Contents
What do you need to know about FileVault?
FileVault is one of the tools provided by Apple to prevent data theft in cases of stolen or lost MacBooks. FileVault uses XTS-AES-128 encryption with a 256-bit key so it is very secure. The number of key combination in AES-128 is 3.4*10^38.
What kind of encryption key does FileVault use?
FileVault full-disk encryption (FileVault 2) uses XTS-AES-128 encryption with a 256-bit key to help prevent unauthorized access to the information on your startup disk.
How can I change the recovery key for FileVault?
If you want to change the recovery key used to encrypt your startup disk, turn off FileVault in Security & Privacy preferences. You can then turn it on again to generate a new key and disable all older keys.
How to enable Intune to take over management of FileVault?
There are two methods you can use that enable Intune to take-over management of FileVault in this scenario: Upload a personal recovery key to Intune – Use this method when the user knows their personal recovery key. The user generates a new recovery key on the device – Use this method if the personal recovery key isn’t known by the user.
FileVault is just a little magic that allows you to decrypt and log into an encrypted volume. If you encrypt both containers prior to enabling FileVault, all that will happen is that FileVault will enable login on decrypt. It won’t change anything about the encryption. FileVault is “whole-disk” encryption.
How does FileVault 2 affect I / O performance?
Enabling FileVault 2 can have a negative impact on I/O performance of approximately 20-30% of modern CPUs, and it noticeably worsens performance on older processor hardware. If the passphrase or recovery key must be changed, the entire volume will need to be decrypted and have the encryption process run again with the new key.
Where do I Find my FileVault 2 recovery key?
When FileVault 2 is enabled while the system is running, the system creates and displays a recovery key for the computer, and optionally offers the user to store the key with Apple. The 120 bit recovery key is encoded with all letters and numbers 1 through 9, and read from /dev/random, and therefore relies on the security of the PRNG used in macOS.