> My understanding is that the master encryption key does not exist on the device in non-volatile storage, but rather is computed by combining a secret key (I g

> My understanding is that the master encryption key does not exist on the device in non-volatile storage, but rather is computed by combining a secret key (I guess you could call this a “salt”) stored in the secure enclave with the user’s passphrase. When you start the device and authenticate, this derivation happens, and then the derived key is kept in memory and it’s only software keeping an attacker out. Sorry yes I sort of glossed over this part and some other parts in my explanation. > If the locked state without a derived key loaded is as secure as it theoretically should be, doesn’t that mean recovering data off the device without uncapping (or similar) requires correctly guessing the passcode in however many master key derivation attempts the secure enclave is configured to allow before it wipes the secret key and renders the stored data useless? You are correct. As pointed out below, this also assumes there is no vulnerability in the enclave. Having a secure passphrase with a secure key derivation function provides a more secure foundation however, because even having unlimited guesses means you are still down to the original brute force.