Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For security concerns, I wonder how it would be possible for an OS X upgrade (e.g. from Mavericks to El Capitan), to reboot my Mac multiple times without asking me for my FileVault 2 password?

I mean, the whole drive is encrypted and even an OS X installer would not know the password after a reboot. In spite of that, it reboots one or more times without asking me for my password.

Therefore I suspect that Apple stores my password somewhere, either on disk, in NVRAM, or online, at least during the upgrade process. If so, wouldn't this be a serious security concern?

Can anyone shed a bit of light on this? How does it work?

share|improve this question
3  
As an aside, OS X accidentally logged the password in plaintext to disk during a 10.7.3 upgrade: 9to5mac.com/2012/05/07/… ! It has since been fixed, of course. – Sedate Alien Feb 1 at 3:49
up vote 33 down vote accepted

There's an OS X feature called authenticated restart that stores the FileVault key in the SMC for the duration of the reboot. Apple acknowledges in the manpage that it does reduce FileVault security for the duration of the restart:

On supported hardware, fdesetup allows restart of a FileVault-enabled system without requiring unlock during the subsequent boot using the authrestart command.

WARNING: FileVault protections are reduced during authenticated restarts.

In particular, fdesetup deliberately stores at least one additional copy of a permanent FDE (full disk encryption) unlock key in both system memory and (on supported systems) the System Management Controller (SMC). fdesetup must be run as root and itself prompts for a password to unlock the FileVault root volume. Use pmset destroyfvkeyonstandby to prevent saving the key across standby modes. Once authrestart is authenticated, it launches reboot(8) and, upon successful unlock, the unlock key will be removed.

share|improve this answer
1  
Thanks. Perfectly answers my question and reduces my concerns to the question whether erasure from SMC is actually complete and safe. – Anders Jan 31 at 20:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.