posidon wrote:
Modern day implementation of Bitlocker is dependent on two other security features –
TPM (not a requirement for Bitlocker, but offers the hardware security which is much needed)
Windows Measured Boot (a security feature of Windows implemented using the TPM capabilities)
TPM can create cryptographic keys and encrypt them so that they can only be decrypted by the TPM. This process is called wrapping or “binding a key to TPM.” The key as generated is wrapped/bound using a master wrapping key (unique to each TPM), called the Storage Root Key (SRK).
SRK is a RSA 2048 bit public-private key pair where the SRK_Pub is used for encryption operation as it is exposed outside TPM. However, only the TPM can decrypt the encrypted content as only it has the SRK_Priv (this is stored within TPM and is never exposed outside)
A TPM can also create a key that has not only been wrapped, but is also tied to certain Platform measurements (PCR values). This process is referred to as “sealing the key to the TPM.”
Binding a key to TPM with platform measurement ensures that it can be unsealed only when current platform measurement matches with the measurement values with which the key was sealed.
Thanks posidon
Does that means If a new SSD with new OS in installed in that laptop ,
bitlocker key will be same as from crashed SSD ? In that case if I connect cloned volume of crashed SSD to this laptop via USB ,it will get autodecrypted as both keys are identical ?
Does TPM takes care of all encryption /decryption and no unique key is generated with each windows install ?
Those who have worked with TPM and
bitlocker might be able to shed light.
FAQ
Search
Login
Register
HDDGURU FILES
