apfs-fuse icon indicating copy to clipboard operation
apfs-fuse copied to clipboard

Published 20 hours ago • verified publisher icon sgan81

FileVault and CoreStorage encrypted volumes that have been converted to APFS fail 'Rfc3394_KeyUnwrap' in KeyMgmt.cpp

Open arcticforensics opened this issue 2 years ago • 2 comments

The 'Rfc3394_KeyUnwrap' function in 'KeyMgmt.cpp' returns false (a != rfc_3394_default_iv) when calling 'KeyManager::GetVolumeKey' for an APFS volume converted from FileVault/CoreStorage. If the 'Rfc3394_KeyUnwrap' function parameter 'aes_mode' is substituted with 'AES::AES_128', it works!

arcticforensics avatar Jan 19 '22 04:01 arcticforensics

In which key unwrap call did you put these changes?

sgan81 avatar Mar 11 '23 18:03 sgan81