Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The TPM specification mentions that some keys are migratable, i.e. transferable to another TPM. Does this mean that it would be possible to share (transfer) a BitLocker decryption key between several TPMs, and thus being able to decrypt the same encrypted hard drive on multiple machines? Or does the BitLocker keys fall under the non-migratable category which is locked to one TPM?

share|improve this question

This is a wild guess, but I would expect that it would depend on how you configure BitLocker when setting it up. If they allow you an option to backup the key when configuring it (which they should), then you could import that backup copy regardless of if it is exportable or not. If you don't have some backup copy of the key and it isn't exportable, I wouldn't use the encryption as TPMs can and do fail (a good one is in fact designed to fail if problems are detected.) I've had it happen before and if I didn't have a backup of the key, my data would have been lost.

share|improve this answer
up vote 1 down vote accepted

I think I have found the "answer" to this. It should be possible, but Microsoft has not currently implemented it. As far as I know it is technically possible to have the decryption keys protected by several different TPMs stored on the same encrypted hard drive since they are (I think) a binary blob encrypted by the TPM, so each different TPM could have its own different blob that can be decrypted by that TPM.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.