vista multiple startup keys one usb flash drive

If I have several startup keys (.FVE files) for different Vista machines on one USB flash drive, how does each machine know which one is correct? Is the filename recorded somewhere in the unencypted portion of the drive? Or does it simple try all the possible .FVE files until it finds the lucky winner?
Thanks,

Good question :)
There are a number of layers to the answer. (1) The filename uses a GUID. Each key protector (refer to WMI interface) is referenced by a GUID, these are the same GUID. (2) The structure of the binary file contains both the GUID of the encrypted volume and the GUID of the key protector. (3) When decrypting the VMK, AES/CCM is used with 256-bit AES key. This is an industry standard algorithm, that contains a nonce and a MAC (message authentication check). If the startup key was wrong, then the MAC part of the AES/CCM algorithm detects this and causes a failure. (4) Should 1-3 fail, then the data would be decrypted incorrectly into gibberish :) Thankfully 1-3 prevents (4). - Jamie Hunter [MS]
"tavis" wrote in message

If I have several startup keys (.FVE files) for different Vista machines on one USB flash drive, how does each machine know which one is correct? Is the filename recorded somewhere in the unencypted portion of the drive? Or does it simple try all the possible .FVE files until it finds the lucky winner?
Thanks,

Thanks again, Jamie.
I must give credit to my very inquisitive and bright colleagues for these questions. ;-)
"Jamie Hunter [MS]" wrote:

Good question :)
There are a number of layers to the answer. (1) The filename uses a GUID. Each key protector (refer to WMI interface) is referenced by a GUID, these are the same GUID. (2) The structure of the binary file contains both the GUID of the encrypted volume and the GUID of the key protector. (3) When decrypting the VMK, AES/CCM is used with 256-bit AES key. This is an industry standard algorithm, that contains a nonce and a MAC (message authentication check). If the startup key was wrong, then the MAC part of the AES/CCM algorithm detects this and causes a failure. (4) Should 1-3 fail, then the data would be decrypted incorrectly into gibberish :) Thankfully 1-3 prevents (4). - Jamie Hunter [MS]
"tavis" wrote in message If I have several startup keys (.FVE files) for different Vista machines on one USB flash drive, how does each machine know which one is correct? Is the filename recorded somewhere in the unencypted portion of the drive? Or does it simple try all the possible .FVE files until it finds the lucky winner?
Thanks,