sentences:  This way, to revoke a given device key, the MKB needs only be encrypted with that device key's parent key.Once the MKB is decrypted, it provides the Media Key, or the "km".The "km" is combined with the Volume ID (which the program can only get by presenting a cryptographic certificate to the drive, as described above) in a one-way encryption scheme (AES-G) to produce the Volume Unique Key ("Kvu").