How is administrative recovery implemented?
When volumes are created the software generates a random data encryption key. In addition to any normal password processing that is performed, when administrative key recovery is enabled, the random data encryption key is encrypted using the administrator’s public key. In the event of an emergency, the administrator’s private key can used to decrypt the random data encryption key. This process is cryptographically safe due to the nature of public/private key algorithms.
