FileVault personal recovery key How is PRK generated/derived and what is being sent to Apple's servers if I choose "use this iCloud account to unlock and reset your password..." during FileVault setup? I wasn't able to find this in FileVault technical whitepaper. Is it just yet another DEK (Data Encryption Key)?
The personal recovery key is read from /dev/random and base32 encoded afterwards:


  ... When activating FileVault 2, the
  System Preferences application displays a randomly generated
  120 bit password, encoded with base32, to the end
  user and advises them to securely store the password for
  recovery (see figure 2). The recovery password is read
  from /dev/random (through libcsfde and SecCreateRecoveryPassword()
  in Security.framework).


Source: Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption, page 9