Does APFS make evicting FV keys redundant?
crichez opened this issue · comments
Apple's File System Programming Guide updated February 20th mentions the following under "File System Basics/Security/Files[...]":
When the user puts the computer to sleep or shuts it down, the decryption keys are destroyed to prevent unauthorized access to the disk’s contents.
The Apple File System Guide also suggests user data is protected even on a decrypted volume:
Multi-key encryption ensures the integrity of user data. Even if someone were to compromise the physical security of the device and gain access to the device key, they still couldn't decrypt the user's files.
I don't know of any technical information to confirm that. Is there precedent for this (file systems that support per-file multi-key encryption)?
Not confirming this is true, but if so, this is beautiful. I have been eyeing the filevault key deletion/hibernate option for my laptops knowing how much trouble people have had with it (#124)
Interesting, does anyone have more information or have done an analysis to verify this?
Sorry for necromancing this issue, but did anyone else find any info other than this single mention in the APFS-Guide-document about this?