MacOS – My Macbook’s hard drive is encrypted using FileVault 2. Will adding a new user with a different password break the encryption

encryptionfilevaultmacbook promacospassword

I want to add a separate account or accounts to use as chroot accounts for an FTP server, and I want to use different passwords for these accounts. I know the AES-128 key used by FileVault is calculated from the password, so will using a new password cause FileVault to try to encrypt using a different key, making the ciphertext inconsistent? Or does FileVault calculate the key based on the password you used when you first encrypt the hard drive? I'm not sure about this, and I don't want to break my computer.

Best Answer

FileVault 2 will encrypt the boot volume and allow you to unlock that volume based upon existing user accounts.

Adding a new user account on OS X El Capitan (10.11.6) will automatically add that account to FileVault 2's list of enabled users. So no, you won't revert your existing setup or remove an existing account's ability to unlock an encrypted volume.

The built-in fdesetup account is also very useful (requires sudo privileges):

 list       [-extended] [--offline] [-verbose]
            List enabled users, or locked volumes.

 enable     [[[-user username ...] [-usertoadd added_username ...]] |
            [-inputplist]] [-outputplist] [-prompt] [-forcerestart]
            [-authrestart] [-keychain | [-certificate path_to_cer_file]]
            [[-defer file_path] [-forceatlogin max_cancel_attempts]
            [-dontaskatlogout]] [-norecoverykey] [-verbose]
            Enables FileVault.  This command will fail if no recovery par-
            tition was found on your disk.
Related Question