Mac shutdown while decrypting mac os x#
Mac shutdown while decrypting pro#
Mac shutdown while decrypting software#
Mac shutdown while decrypting password#

Mac shutdown while decrypting password#

When FileVault is turned on, that adds the protection of the KEK, which is in turn protected by the user password and a hardware key. If a T2-equipped Mac is used with FileVault turned off, the contents of its internal storage are still encrypted, using a VEK protected by a hardware key, and an xART key (to prevent replay attacks).

Mac shutdown while decrypting pro#

The Mac Pro 2019 has replaceable internal SSDs, but following replacement new internal storage has to be initialised against that Mac’s T2 chip using Apple Configurator 2. All Macs with these SoCs, with the exception of the Mac Pro 2019, have internal storage which is soldered into place to make its removal challenging. This is enabled by the SoC acting as the storage controller for the internal SSD, so all data transferred between the main CPU/memory and internal storage passes through an encryption stage in the ARM processor of the SoC.

Mac shutdown while decrypting software#

The internal SSD in Macs with T2 chips, and all Apple Silicon Macs, doesn’t use software FileVault, instead relying on the hardware in the SoC for encryption and decryption.

As the file system on the volume is also encrypted, following unwrapping of the KEK and VEK, the next task to access a volume is to decrypt the file system B-tree using the VEK. A recovery key or the password is used to unwrap a key encryption key (KEK), which is in turn used to unwrap the volume encryption key (VEK), which is actually used for encryption/decryption. The key used to encrypt the volume contents isn’t exposed, but accessed via a series of wrappers, which enables the use of recovery keys if the user password is lost or forgotten. If your Intel Mac doesn’t have a T2 chip, this is probably the best integrated whole-volume encryption on offer for HFS+, and its successor for APFS volumes unlike HFS+, APFS was designed for software encryption from the outset. Software FileVault 2 is the volume encryption available in macOS for internal storage in Intel Macs without T2 chips, and on external storage of all models of Mac: even M1 Macs don’t offer hardware encryption on external storage. However, more modern Intel processors such as Intel Core i have instruction support, reducing the performance penalty to around 3%, which can still be noticeable at times, particularly on hard disks. Older Intel Core processors don’t have instructions to perform encryption-decryption, and using FileVault 2 with them imposes a significant performance penalty. The only users who can unlock an encrypted boot volume are those specifically enabled to do so, and once that boot volume has been unlocked, other users have unlimited access until that Mac is shut down. The user’s password is used as the passphrase for encryption using the XTS-AES mode of AES with a 256-bit key.

Mac shutdown while decrypting mac os x#

This was introduced in Mac OS X 10.7, and replaced FileVault 1 completely, with whole-volume software encryption which is far more secure. Jonathan Zdziarski’s classic article File Vault’s Dirty Little Secrets is an excellent account of some of those weaknesses. Even on old Macs, you shouldn’t assume that FileVault 1 provides any significant level of protection.

These caused problems with Time Machine backups, and were readily copied from the Mac, so became comparatively easy to crack. Instead of being stored normally as files and folders on a disk, they were kept in an encrypted sparsebundle. The first version of FileVault, known now as FileVault 1 or Legacy FileVault, was introduced in Mac OS X 10.3, but applied only to Home folders. There are several options which can prevent that. Even if your Mac is protected by a firmware password, all someone has to do is remove the disk and they can see and copy everything on it. Without encrypting the contents of a disk, it’s all too easy for anyone to access its contents.