FileVault Encryption Speed (not impact, actual how fast disks are encrypted)

[germanjulian]

Hello,

I am hoping somebody can explain to me why FileVault full disk encryption takes only seconds where experience (in windows with bitlocker) has thought me it takes hours (or even VeraCrypt) for full disk encryption of the main drive. Thanks

Model:
MacBook Pro M2 with 2TB drive with 1TB of data used latest MacOS

Full Info:

I decided to re-encrypt my Macintosh HD with FileVault as I wanted to move away from "recovery key stored in iCloud" to "store the key somewhere save or else loose access to your data".

So I decided to 'disable' FileVault in System Settings first which took around 4 to 5 seconds
Then did some more work etc. and decided to power cycle and start recovery mode and go into Disk Utility. In there the Info panel showed me both partitions have an encryption status: Is Encrypted: No (Encrypted at Rest)

Ok, so does seem to be off and when I booted the login screen also loaded my normal desktop wallpaper (aka macOS loaded without me logging in and providing the filevault decryption password).

I then re-enable FileVault and the encryption = took about 6 to 7 seconds 🤯

I again checked Disk Util (after a full power cycle) and I can confirm that the disk / partitions are encrypted and I even for the Data partition had to mount the partion but enter the password.

Question:

How can full disk encryption only take a few seconds on a 1TB disk on MacOS? This cannot be right? I encrypted and waited... painfully.. on bitlocker disk encryption to finish for hours and something like VeraCrypt also take ages depending on partition size and obviously ssd speed.

 

[3166792]

FileVault encryption is 'accelerated' on Macs with Secure Enclave - T2 equipped or Apple Silicon. It's normal for it to be very fast.

 

[NoBoMac]

You have an M Mac, so files are encrypted by default even without FileVault.

FileVault just adds another layer/wrapper around the master encryption key. So turning FileVault on only need to encrypt the master key.

Gory details:

Volume encryption with FileVault in macOS

In Mac OS X 10.3 or later, Mac computers provide FileVault, a built-in encryption capability to secure all data at rest.

support.apple.com

 

[germanjulian]

You have an M Mac, so files are encrypted by default even without FileVault.

FileVault just adds another layer/wrapper around the master encryption key. So turning FileVault on only need to encrypt the master key.

Gory details:

Volume encryption with FileVault in macOS

In Mac OS X 10.3 or later, Mac computers provide FileVault, a built-in encryption capability to secure all data at rest.

support.apple.com

Totally makes sense. DEK vs KEK etc. (though I try to avoid crypto)