Luks: (1) choosing iter-time (2) setting iter-time in installer

I did an openSUSE Tumbleweed installation with this partitioning scheme:

(1) unencrypted /boot/efi partition (fat32)
(2) encrypted LVM, which contains:
(2.1) swap
(2.2) home (btrfs)
(2.3) root (btrfs)

It works fine, except that the LVM decryption was taking around 30 seconds. That prompted me to google around, which led me to find out about “iteration time” on the LUKS passphrase, which I had never heard of before. I changed the iteration time a few times before settling on 500 milliseconds, which leads the LVM decryption to take 7 seconds.

my questions:
(a) Did I do my partitioning sensibly? (In other words, there’s no way to encrypt /boot/efi, right?) Is there a “full disk encryption” tool that would be better than what I did?
(b) Is my 500 millisecond iter-time sufficiently secure? What would you say is your “minimum” for iter-time for sufficient security? If it matters, my passphrase is 10 chars.
(c) For future reference, is the iter-time selection somewhere in the GUI installer (Yast Partitioner)? If so, I must have missed/ignored it.

Thank you, in advance, for your help!

You are right, that there is no way to encrypt the EFI partition.

I have used a similar encryption setup, except that I went with the defaults (I did not set a shorter iteration time).

Until recently, it was necessary to enter the passphrase twice – once for grub and once for the kernel. It is the decryption by grub that can be slow. It depends on the speed of your BIOS (or UEFI firmware).

I don’t have answers for your other questions.