Mac Security · FileVault & Mac Data Protection · Lesson 2 of 5

Apple Silicon Keeps Your Keys

How the Secure Enclave guards your disk key, and why shutting down helps.

Where the disk key lives

Encryption is only as safe as its key. If the key sat next to the data, a thief could take both. So where does your Mac keep it?

You met the Secure Enclave in the lesson on Apple silicon. It is the separate, locked security part inside the chip. It also guards the key that unlocks your disk.

Here is the idea, kept simple:

• Your disk is scrambled with a key.
• That key is itself locked up, so it is never stored in a readable form.
• One lock is a secret built into the Secure Enclave when the chip was made. Nobody can read it out, not even Apple.
• With FileVault on, another lock is your login password.

Both are needed. This gives you two strong protections.

First, the storage only works with its own chip. If someone took the storage out and put it in another computer, they would see only scrambled data. The secret they need never leaves the Secure Enclave.

Second, guessing your password is slow. Every guess has to go through the Secure Enclave on that Mac. It counts wrong tries. After several wrong tries in a row, it makes the person wait longer and longer before the next one. A thief can't hook up a fast computer to try millions of passwords.

That waiting is why a good password still matters. A long password that isn't a word, a name or a date would take far too long to guess.

Many Intel Macs with the Apple T2 chip work the same way. Older Intel Macs without it don't have a Secure Enclave doing this job. FileVault still encrypts them, but a strong password matters even more.

On Windows, a chip called the TPM does a similar job for BitLocker.

Off, locked or just restarted

Your Mac protects your files in different ways, depending on what state it is in. Knowing the difference helps you choose well.

Shut down. With FileVault on, everything on the disk is scrambled. The key is not loaded anywhere. Nobody can read a single file until someone types a login password, or uses your recovery method. This is the safest state.

Asleep or locked. Closing the lid puts a MacBook to sleep, a low power state where your apps stay open. Inside, the disk is already unlocked so your apps can keep working. The lock screen is what guards it. Someone needs your password or your fingerprint to get past it.

So make sure the lock comes on fast:

1. Open System Settings and click Lock Screen.
2. Find "Require password after screen saver begins or display is turned off".
3. Choose Immediately.

Just restarted. A restart turns the Mac off and on again, and updates often need one. While it starts up, the disk is locked again, just like after a shutdown. After a restart, your Mac asks for your password, not Touch ID. You saw this in the Apple silicon lesson. Now you know why. A fingerprint can't unlock the disk key. Only your password can. Touch ID works again once you have typed it.

This leads to one good habit. When you leave your Mac somewhere riskier, like a hotel room, a car or a long trip, shut it down instead of just closing the lid. Then it is in its safest state. Starting it up again takes only a minute when you get back.