On Wed, Mar 05, 2025 at 07:23:55AM +0000, Aditya Garg wrote: > > This driver tbh will not ‘really’ be helpful as far as T2 Macs are > concerned. > > On these Macs, the T2 Security Chip encrypts all the APFS partitions > on the internal SSD, and the key is in the T2 Chip. Even proprietary > APFS drivers cannot read these partitions. I dunno how it works in > Apple Silicon Macs. How this workings on Apple Silicon Macs is described in this article: https://eclecticlight.co/2022/04/23/explainer-filevault/ It appears such a driver will also be useful if there are external SSD's using APFS. (Although I suspect many external SSD's would end up using some other file system that might be more portable like VFS.) In terms of making it work with the internal SSD, it sounds like Linux would need to talk to the secure enclave on the T2 Security Chip and convince it to upload the encryption key into the hardware in-line encryption engine. I don't know if presenting the user's password is sufficient, or if there is a requirement that the OS prove that it is "approved" software that was loaded via a certified boot chain, which various secure enclaves (such as TPM) are wont to do. - Ted
