From owner-freebsd-hackers@freebsd.org  Tue Sep  8 18:27:44 2015
Return-Path: <owner-freebsd-hackers@freebsd.org>
Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id CA3FA9CCCD4
 for <freebsd-hackers@mailman.ysv.freebsd.org>;
 Tue,  8 Sep 2015 18:27:44 +0000 (UTC)
 (envelope-from mozolevsky@gmail.com)
Received: from mail-io0-x231.google.com (mail-io0-x231.google.com
 [IPv6:2607:f8b0:4001:c06::231])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 94C7B1900
 for <freebsd-hackers@freebsd.org>; Tue,  8 Sep 2015 18:27:44 +0000 (UTC)
 (envelope-from mozolevsky@gmail.com)
Received: by ioii196 with SMTP id i196so128625206ioi.3
 for <freebsd-hackers@freebsd.org>; Tue, 08 Sep 2015 11:27:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:sender:in-reply-to:references:from:date:message-id
 :subject:to:cc:content-type;
 bh=4waFVJCii2oojkzcXf4MdAHxjMSLhk6Ipm4aoc/a23c=;
 b=AFBgcB/Fz/YxMeCPw6YX3FBm6sbDrOzpPkg0Z5W4+vkTZCx12CJzqJ78OvMn4uuz/2
 o2SMpwFTNc6IzAh7wdBoW3hf4SIJYdIhqV71Pb0bKaBEhrOAghojYa1Oq315wQfWcuh5
 /ZRJCevkW9w0UrBWmnZSlfgusL9il8nGZbvI1U6/DjdsjyZrX/6WA4RTSnLupFYjOLzn
 kPNHPP4HxnJFr8ys8baITm0d8iQFW6CD7iZ5RiZvzluMZtR8g6ASv9vjuzrt/0aaa7dX
 5okT3AWW5C7ckIvM6kfbYWRoCA421tflgdG1pQOpuAUg3k7leYAVMmJMNSAUP62plGSj
 3smg==
X-Received: by 10.107.16.80 with SMTP id y77mr40651625ioi.183.1441736863765;
 Tue, 08 Sep 2015 11:27:43 -0700 (PDT)
MIME-Version: 1.0
Sender: mozolevsky@gmail.com
Received: by 10.79.92.198 with HTTP; Tue, 8 Sep 2015 11:27:04 -0700 (PDT)
In-Reply-To: <D214715D.1A32%xaol@amazon.com>
References: <8B7FEE2E-500E-49CF-AC5E-A2FA3054B152@gmail.com>
 <CADWvR2iv7xz02Fw9b=159+SMuphQGRKZsfyy9DDeqGMxn=p1BA@mail.gmail.com>
 <D214715D.1A32%xaol@amazon.com>
From: Igor Mozolevsky <igor@hybrid-lab.co.uk>
Date: Tue, 8 Sep 2015 19:27:04 +0100
X-Google-Sender-Auth: 2KJnaluC4-xHGHjA0KUhWqYmef8
Message-ID: <CADWvR2iVubsBQjnvQ8mDGGS7ujsR8wPQ2RAxn=kvFkmVGQkXiQ@mail.gmail.com>
Subject: Re: Passphraseless Disk Encryption Options?
To: "Li, Xiao" <xaol@amazon.com>
Cc: Analysiser <analysiser@gmail.com>,
 Hackers freeBSD <freebsd-hackers@freebsd.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Content-Filtered-By: Mailman/MimeDel 2.1.20
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
 <freebsd-hackers.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers/>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Sep 2015 18:27:45 -0000

On 8 September 2015 at 19:14, Li, Xiao <xaol@amazon.com> wrote:

> Hi Igor,
>
> Thanks for the suggestion! I=C2=B9m trying to achieve that the data could=
 only
> be accessed in a trusted booted system and cannot be decrypted when the
> startup disk is a cold storage device. Something like FileVault on Mac OS
> X (https://support.apple.com/en-us/HT204837).



Please read Apple's blurb- your logging in unlocks the FileVault; if you
forget your login password (and you haven't set up password recovery) you
data is just a source of entropy. I suspect what they did was that their
uefi loader logs you in and decrypts the drive.


--=20
Igor M.