How is PRK generated/derived and what is being sent to Apple's servers if I choose "use this iCloud account to unlock and reset your password..." during FileVault setup? I wasn't able to find this in FileVault technical whitepaper. Is it just yet another DEK (Data Encryption Key)?
The personal recovery key is read from /dev/random and base32 encoded afterwards:
... When activating FileVault 2, the System Preferences application displays a randomly generated 120 bit password, encoded with base32, to the end user and advises them to securely store the password for recovery (see figure 2). The recovery password is read from /dev/random (through libcsfde and SecCreateRecoveryPassword() in Security.framework).