Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Wikipedia defines Bitlocker as:

BitLocker Drive Encryption is a full disk encryption feature included with the Ultimate and Enterprise editions of Microsoft's Windows Vista and Windows 7 desktop operating systems, as well as the Windows Server 2008 and Windows Server 2008 R2 server platforms. It is designed to protect data by providing encryption for entire volumes.

I've heard that some maybe using Bitlocker for drive encryption in order to comply with FIPS 140-2.

The National Institute of Standards and Technology (NIST) issued the FIPS 140 Publication Series to coordinate the requirements and standards for cryptography modules that include both hardware and software components.

Does Bitlocker qualify as the cryptographic module defined in FIPS 140-2?

Are there any other pieces that are needed to fulfill the need for FIPS 140-2 security level 1 'cryptographic module' requirements?

share|improve this question
up vote 4 down vote accepted

Bitlocker is a FIPS 140-2 certified module with certificate number 1339. It is important for you to read the FIPS security policy to determine if the operating conditions conform to your environment. For example:

The BitLocker™ components (Windows Server 2008 R2 versions: 6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897 and 6.1.7600.20916; SP1 versions: 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 and 6.1.7601.21675) identified in section 4 have been validated on the Microsoft Windows Server 2008 R2 and Microsoft Windows Server 2008 R2 on x64.
share|improve this answer
+1 Excellent answer, thanks. – Mark Rogers Jan 8 '12 at 18:39
Usually it's some regulation thing "you must use FIPS 140-2 compliant security measures." in some contract or something. – ewanm89 Jan 8 '12 at 20:32
@ewanm89 I'm not sure what you mean, here. Did you mean to comment on my answer or to the original question? – logicalscope Jan 8 '12 at 21:38
It also depends on the region it's being used in: but that is somewhat obvious. – Jonathan Dickinson Jan 8 '12 at 22:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.