OS X Recovery Keys

[Cubic Earth]

I know this is a little bit off topic -

Does anyone know how make os x display the recovery key (really just the direct encryption key) for an encrypted drive?  I've been going though a process of doubling down on all of my security procedures.  One result is going to be a bunch of encrypted drives, and I will be greater risk of data loss if all else stays the same.

First I would like to make os x show me in - plain text - each of the keys.  Then would like to have a way to test out each of those keys and prove to myself they are capable of decrypting the drive.

Does anyone know some terminal commands that would work?  Google is not being my friend.

Thanks

[empoweoqwj]

I know this is a little bit off topic -

Does anyone know how make os x display the recovery key (really just the direct encryption key) for an encrypted drive?  I've been going though a process of doubling down on all of my security procedures.  One result is going to be a bunch of encrypted drives, and I will be greater risk of data loss if all else stays the same.

First I would like to make os x show me in - plain text - each of the keys.  Then would like to have a way to test out each of those keys and prove to myself they are capable of decrypting the drive.

Does anyone know some terminal commands that would work?  Google is not being my friend.

Thanks

Wouldn't be very secure if it just showed the keys in plain text would it ....

[Cubic Earth]

It's a fundamental security weakness that us humans can only read plain text.  I would only be revealing it to myself in a secure environment.  Anyway, I've found some of what I was looking for.

Here is the option, as part of the "fdesetup" command.

 -outputplist
             Outputs the recovery key and additional system information to stdout in a plist dictionary.  If
             the recovery key changes, a Change key will be set and the EnableDate will contain the date of
             the change.   This should not be used when using the deferred mode.

Now my next question: where would that plist directory reside?

[empoweoqwj]

It's a fundamental security weakness that us humans can only read plain text.  I would only be revealing it to myself in a secure environment.  Anyway, I've found some of what I was looking for.

Here is the option, as part of the "fdesetup" command.

 -outputplist
             Outputs the recovery key and additional system information to stdout in a plist dictionary.  If
             the recovery key changes, a Change key will be set and the EnableDate will contain the date of
             the change.   This should not be used when using the deferred mode.

Now my next question: where would that plist directory reside?

I really meant if you can see the keys, what's to stop someone stealing your Mac and grabbing them all?

[Trizin]

http://support.apple.com/kb/ht5077

[stimpi]

It may be easier to disable filevault and then re-enable it. Once re-encrpyted, the master (backup) recovery key pops up in an alert box, which you can take a note of.

[empoweoqwj]

http://support.apple.com/kb/ht5077

I wish people would just post a quick answer, rather than a link which may or may not be useful.

[bitpop]

Glad my bitlocker does just that. You guys don't get a recovery key??

[michagogo]

I really meant if you can see the keys, what's to stop someone stealing your Mac and grabbing them all?

If someone steals your Mac and it's powered on and unlocked, then you've already lost all your data. If it's not, then those keys won't be accessible without first booting up, which requires the passphrase to decrypt the key.

[Cubic Earth]

+1 to the above.

Glad my bitlocker does just that. You guys don't get a recovery key??

When you encrypt the boot drive with filevault, you are provided with a recovery key.  I wrote mine down.  As far as other encrypted volumes go, including time machine backups, you are not provided with a recovery key as far as I can tell.

I really meant if you can see the keys, what's to stop someone stealing your Mac and grabbing them all?

You need to enter you credentials before the key(s) was displayed.

[empoweoqwj]

+1 to the above.

Glad my bitlocker does just that. You guys don't get a recovery key??

When you encrypt the boot drive with filevault, you are provided with a recovery key.  I wrote mine down.  As far as other encrypted volumes go, including time machine backups, you are not provided with a recovery key as far as I can tell.

I really meant if you can see the keys, what's to stop someone stealing your Mac and grabbing them all?

You need to enter you credentials before the key(s) was displayed.

OK thanks. I've not used filevault yet. Might give it a spin. Does it slow the system down much? My MacBook is ageing (2010 model), saving up for a Darth Vadar model in 2014.

[bitpop]

Oh you guys use a password not the tpm

[Cubic Earth]

OK thanks. I've not used filevault yet. Might give it a spin. Does it slow the system down much? My MacBook is ageing (2010 model), saving up for a Darth Vadar model in 2014.

If you get a new Mac that comes with a SSD, the decryption is hardware accelerated.  I have filevault enabled on my haswell macbook air and the disk I/O is lightning fast.

[empoweoqwj]

OK thanks. I've not used filevault yet. Might give it a spin. Does it slow the system down much? My MacBook is ageing (2010 model), saving up for a Darth Vadar model in 2014.

If you get a new Mac that comes with a SSD, the decryption is hardware accelerated.  I have filevault enabled on my haswell macbook air and the disk I/O is lightning fast.

Yeah sounds like an SSD is a must. Thanks. Not sure my "give it a spin" is appropriate in that case though