If I have a system with FileVault 2 enabled on the system and on the Time Machine drive, what happens if I change my system password? Is the encryption based on my login (being able to log in) or is the encryption tied to the password (somehow hashed to the password value so if it changes, the new password can't decrypt the files?)
10.7.4 running FileVault 2, migrated from 10.6.x installation, if that makes any difference…
Best Answer
IIRC, FileVault2 generates its own encryption keys when you start using it. It uses those keys to encrypt the drive, not your password. This is unlike FileValut1 which uses your password itself.
The keys themselves, when stored on disk, are THEN encrypted using your password, and therefore can only be used to read the disk if you have the password. This is the reason multiple accounts can unlock the disk in FV2, and how the "master key" can exist (multiple encrypted copies of FV2's storage keys).
Yes, changing your password will mean that this new password is required to access the storage keys, and hence the drive. But this only triggers a re-encryption of the keys, which are very small, and not the entire drive.
Since FV1 and FV2 are 2 totally different encryption schemes, the fact that you migrated from 10.6 shouldn't matter. Not sure if Lion is backwards compatible with FV1 directories, but as long as you're actually using FileValut2, changing your password should work as described above.