I an trying to understand how FileVault (specifically the later version used in recent macOS releases, i.e. FileVault 2) stores and retrieves its encryption key.
This is prompted by two specific questions/observations:
- When you boot up a device with FileVault enabled, it goes to your login screen and shows your username, and a place to enter a password. When you do log in, it is extremely quick. This implies the disk already was decrypted. Assuming that the encryption key somehow was derived from your passphrase, this should be impossible, as you have not yet entered it.
- If you create an alternate OS install, e.g. another copy of the latest (Catalina) or a beta (Big Sur), in another APFS volume, you can encrypt it. Assuming you want similar convenient behaviour, the encryption key you provide should be related to whatever encryption key is used for your other volumes. Of course, it is possible that the read-only OS volume is not encrypted and only the read-write Data volume is encrypted, but that is not what appears in the various utilities.