33

For security concerns, I wonder how it would be possible for an OS X upgrade (e.g. from Mavericks to El Capitan), to reboot my Mac multiple times without asking me for my FileVault 2 password?

I mean, the whole drive is encrypted and even an OS X installer would not know the password after a reboot. In spite of that, it reboots one or more times without asking me for my password.

Therefore I suspect that Apple stores my password somewhere, either on disk, in NVRAM, or online, at least during the upgrade process. If so, wouldn't this be a serious security concern?

Can anyone shed a bit of light on this? How does it work?

klanomath
  • 66,391
  • 9
  • 130
  • 201
Anders
  • 493
  • 3
  • 8
  • 3
    As an aside, OS X accidentally logged the password in plaintext to disk during a 10.7.3 upgrade: http://9to5mac.com/2012/05/07/bug-in-mac-os-x-10-7-3-exposes-passwords-in-plain-text/ ! It has since been fixed, of course. – Aidan Steele Feb 01 '16 at 03:49

1 Answers1

35

There's an OS X feature called authenticated restart that stores the FileVault key in the SMC for the duration of the reboot. Apple acknowledges in the manpage that it does reduce FileVault security for the duration of the restart:

On supported hardware, fdesetup allows restart of a FileVault-enabled system without requiring unlock during the subsequent boot using the authrestart command.

WARNING: FileVault protections are reduced during authenticated restarts.

In particular, fdesetup deliberately stores at least one additional copy of a permanent FDE (full disk encryption) unlock key in both system memory and (on supported systems) the System Management Controller (SMC). fdesetup must be run as root and itself prompts for a password to unlock the FileVault root volume. Use pmset destroyfvkeyonstandby to prevent saving the key across standby modes. Once authrestart is authenticated, it launches reboot(8) and, upon successful unlock, the unlock key will be removed.

Community
  • 1
Mike Scott
  • 10,484
  • 1
    Thanks. Perfectly answers my question and reduces my concerns to the question whether erasure from SMC is actually complete and safe. – Anders Jan 31 '16 at 20:02