, and boot. Since apparently some 
mainboards can't even boot GPT BIOS legacy mode anymore.

I found a guide for a similar setup here: 
https://www.unitedbsd.com/d/449-disk-encryption-netbsd/12 Perhaps that 
could be an inspiration?



## 3rd thing I missed, more in-depth crypto parameter discussion:

The disk guide also suggests AES-CBC 256 instead of AES-XTS 512. That 
seems a little outdated.

At the risk of making this part even more outdated in the future, it 
would also help if it had some suggestions for the iterations tested on 
some average office PC made in 2026. like for example suggesting 3-4 
possible iteration values and what ballpark of time one would wait.

Or perhaps there could be a separate small tool that just tests out how 
many iterations the current hardware can do in X seconds, and prints it?



## 4th thing I missed, applying more filesystem choices:

From what I can tell, the system partition will always be UFS2 if one 
follows this guide, as far as I can tell. On a modern relatively fast 
workstation, I would assume many users will want content checksums for 
bit rot protection (which so far apparently requires ZFS, or I guess 
perhaps at some point GeFS that seems to currently be making its ways 
into the *BSD world as a leaner alternative).

I don't know many people who bother with RAID, typically they seem to 
just setup backup scripts, but most of the time these backup scripts 
aren't bit rot protected.



## 5th thing I missed, fast track for encrypted default install:

Some sort of shortcut command for this entire process!

I expected the top of the guide to say "if you just want to nuke an 
entire disk of your choice and do a standard disk encryption setup with 
new partitions, specify the disk as a parameter for this script"...

...and then to have some sort of 
make_standard_encryption_partition_setup.sh one liner, which prompts for 
the unlock password and has command line parameters for:

i. AES-CBC/AES-XTS,

ii. AES key size,

iii. key iterations and/or seconds of key unlock time to approximately 
target with automatically determined key iterations value,

iv. filesystem choice which should perhaps include UFS2 and ZFS,

v. amount of megabytes of empty space at the end since some SSDs seem to 
perform a lot better if some space is left unpartitioned,

vi. GPT BIOS boot or GPT EFI boot,

vii. amount of megabytes of boot partition, since in some cases it can 
be useful to have it be larger and future proof on a very large disk.

I know that experts won't find this configurability sufficient, but for 
a beginner who just wants a relatively standard encrypted workstation 
setup for modern hardware, this would save so much time.

Or perhaps this could even be added as an option to the installer?

Perhaps after the "Available disks" menu after picking a disk, and after 
the "The disk seems not to have been partition before" menu (if 
applicable), as an option of the "What would you like to do?" 
partitioning menu:

Suggested option name: "Delete everything and install with default 
layout (encrypted or plain)"

Suggested prompt right after: "Do you want to proceed to delete 
everything, and setting up a default install? You will be asked about 
some preferences first before the setup is applied. (Y/n)"

Suggested prompt right after: options for all the 7 points above for a 
fast-track script.

Suggested prompt right after: "Proceed with chosen options and deletion 
of all data to write recommended partition layout to disk? (y/N)"

Sorry if this seems nonsensical. I'm sure there are better ideas.

I just wanted to give an actionable idea which doesn't go as far as 
requiring the manual partition editor to fully support encryption. 
(Which I assume would be more difficult to implement.)


## 6th thing I missed, upgrade concerns:

Notes on potential upgrade concerns would be nice. This seems like it 
would be relevant especially if the case of an encrypted system disk 
partition is ever included.

A separate boot partition seems to involve copying the kernel and such 
to the /etc/cgd/ partition and it's not clear to me what this means if I 
install system updates or I upgrade between major NetBSD versions.

Will I then need to copy it again or would that automatically be taken 
into account? Etc.



## Conclusion

I hope some of these points help somebody to give the disk encryption 
guide a bit of an overhaul, or with even adding a convenience installer 
option to handle it all. My apologies if this write-up isn't helpful!


Regards,

Ellie