Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the document Windows Server 2008 R2 BitLocker™ Drive Encryption Security Policy For FIPS 140-2 Validation, in the section 6.1.2 FIPS 140-2 Security Rules bullet point 2 it says:

BitLocker™ will only release keys to be stored on USB flash drives, if the Crypto Officer performs this operation

What does "operation" mean in this context?

What "operation" requires that "release keys to be stored on USB flash drives"?

What situations would require "release keys to be stored on USB flash drives"?

What is the exact definition of "releasing keys"?

share|improve this question

The FIPS 140 standard defines a number of technical terms (§2.1). Beyond that, you can assume common English meanings for words that aren't defined in the security policy you're reading.

The word operation is not defined in the standard, so it has its ordinary English meaning: “the act or process of operating” (Webster) (oh, and operate means “to produce, as an effect; to cause”). The operation here is the release of keys for storing on a USB flash drive.

Releasing a key from the cryptographic module means copying a key from inside the module to the outside of the module. Since Bitlocker is a software module, “inside” means that you need to go through Bitlocker to access it and “outside” means that you don't.

What the sentence means is that only the crypto officer can cause Bitlocker to release keys. Crypto officer is defined by FIPS 140-2; it is the role of the person(s) who can manage the keys stored in the module. This is usually the administrator role, the most privileged role possible on a cryptographic module. If the cryptographic module is a physical box with secret material inside, the crypto officer is the guy with the keys to the box; other users can only act on the box in controlled ways from the outside.

Bitlocker is intended to keep keys confidential. This sentence says that only the crypto officer can break this confidentiality. Usually, keys are extracted from a security module to back them up or to migrate them to another security module.

share|improve this answer

"Operation" enabling BitLocker

When BitLocker is used, a key is generated that must be present in order to decrypt access to the drive.

BitLocker will only store the unlock key on a USB drive so that the USB drive needs to be plugged in to the machine to unlock it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.