Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads.

Is anyone aware of OTP or smart card technology exists and is compatible with File Vault 2?

I checked the Apple support forums, but found nothing. My hope is that government or other secure institutions can offer advice regarding this.

share|improve this question
    
What about a YubiKey? Since this acts as a USB keyboard, it should be possible for the EFI to interact with it on boot. –  user47031 May 21 at 18:43

1 Answer 1

up vote 3 down vote accepted

Unfortunately, it's not currently possible.

From: http://training.apple.com/pdf/WP_FileVault2.pdf

Two-Factor Authentication

As discussed earlier, when using FileVault 2 (FDE), the initial authentication takes place as part of the EFI pre-boot authentication process. At this very early stage of the boot phase, none of the OS-reliant services are able to load because they’re dependent on the OS running. This means that alternative authentication mechanisms other than password-based authentication aren’t supported at this time. Any support for additional two-factor authentication mechanisms, such as smart cards or one-time passwords (OTP), requires further development of those services in the highly restricted space and execution of EFI. If an organization needs to use smart cards for authenticating and unlocking access to encrypted storage, use of container-based Legacy FileVault should be examined more closely.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.