Recovery Key on 1.5.0

@olyroad You do understand, that there was no recovery key in past versions and that it was introduced to mitigate the possibility for human error? :smiley:

I don’t think you quite get what the recovery key is, yet. It can not be changed. It is a representation of the masterkey that can be used for disaster recovery.

If you don’t opt in for using it, then it does not exist. Nobody can use it if you haven’t generated it. It isn’t pre-generated and lurking around somewhere on your system.

While bruteforcing a password is a hard job (German post), bruteforcing the recovery key is virtually impossible, since it has the full 512 bit entropy of the original key. It is not a KEK, it is the key itself. No stretching involved.

Of course, if you opt for saving/printing/etc the recovery key, you should treat it like a password. This is btw what the instructions already stress.

3 Likes