When are the encryption keys for each partition dynamically created?

When are the encryption keys for each partition dynamically created?

A.
When updating a profile

B.
When a recovery file is written

C.
At shutdown

D.
At boot