Apart from being able to encypt an entire volume, what are the other differences of FileVault 2 over FileVault?

Question

Does FileVault 2 in Lion have any other differences compared to the old version, FileVault in previous releases of the system? Are there any additional benefits to using the new version?

Answer 1

Borrowing heavily from John Siracusa's Lion review...

FileVault 2 is a Whole Disk Encryption system, as opposed to just a 'store your home folder in an encrypted disk image' solution. It's implemented as a filesystem layer below the actual volume that you unlock at system boot time. If you're familiar with LVM, it's much the same way. Whenever you get past the password lock, everything looks the same to the rest of the system.

As Steve mentioned, the encryption work can be aided by specialized processor instructions, and runs entirely in the background. What's nice is that you can turn disk encryption on a full drive, and everything will be done at leisure (you can shut it down, bring it back up, etc. and everything will continue).

Answer 2

Password less 'Guest' accounts can no longer be created since the whole disk is encrypted than just the User's home directory. It's sad that I could not find any information on the kb article in Apple about this.

Answer 3

The new Filevault seems to put far fewer constraints on you than the old version. You don't have to log out for time machine to work, for example, and all the sharing daemons appear to work fine (some of them were disabled when filefault was enabled if I recall correctly. I think web sharing was among them, which made my laptop a bit useless as a development platform for web applications :) ).

One problem with Filevault 2 is you can't ssh into a machine until you've entered a password locally, as the startup process can't commence until the encrypted drive has been unlocked.

Answer 4

• It supports AES-NI which offloads encrypting and decrypting on supported CPUs (some core i5's and i7's).
• You can store your encryption key with Apple.

I'm sure there are a few other. This Apple support article should answer the rest of your questions.

http://support.apple.com/kb/HT4790

Answer 5

One drawback I can see is that before you could encrypt individual user accounts, whereas now you can only encrypt the whole disk. If you encrypt the whole disk, you also have to decrypt the whole disk every time you use the computer. This means that once the computer is booted, the whole disk is accessible to malware, whereas before you could log in (and soon again out of) to security-critical accounts separately.

I suppose you can still use encrypted disk images on top of FileVault for really important data.

Another problem could be Time Machine. Whereas before the FileVault users' directories were also stored encrypted on the backup volume, that does not seem to be the case anymore.

Does anyone know if Time Machine now support whole-disk encryption as well (from the reports so far it seems to be not enabled for external drives, at least not via the GUI)?

Update: Apparently, Time Machine does not support whole-disk encryption: Can Time Machine volumes be easily encrypted with FileVault 2?

Answer 6

FileVault 2 LVG failures may be irreparable

From the manual page for fsck_cs:

The fsck_cs utility verifies and repairs CoreStorage logical volume group metadata.

...

BUGS

fsck_cs does not perform an exhaustive validation, nor is it able to fix many of the inconsistencies that it does detect.

Issues with FileVault 1

fsck_hfs (used by Disk Utility) has been developed for more than ten years and is capable of repairing most issues with JHFS+ as used by FileVault 1.

Should you encounter an issue that fsck_hfs can not repair, there are multiple alternative third party utilities.

Core Storage issues with FileVault 2

fsck_cs (also used by Disk Utility) first appeared along with CoreStorage in Mac OS X 10.7.0. Inconsistencies may be irreparable.

In the absence of alternatives to fsck_cs

If LVG failure occurs and fsck_cs can not make necessary repairs, then your startup volume will not mount. In this situation you may destructively reformat the disk and reinstall Mac OS X. (Using Recovery OS Time Machine alone will not provide the Apple_Boot Recovery HD that's required for FileVault 2.)

Answer 7

For multiple administrators: FileVault 2 alone is less secure than FileVault 1 

Similar to the answer offered by Thilo. This logic applies to any computer with two or more administrators.

FileVault 1 in Snow Leopard and in Lion

There is a good level of security to prevent a person without the master password from accessing any other person's data.

FileVault 2 alone

Any administrator can view, copy, edit all other users' data.

Example

Two business partners share a computer, both administrators. One of the two partners might like to keep something private. The partner who holds the master password, who wishes to keep something private, does not give that password to the other partner.

With FileVault 2 alone in such scenarios, security and privacy are easily ignored — sudo comes immediately to mind.

Comparison

ZFS encryption in Oracle Solaris, which can apply to users' home directories.

---

Workaround

If a user of FileVault 2 in the situation above requires the extra security, that person can:

1. add a separate disk, internal or external
2. on that disk, have a Core Storage encrypted logical volume (LV) with a Disk Password that differs from both (a) the Disk Password for the OS startup volume and (b) all user passwords for the startup volume
3. store their home directory on the LV on the separate disk
4. match the password for their user account to the Disk Password for the LV.

Alternatively, that person might use just a part of an existing disk … but partition management in and around coreStorage world is difficult, so for long-term simplicity: I would recommend investment in an additional/separate disk.

---

/var/folders

Expect some user data to be written to a subdirectory of /private/var/folders – all administrators will have access to this data. A solution for this is beyond the scope of this question.

Answer 8

FileVault 1 can be disabled for individuals

For any user who uses FileVault 1:

• System Preferences allow you to disable FileVault for that user alone, provided there is sufficient free space.

Enabled users of FileVault 2 can not be disabled

In Mac OS X 10.7 (Build 11A511) you can allow a user to unlock the startup volume, but once enabled:

• that user alone can not be disabled
• only FileVault 2 in its entirety can be disabled.

Lion: Disable FileVault Disk decryption by a particular user

Answer 9

Lion Recovery Disk Assistant lacks support for FileVault 2

Version 1.0 of the assistant used with FileVault 2 in Mac OS X 10.7 (Build 11A511) does produce a Recovery OS on a USB flash drive. However:

• the computer can not boot from that Recovery OS.

I found this problem with two different computers.

Answer 10

FileVault 1 impact on performance

In my experience, the impact is usually acceptable. I'd like to see relevant benchmarks.

Performance comparisons

In Ask Different: Speed of old Filevault vs. new Lion full disk encryption

• my answer there (work in progress) includes some technical data.

FileVault 2 impact on performance

Apple suggests:

FileVault 2 encrypts and decrypts your data on the fly with an imperceptible performance impact.

— page cached 2011-07-28.

AnandTech — Back to the Mac: OS X 10.7 Lion review: FileVault performance observes:

… Overall the hit on pure I/O performance is in the 20 - 30% range. It's noticeable but not big enough to outweigh the benefits of full disk encryption. …

I'd like the AnandTech reviewers to weigh things again more broadly, to include at least:

• FileVault 1 in lieu of FileVault 2.

More observations on CPU, kernel_task et cetera in Re: [Fed-Talk] Lion FileVault (2011-07-22) (highlights).

Answer 11

FileVault 2 prevents remote restart

Do not expect remote access to the EFI loginwindow.

Answer 12

Partition management in and around coreStorage world is difficult

For a disk that uses FileVault 2 — or any other application of Core Storage — it may be impossible to add or resize partitions using Disk Utility.

In Super User:

• an answer under How do I resize a FileVault 2 encrypted partition?
• an answer under Create new partition on encrypted volume in OS X Lion.

Expect Apple's diskutil(8) Mac OS X Manual Page to be updated for 10.7 in due course. In the meantime, if you already installed Lion, read the man page in Terminal.

Answer 13

Disabling FileVault 1 may worsen performance

Two reasonably-sized volumes (one a home directory), with a good set of B-trees, are probably easier for the system to manage — and almost certainly perform better — than a single colossal volume with attributes and catalog B-trees that are oversized and fragmented.

Explanation

FileVault 1 uses bands of a size that is optimised.

Depending on the content of a home directory, abandoning those bands in favour of a greater number of smaller files may significantly increase the sizes and fragmentation of the following critical areas of the startup volume:

• attributes B-tree
• catalog B-tree
• extents B-tree.

Enlarged B-trees can be unexpectedly problematic

What follows is debatably beyond the scope of the opening question, and relatively technical, but for any user of a computer with (a) limited memory and (b) a considerable number of files within and outside their home directory, it's worth thinking about before abandoning FileVault 1.

If the sum of the sizes of the B-trees is too great, and if repair is required, third party utilities on your computer may be unable to repair the damage.

If a volume is irreparable by fsck_hfs — most obviously using Disk Utility, less obviously whenever the system encounters a file system that is dirty — a user may turn to a respected third party utility.

Example

I encountered a situation where the sum of the sizes of the B-trees — in relation to the physical memory — was too great for a third party utility to work as required for a Core Storage encrypted backup volume that was irreparable by fsck_hfs. As my MacBookPro5,2 can take no more than 8 GB, so for some time this volume was read only.

I might have taken the volume, with or without the computer, to a service provider for attention in an environment with more memory. However for security, I should not provide to any third party — however well trusted — the passphrase or key for some types of volume.

Eventually and unexpectedly the fsck_hfs in Lion did repair the volume without me using Disk Utility, possibly thanks to me experimentally (riskily?) removing the volume from coreStorage world (reverting, completely converting backwards) whilst in the irreparable and read-ony state. That was a pleasing outcome for me, and a thumbs-up to Apple for the qualities and capabilities of 10.7 (Build 11A511), but this should serve as a caution to other readers.

Answer 14

Some installations can not use FileVault 2

Not all installations of Lion gain the hidden Apple_Boot Recovery HD that is required for FileVault 2 — OS X Lion: "Some features of Mac OS X Lion are not supported for the disk (volume name)" appears during installation (2011-07-21).

… You won't be able to use FileVault …

If this happens — and if you abandoned FileVault 1 before the upgrade to Lion — your Mac with Lion will be less secure.

The advice published by Macworld before the release of Lion continues to advise users to disable FileVault 1 before installing Lion. It's most unusual for Macworld to give advice that is contentious but in this case, I disagree strongly.

Answer 15

Lion makes FileVault 1 homes less easy to create

Easiest to create the FileVault 1 home in Snow Leopard before upgrading to Lion.

If without Snow Leopard: you can use Lion to create the home, but there are a few steps to the routine.

After disabling Filevault 1, is it possible to enable it again in Lion?

Answer 16

By combining FileVault 2 with FileVault 1, you can have double layer security. Note that this is will cause troubles with TimeMachine and sharing. Therefore, this double layer security is only advisable for an account where TimeMachine is turned off!

On my computer, I have an everyday work account, a FileVault 1 account (excluded from TimeMachine) and an administrator account. When I activated FileVault 2 from my everyday work account (using the administrator account's password), I expected FileVault 1 to disappear because Apple says at OS X Lion: About FileVault 2: «If you turn off Legacy FileVault, the Legacy FileVault tab will disappear and you can then choose to enable OS X Lion's FileVault 2».

When FileVault 2 was all set up, I was very surprised that my FileVault 1 continued having FileVault 1 encryption. So I had a double layer security: A legacy FileVault 1 account within a FileVault 2 computer. All I needed was a non-FileVault 1 account from where to turn on FileVault 2.

Eventually, I turned off FileVault 2 again. I like being able to access the OS X filesystem from the Bootcamp Windows system. With FileVault 2, that was no longer possible. I still keep the FileVault 1 account and it continues working fine, even in 10.8.1.