I got this query while distrohopping. On Linux I have to enter my password erveytime I boot to decrypt the disk. But on windows I never had to do it. The first time windows bitlocker asked for password was when I booted into windows after installed Linux. Why is it so?
Bitlocker stores the key required to boot the system in the TPM.
You can do that on Linux too if you want to, using Clevis or systemd-cryptenroll.
As far as I know, Bitlocker uses two keys to boot: There’s a key in the TPM, that’s used to decrypt a key stored on the drive, that’s used to decrypt the data.
I think some data (maybe just user-specific data?) is encrypted with a user-specific key too, that isn’t unlocked until you log in.Edit: I think I was thinking of DPAPI.I’m not 100% sure about the specifics of its design.
I doubt that it is the case - it encrypts
diskpartition , not user specific data AFAIK. It has a single key AFAIK.Yeah I think I was thinking of DPAPI. Updating my comment!
Ask yourself a different question:
What is the point of encrypting the drive if your computer decrypts it automatically?
Are you really worried about the case where a thief steals the hard drive but not the rest of the computer?
There’s other approaches to automatically unlocking. For example, you can combine Clevis with Tang to use Network Bound Disk Encryption, which lets you automatically decrypt only when on a trusted network. (the password is stored on a different system on the same network)
You can have multiple different LUKS keys, and any of them can be used to decrypt the disk. This lets you automatically unlock via a network server when your system is at home, while still prompting for an unlock password when not at home.
At my workplace, our laptops have two LUKS keys - one for me and one for IT / tech support. It lets IT boot the system (eg if I send it in for repair) without having to know my LUKS password.
It also protects you from malicious apps running outside of windows - they can’t manipulate the file system. Also an attacker would have hard time breaking into your disk/OS if they get control of your machine. If he tries to boot from another device, bitlocker won’t decrypt the windows partition automatically.
Wouldn’t that data be inaccessible if encrypted? You would still need to login to access it. You wouldn’t be able to drop the drive on another machine if it’s encrypted.
Every once in a while a security researcher will highlight a new method for obtaining the key from the TPM, usually by tapping into the I2C comms between it and the CPU. They’ll say it’s ‘trvial’ and can be done ‘in seconds’, but that’s only after a lot of work figuring out that particular motherboard.
A few months ago there was yellowkey that just needed a special file on a USB drive to bypass bitlocker, making it so easy that it was arguably a backdoor.
Yes, that is infact the situation Bitlocker wants to protect you from. Correct. I mean we can argue that’s not the case you need it to protect against but if we’re looking at non-drive-retrieval situations, then you can just have a password at the BIOS-level, you don’t need to encrypt the actual drive. Might as well save yourself the little CPU usage for encrypting/decrypting.
Bitlocker is specifically for th idea that someone circumvents any on-boot password and just takes the drive out, reading your files off of it directly.
Like any security measure it is not to be applied in isolation.
Just a side note: these days there usually isn’t any overhead for having a drive encrypted, the CPU isn’t even involved. The drive itself will decrypt the data itself.
Again, let me emphasize: usually. There are exceptions.
I was guessing bitlocker was decrypted when you logged in.
