1

As far as I'm aware, on iOS when you click the power button 5 times, you effectively nuke the encryption key used to protect the device (which is ultimately derived from your passcode). With regular use, FaceID keeps the key wrapped between unlocks, and thus requiring your passcode is a sign your device needs to derive the key.

On macOS is there anything similar? Reading about the Data classes and FileVault support docs, it looks like macOS FileVault only supports NSFileProtectionCompleteUntilFirstUserAuthentication, i.e. it's only safe when shutdown after initial login.

How can I nuke the derived macOS encryption key without shutting it down. i.e. wipe the FV encryption key on closing the lid.

Do I have this right? If so, that's not great.

Improve this question

1 Answer 1

Reset to default
2

Yes, there's something somewhat similar on macOS.

On older versions of macOS, you could make sure that the FileVault encryption key was removed from memory when closing the lid by enabling two features via the Terminal:

sudo pmset hibernatemode 25
sudo pmset destroyfvkeyonstandby 1

This would mean that when you close the lid, the system hibernates (i.e. everything in memory is written out to disk), and the FileVault encryption key is destroyed. Effectively this means that when you open the lid again, you would have to enter your password to unlock the FileVault encryption again.

If you choose to go this route, you probably also want to disable PowerNap and otherwise ensure that the system doesn't wake up while in standby mode. If it does, the missing FileVault key would mean that the system cannot run:

sudo pmset -a powernap 0
sudo pmset -a standby 0
sudo pmset -a standbydelay 0
sudo pmset -a autopoweroff 0

On modern systems with APFS and T1/T2 there's already protections in place regarding systems in sleep not having the encryption key in main memory.

Note that even old systems without T1/T2 automatically disable DMA when the laptop is in sleep mode.

Improve this answer
2
  • excellent thank you... I wonder why Apple has tighter controls on iOS. I mean it's the same Darwin core as macOS. Why not use the same principal, where by you nuke the disk key on sleep? - is it simply to ensure things like PowerNap work? iOS has background app refresh and that still works?
    – Woodstock
    Commented Dec 28, 2022 at 13:51
  • Can you cite a source for "On modern systems with APFS and T1/T2 there's already protections in place regarding systems in sleep not having the encryption key in main memory."? I don't disbelieve you, I'd just love to read the source documentation on that feature.
    – Harv
    Commented Dec 17, 2023 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .