Many discussions of FileVault 2 security suggest using:

sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25

Some of those discussion state that FileVault keys are stored in RAM during normal awake use whereas others say that they are stored in EFI firmware.

  1. Where are the keys stored while the machine is awake and running- in RAM or in firmware?

  2. What, precisely, does destroyfvkeyonstandby do? For example, if I delete a file I can recover it because it is not wiped. Does destroyfvkeyonstandby perform a memory release (delete) or a wipe (overwriting the memory that was being used to hold the key)?

  3. If I use destroyfvkeyonstandby, what benefit is there to going into hibernation mode immediately (other than saving energy)? If the key has been wiped, what danger is there in leaving the RAM powered on?

  1. During normal use, the keys are stored in RAM, which makes them vulnerable to a DMA attack over Firewire or Thunderbolt (using something like Inception). This is an old set of attacks, and Apple does actually disable some of the functionality of those devices during some sleep modes (e.g., hibernatemode 25 which removes power from the RAM after dumping its contents to disk; for added security, you should also disable Fast User Switching, as it's another attack vector.)

  2. That is the only thing that makes sense for Apple to do, since it's pretty trivial. More details might be culled from this analysis of FileVault 2, courtesy of a few security researchers from Cambridge.

  3. RAM can also be written to (see Inception) in order to bypass the actual password; dumping to disk and reloading on wake will ensure the contents is tamper-proof.

  • Thank you for the answer and links! Those, and additional reading, suggests that in addition to an inception-type attack on a system where information is still in RAM, the passphrase that unlocked the filevault key may also be available in RAM. Hence even if one destroys the filevault key via "destroyfvkeyonstandby 1", the passphrase to unlock that key may still be readily available in RAM if the RAM is still powered. By using "hibernatemode 25" and thereby cutting power to RAM, all other passphrases in RAM will also be removed. – Michael Dec 7 '12 at 1:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .