I an trying to understand how FileVault (specifically the later version used in recent macOS releases, i.e. FileVault 2) stores and retrieves its encryption key.

This is prompted by two specific questions/observations:

  1. When you boot up a device with FileVault enabled, it goes to your login screen and shows your username, and a place to enter a password. When you do log in, it is extremely quick. This implies the disk already was decrypted. Assuming that the encryption key somehow was derived from your passphrase, this should be impossible, as you have not yet entered it.
  2. If you create an alternate OS install, e.g. another copy of the latest (Catalina) or a beta (Big Sur), in another APFS volume, you can encrypt it. Assuming you want similar convenient behaviour, the encryption key you provide should be related to whatever encryption key is used for your other volumes. Of course, it is possible that the read-only OS volume is not encrypted and only the read-write Data volume is encrypted, but that is not what appears in the various utilities.
  • Re #1, your login credential is stored outside the encryption. The device maintains a list of users that are allowed to unlock the volume. No idea why you think speed of acceptance of this credential means the volume is already unlocked. – Marc Wilson Oct 21 '20 at 19:22
  • Thanks @MarcWilson. Speed not because of acceptance, but because if you wait a minute or so and then login, many apps are up and running. It must have decrypted it prior to my entering the credentials. – deitch Oct 22 '20 at 7:03
  • So if it maintains a list of users allowed to unlock the volume, where is the secret for the volume? – deitch Oct 22 '20 at 7:03

You must log in to answer this question.

Browse other questions tagged .