How does FileVault generate a recovery key? From my user password? Does FileVault use the same key to decrypt disk on startup as recovery key? Are they identical?

I probably know the answers to this questions, but I want to be sure.

How does filevault 2 work?


3 Answers 3


The general principle used by FileVault is the same as for any encryption scheme which allows more than one password to access the data (such as LUKS, which is commonly used in Linux environments). To summarise:

  • A key called the MEK (media encryption key) is used to encrypt and decrypt the data.
  • A key called the KEK (key encryption key) is used to generate a ciphertext version of the MEK, which we'll call X. The value of X is stored alongside the data, e.g. in a filesystem header.
  • A series of passwords (such as your user password and a recovery password), e.g P₁ and P₂, are passed to a standardised key derivation function to generate corresponding encryption keys that are used to generate ciphertext versions of the KEK. Let's say that the ciphertext version of the KEK generated using P₁ is C₁, and likewise, P₂ yields C₂. The values C₁ and C₂ are stored alongside X.

Now, if you know one of the passwords, you can provide it to decrypt the data. For example, if you know P₂, you can decrypt C₂ to find out the KEK. Once you know the KEK, you can decrypt X to find out the MEK. Once you know the MEK, you can decrypt the data.

This scheme allows easy addition, removal, and alteration of passwords used to access the data, since this simply requires altering the set of stored Cᵢ values. No re-encrypting of the data itself is necessary, since the MEK being used doesn't change.

In LUKS, these places to store a Cᵢ value are called "keyslots", and LUKS provides eight such keyslots.

In APFS, all such Cᵢ values are stored together in a data block called a "keybag" — in principle, the size of this keybag is unbounded, but in current practice, it's typically large enough for 7 keys. When you set up authorised users and passwords in FileVault preferences, one of these slots is used to store a Cᵢ which can be decrypted using the recovery password that is displayed to you.

  • Why is there a KEK? Why isn't the MEK used as plaintext for the C values directly? Jan 28, 2020 at 20:46
  • @EagleV_Attnam, thinking about it now, I actually believe it's not needed, but I specifically had APFS on my mind when writing this. With APFS, encryption is done on a per volume basis, so the same KEK is used to encrypt multiple MEKs, one for each APFS volume; the standard refers to each such MEK as a VEK (volume encryption key). There may also be some cryptographic security argument about mitigating against chosen-ciphertext attacks or some such, but I can't be sure right now.
    – Jivan Pal
    Jan 28, 2020 at 21:46
  • I don't know LUKS very well on a technical level, so if anyone knows or can provide a source that says it does not use such a level of indirection, then I'd reason that it's probably not necessary in general from a security standpoint, so feel free to edit my answer. In any case, it is definitely necessary for APFS, given its per volume encryption.
    – Jivan Pal
    Jan 28, 2020 at 21:48
  • It was mainly the security value that I was wondering about, but your explanation on different volumes makes sense. I don't know anything about LUKS, so I can't help you with the details. Thanks! Jan 28, 2020 at 21:51

FileVault uses the user's login password as the encryption pass phrase. It uses the AES-XTS mode of AES with 128 bit blocks and a 256 bit key to encrypt the disk, as recommended by NIST.[12][13] Only unlock-enabled users can start or unlock the drive. Once unlocked, other users may also use the computer until it is shut down.[3]


Master passwords and recovery keys

When FileVault 2 is enabled while the system is running, the system creates and displays a recovery key for the computer, and optionally offers the user to store the key with Apple. The 120 bit recovery key is encoded with all letters and numbers 1 through 9, and read from /dev/random, and therefore relies on the security of the PRNG used in macOS. During a cryptanalysis in 2012, this mechanism was found safe.[15]

Changing the recovery key is not possible without re-encrypting the File Vault volume.[3]




All the answers you've needed. It's a full explanation of work. ☝🏻☝🏻☝🏻

I found the link on this site: https://www.lightbluetouchpaper.org/2012/08/06/analysis-of-filevault-2-apples-full-disk-encryption/

My explanation (Maybe something is wrong in it, but the hole idea is understandable):

  • You turn on FileVault.
  • macOS provides a Recovery Key.
  • macOS takes your login password and somehow creates an "encryption key". (Presumably it takes your login password, "salts" it, runs it through some fancy algorithm, and produces a hashed value which serves as your "encryption key".)
  • macOS uses this "encryption key" to encrypt your entire hard-drive.
  • macOS also stores this "encryption key" somewhere on your hard-drive.

  • Later on when you start up your Mac, and log in, macOS takes your login password, runs it through the same process it used earlier (e.g. salting + some algorithm) and creates a hashed value.

  • macOS then compares this hashed value against the stored "encryption key" on your hard-drive.
  • If the hashed value matches yours "encyption key" then macOS unlocks (i.e. decrypts) your hard-drive.
  • If the hashed value doesn't match, then you cannot access your hard-drive or the data on it.

MAYBE FileVault 2 is not storing encryption key on a hard drive it self. Probably FileVault is destroying the key after successful encryption. And then when you ask for access, it takes your password (which you typed as pass to system), runs through algorithms, salting and hashing it. And THEN FileVault trying to access hard drive using this key, recently generated from your password. Basically, if you type the right login password which was used for generating encryption key - the system will get the exact same key and will get access to hard drive data.



You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .