5

I've been getting into forensics and penetration testing lately and hoping someone can explain what the below data is and how it might be used to perform a bruteforce (hashcat) attacks against macbooks.

More specifically, what is "VEK Wrpd", "KEK Wrpd", "HMAC", and "PW Key"? And can they be used to reproduce the FileVault password if it's guessed correctly?

I used apfs-fuse to dump the data:

$ ./apfs-fuse -d 16 /dev/sda2/ /path/to/mount

Device /dev/sda2 opened. Size is 250790436864
starting LoadKeybag
 all blocks verified
 header has type 6b657973
Volume macOS1 is encrypted.
Password hint: looking for key type 3 for volume 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251 in m_container_bag
Trying to load key bag from recs_block
starting LoadKeybag
 all blocks verified
 header has type 72656373
Password hint: looking for key type 4 for volume 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251 in recs_bag
Enter Password: 
GetVolumeKey: Dumping container keybag.
Dumping Keybag (keys)

Version :    2
Keys    :    2
Bytes   :       e0

Key 0:
UUID    : 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251
Type    :    3 [Keybag Ref]
Length  :   10
Unknown :        0

Block   :           7c1f57
Count   :                1

Key 1:
UUID    : 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251
Type    :    2 [VEK]
Length  :   7c
Unknown :        0

[Blob Header]
Unk 80  : 0
HMAC    : 106BXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX9921
Salt    : 5493XXXXXXXX1F47

[VEK]
Unk 80  : 0
UUID    : 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251
Unk 82  :        0    1 9e b1
VEK Wrpd: 06391FA9XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX552582F2



GetVolumeKey: looking for key type 3 for volume 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251 in m_container_bag
 key found
 data size matches that of key_extent_t
Trying to load key bag from recs_block
starting LoadKeybag
 all blocks verified
 header has type 72656373
Volume key bag loaded successfully. Dumping contents.
Dumping Keybag (recs)

Version :    2
Keys    :    3
Bytes   :      220

Key 0:
UUID    : 257AXXXX-XXXX-XXXX-XXXX-XXXXXXXX7975
Type    :    3 [KEK]
Length  :   94
Unknown :        0

[Blob Header]
Unk 80  : 0
HMAC    : F047XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXF6A8
Salt    : 630CXXXXXXXX268

[KEK]
Unk 80  : 0
UUID    : 257AXXXX-XXXX-XXXX-XXXX-XXXXXXXX7975
Unk 82  :        0    2 9e b1
KEK Wrpd: BB7FXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX07F8
Iterat's: 100000
Salt    : 863CXXXXXXXXXXXXXXXXXXXXXXXX2F51


Key 1:
UUID    : CDF5XXXX-XXXX-XXXX-XXXX-XXXXXXXXE4CA
Type    :    3 [KEK]
Length  :   94
Unknown :        0

[Blob Header]
Unk 80  : 0
HMAC    : 5A2AXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXAEB8
Salt    : BFBFXXXXXXXX5FD6

[KEK]
Unk 80  : 0
UUID    : CDF5XXXX-XXXX-XXXX-XXXX-XXXXXXXXE4CA
Unk 82  :        0    2 9e b1
KEK Wrpd: 43A8XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX5E07
Iterat's: 117590
Salt    : 8751XXXXXXXXXXXXXXXXXXXXXXXXB0DA


Key 2:
UUID    : EBC6XXXX-XXXX-XXXX-XXXX-XXXXXXXXECAC
Type    :    3 [KEK]
Length  :   94
Unknown :        0

[Blob Header]
Unk 80  : 0
HMAC    : 9F92XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX5706
Salt    : E363XXXXXXXXCC09

[KEK]
Unk 80  : 0
UUID    : EBC6XXXX-XXXX-XXXX-XXXX-XXXXXXXXECAC
Unk 82  :        0    2 9e b1
KEK Wrpd: CF35XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXEC04
Iterat's: 127270
Salt    : 3780XXXXXXXXXXXXXXXXXXXXXXXXA2E7



PW Key  : EE62XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX6AB5
KEK Wrpd: BB7FXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX07F8
KEK     : A60EXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX4D78
KEK IV  : F7ECXXXXXXXX202A

PW Key  : 6363XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX6191
KEK Wrpd: 43A8XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX5E07
KEK     : EB9FXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXD6F9
KEK IV  : 5932XXXXXXXX4ACB

PW Key  : 6B62XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXEEFF
KEK Wrpd: CF35XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXEC04
KEK     : B579XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXAD90
KEK IV  : A3E7XXXXXXXXCA4F
  • Remember to mark an answer as accepted if it worked for you. :) – forest Apr 4 at 3:09
6

what is "VEK Wrpd", "KEK Wrpd", "HMAC", and "PW Key"?

This is all explained in this whitepaper, starting at page 26, section Key Management.

  • VEK - This is the Volume Encryption Key. Each logical volume contains its own VEK, which is used to encrypt individual 512-byte sectors on the drive. FileVault uses a 256-bit VEK which is used by 128-bit AES in XTS mode, a standard mode for block device encryption.

  • KEK - This is the Key Encryption Key. A random symmetric key is generated which encrypts the VEK, which is then stored in the CoreStorage metadata. The function of this key is to provide a layer of indirection so the KEK can be changed independently of the VEK (which would otherwise require re-encrypting the entire drive in a very costly process).

  • DEK* - This is the Derived Encryption Key, which is likely what "PW key" refers to. It is derived directly from a combination of the password and the stored salt or an x.509 certificate using the PBKDF2 algorithm. Any given password and salt tuple will result in the same DEK.

  • HMAC - A Hash-based Message Authentication Code is an algorithm which uses a cryptographic hash to prove the integrity of arbitrary data. It is used to detect tampering. An HMAC is essentially the hash of a key and a message put together in a particular way. An attacker is unable to forge a valid HMAC for any given message without the key. HMAC is also used as the core function of PBKDF2, where it is used for purposes other than data integrity.

When you decrypt a volume, the password is converted into the DEK, which is not stored in any form anywhere on the device. The DEK is then used to decrypt the KEK, which is then used to decrypt the VEK which is used to allow you to access all of your volumes. The encrypted forms of the KEK and VEK are kept on the disk. Knowledge of the decrypted values of any of these keys will allow you to read the volume, but not recover your password.

The "Wrpd" most likely stands for "wrapped", i.e. the encrypted version of the key, according to the source code. The VEK Wrpd is thus the VEK after it has been encrypted with the KEK. Likewise, the KEK Wrpd is the KEK after it has been encrypted by the DEK. These values are not particularly sensitive and are stored directly on the disk. There is no DEK Wrpd because it is derived directly from the passphrase, hopefully stored only in your brain.

* Confusingly, DEK in other contexts usually stands for Data Encryption Key and holds the same function as the VEK.

And can they be used to reproduce the FileVault password if it's guessed correctly?

No, although knowledge of the VEK will allow you to decrypt the encrypted volume it protects. While the DEK is derived directly from the input password, the algorithm which is used, PBKDF2, is a one-way function. That is, you can convert your ASCII password to a DEK, but you cannot convert your DEK to an ASCII password. Furthermore, PBKDF2 is intentionally designed to be slow to prevent someone from passing a large number of candidate passwords through the function until one of them works (a brute-force attack).

  • 2
    forest, you are a king among men. – Kieveli Jun 8 '18 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.