News for hackers. Stuff that matters.

A comment on When Full-Disk Encryption Goes Wrong. Parent comment

Re:When Full-Disk Encryption Goes Wrong by Aqua_Geek on Friday May 20, 2016 @01:27PM (#11739722)
It does provide you with a recovery key, but that recovery key is useless if the file containing the volume master key is lost or corrupted (as happened here). In FileVault the recovery key is to protect you from losing your password, not from the system nuking the master key.
[ Parent | on HN ]
Re:When Full-Disk Encryption Goes Wrong by Analemma_ on Friday May 20, 2016 @01:35PM (#11739796)
Ah, that's my misunderstanding then. I always thought the recovery key was the volume master key, for the purposes of guarding against accidents like this. Good to know that's not the case; I think I should go check up on my backup solution now.
[ Parent | on HN ]
Re:When Full-Disk Encryption Goes Wrong by lloeki on Friday May 20, 2016 @02:25PM (#11740232)
You can generate a new recovery key anytime once the volume is decrypted/booted:

    sudo fdesetup validaterecovery  # check
    sudo fdesetup changerecovery -personal  # change
Obviously this doesn't reencrypt the disk, so you can guess how it works.
[ Parent | on HN ]