How is PRK generated/derived and what is being sent to Apple's servers if I choose "use this iCloud account to unlock and reset your password..." during FileVault setup? I wasn't able to find this in FileVault technical whitepaper. Is it just yet another DEK (Data Encryption Key)?

  • What does DEK stand for? Data or Derived Encryption Key? – klanomath Jul 26 '17 at 18:28

The personal recovery key is read from /dev/random and base32 encoded afterwards:

... When activating FileVault 2, the System Preferences application displays a randomly generated 120 bit password, encoded with base32, to the end user and advises them to securely store the password for recovery (see figure 2). The recovery password is read from /dev/random (through libcsfde and SecCreateRecoveryPassword() in Security.framework).

Source: Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption, page 9

  • What relations does it have with other keys? Is it just a randomly generated DEK? – assp1r1n3 Jul 26 '17 at 18:15
  • It depends how you expand DEK! This can be seen in page 8, figure 8. It's one of several possible "keys" for key derivation. It's no DataEK but a DerivedEK. – klanomath Jul 26 '17 at 18:27
  • That's the only thing sent to Apple's servers, right? – assp1r1n3 Jul 26 '17 at 18:31
  • @assp1r1n3 I never checked the content of the IP-packets but I assume it's the only thing sent to iCloud but encrypted again (probably with some temp key). – klanomath Jul 26 '17 at 18:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .