Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Question

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads.

Is anyone aware of OTP or smart card technology exists and is compatible with File Vault 2?

I checked the Apple support forums, but found nothing. My hope is that government or other secure institutions can offer advice regarding this.

Answer 1

Unfortunately, it's not currently possible.

From: http://training.apple.com/pdf/WP_FileVault2.pdf

Two-Factor Authentication

As discussed earlier, when using FileVault 2 (FDE), the initial authentication takes place as part of the EFI pre-boot authentication process. At this very early stage of the boot phase, none of the OS-reliant services are able to load because they’re dependent on the OS running. This means that alternative authentication mechanisms other than password-based authentication aren’t supported at this time. Any support for additional two-factor authentication mechanisms, such as smart cards or one-time passwords (OTP), requires further development of those services in the highly restricted space and execution of EFI. If an organization needs to use smart cards for authenticating and unlocking access to encrypted storage, use of container-based Legacy FileVault should be examined more closely.