I'm a crypto-enthusiast but no expert at all, that'll explain why i didn't understand. Also please consider english isn't my native language :)

I am about to enable FileVault2 FDE on the new macbook of my users. I checked how it worked and my conclusions are :

user pw --> PBKDF2 --> DEK --> unwrap KEK --> unwrap VEK --> Unlock Boot Volume OR for corporations : X.509 digital identity --> DEK --> unwrap KEK --> unwrap VEK --> Unlock Boot Volume

Then user password is forwarded so that he has access to his Desktop. OR for corporations : I guess user types his password at the standard login.

I then saw there are 2 ways of recovering from a lost password (1st way personal and 2nd way for corporations, again) : The PRK (Personnal Recovery Key) and the IRK (Institutional Recovery Key).

On one hand, I saw that PRK is wrapped by another DEK, derived from the concatenation of the answers hash to 3 different secret questions. On the other hand, IRK seems to consist in a copy of the private key used to unwrap the original KEK wrapped by the X.509 public key. Actually, both the X.509 certificate (that also contains the public key) and the private keys are stored in FileVaultMaster.keychain. The private key is also wrapped by another DEK derived from a Master Password. So to access the private key, one must know the Master Password that unlocks the locked part of FileVaultMaster.keychain.

I learned all this theory from WP_Filevault2.pdf, the Apple Technical White Paper.

In another website (https://derflounder.wordpress.com/2014/08/13/filevault-2-institutional-recovery-keys-creation-deployment-and-use/) I learned that in a deployment like what I'm about to do, keeping the private key somewhere else (from the keychain) is a requirement. What I understand is that the IRK is actually THE one and only private key isn't it ???? Since it's not anymore in the keychain... How can it be called "recovery" then ?

The other part I don't understand is the relation between DEK, KEK and VEK and how it can impact PRK in a personnal use of FileVault2. For example PRK : Since FED crypto algorythms are mostly symmetric, the algorythms that create a key (which in turn locks a drive) are non-reversible. As a consequence, I assume the PRK can only be the original KEK (or the VEK) since it is not possible (not that I'm aware of) to have 2 different keys unlocking a drive (or this would be called a collision and is a problem for cryptographers) However, I learned that the PRK is generated randomly... So I assume it's never identical to the original KEK is it ???

And again, speaking about symmetry and non-reversibility, I red about the KEK that "This intermediate key allows for indirection to support the requirements mentioned earlier in the design approach. This indirection allows derived encryption keys (DEK) to be changed independently of each other and the VEK. It also allows the VEK to be changed independently of the DEKs.

How is this even possible ???

It's really frustrating not to beeing able to get the whole idea. So thanks a lot to help me go through the full understanding of this. It'd be really appreciated.


  • $\begingroup$ This is actually not really a question related to cryptography but rather to the protocol so I opt to migrate it. However, one general hint: What many systems do when a back-up key is provided is that they store more than one encryption of the secret key used to do the actual data encryption under different secret keys. So knowing one of these "key encryption keys" suffices to decrypt. Hence, one can be used by the user and one as recovery key. $\endgroup$ – mephisto Sep 7 '15 at 15:32
  • $\begingroup$ I'm voting to close this question as off-topic because it should be migrated to security.stackexchange.com as it is rather about a security protocol design than about the used crypto $\endgroup$ – mephisto Sep 7 '15 at 15:34
  • 2
    $\begingroup$ @mephisto: I think this question is on-topic here at crypto.SE. It could perhaps use some editing to clarify it, but the basic question is about crypto (key wrapping), even if it's at a fairly high abstraction level. $\endgroup$ – Ilmari Karonen Sep 7 '15 at 19:18
  • 1
    $\begingroup$ @mephisto I'd also say it's on-topic as it's about key management (of which escrow / recovery is a part of) and which I'd consider part of crypto as there are discussions about this in the reference: The Handbook of Applied Cryptography (see pp578). $\endgroup$ – SEJPM Sep 7 '15 at 20:03
  • $\begingroup$ @mephisto If the question were about usage of a specific cryptographic software (not its cryptographic internals), it would indeed have been off-topic (and Super User would be the right site)… but this actually handles its internals – and protocol design as well as analysis are on-topic according to the current state of our help-center. Therefore, I am leaving it as-is. $\endgroup$ – e-sushi Sep 7 '15 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.