(AES-256-XTS) and metadata (AES-256-CBC+CTS). Encryption keys are randomly generated, and then encrypted, the passphrase the verified boot key and the hardware-bound Trusted Execution Environment key which also implements rate limiting below the OS layer.