5

The TPM specification mentions that some keys are migratable, i.e. transferable to another TPM. Does this mean that it would be possible to share (transfer) a BitLocker decryption key between several TPMs, and thus being able to decrypt the same encrypted hard drive on multiple machines? Or does the BitLocker keys fall under the non-migratable category which is locked to one TPM?

2 Answers 2

2

I think I have found the "answer" to this. It should be possible, but Microsoft has not currently implemented it. As far as I know it is technically possible to have the decryption keys protected by several different TPMs stored on the same encrypted hard drive since they are (I think) a binary blob encrypted by the TPM, so each different TPM could have its own different blob that can be decrypted by that TPM.

1

This is a wild guess, but I would expect that it would depend on how you configure BitLocker when setting it up. If they allow you an option to backup the key when configuring it (which they should), then you could import that backup copy regardless of if it is exportable or not. If you don't have some backup copy of the key and it isn't exportable, I wouldn't use the encryption as TPMs can and do fail (a good one is in fact designed to fail if problems are detected.) I've had it happen before and if I didn't have a backup of the key, my data would have been lost.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .