KeyRecovery

Key Recovery

Once a key is stored with clipper there are two ways to retrieve it: via the CLI client and via the web UI. In both cases the user is prompted to authenticate, and the App Engine server checks that they are allowed to retrieve keys according to the FILEVAULT_PERMISSIONS_KEY in server/settings.py.

The web UI simply presents the "license-plate" code, whereas the CLI client offers more options, including some that don't expose the code:

• Verify Escrow: check with the server that a key was successfully stored.
• Revert Volume: retrieve the escrowed recovery key and use it to turn off encryption on the volume
• Unlock Volume: retrieve the escrowed recovery key and use it to unlock and mount the encrypted volume
• Display Passphrase: displays the "license-plate" code which can be used as desired.