2 noted that I'm mainly considering the case where the laptop is stolen
source | link

I've googled the heck out of this, and have read multiple related questions on this site, but I'm still missing a crucial piece of the puzzle.

I have a (work) laptop with Win10 Pro which is encrypted with Bitlocker. For quite a while I didn't even realise it was encrypted because it doesn't ask for a password on a cold boot. (We used to use TrueCrypt on all of our laptops, so I was accustomed to using a password.) I then decided to check the system and booted it with a Linux live CD. I was able to see the partitions on the disk but was unable to mount the main one - a quick bit of hex dumping showed me that the main NTFS partition was indeed encrypted.

Now, the OS will happily cold-boot all the way to the Windows login screen with NO input from the user (i.e. no PIN/password), which from my googling I have learned happens by dint of the OS automagically extracting the encryption key from the TPM.

What's bothering me is this: what's to stop another bit of code (e.g. Linux) from asking the TPM for the HDD encryption key? Even assuming a secret MS key is required, this key surely must be present in the boot partition somewhere, and my simplistic idea of how this might be achieved would be for a VM (on a USB key?) to execute the boot loader until the boot sequence interacts with the TPM and bingo the encryption key is no longer secret... This isn't rocket science though, and clearly it can't be this easy or Bitlocker+TPM would be an utter waste of time. So - I can't have a correct picture of what's going on, but I've tried and failed to find out how it really works...

Can anyone provide the insight I'm missing? Thanks in advance!

[Edit: for clarity, I'm mainly thinking about the case where the laptop gets stolen. Like many people, my laptop spends a lot of its time in my bag in sleep mode, so let's assume it's sleeping when stolen - this has implications for how much a move to TPM+PIN would help, but I don't think it directly changes the fundamentals of the actual question.]

I've googled the heck out of this, and have read multiple related questions on this site, but I'm still missing a crucial piece of the puzzle.

I have a (work) laptop with Win10 Pro which is encrypted with Bitlocker. For quite a while I didn't even realise it was encrypted because it doesn't ask for a password on a cold boot. (We used to use TrueCrypt on all of our laptops, so I was accustomed to using a password.) I then decided to check the system and booted it with a Linux live CD. I was able to see the partitions on the disk but was unable to mount the main one - a quick bit of hex dumping showed me that the main NTFS partition was indeed encrypted.

Now, the OS will happily cold-boot all the way to the Windows login screen with NO input from the user (i.e. no PIN/password), which from my googling I have learned happens by dint of the OS automagically extracting the encryption key from the TPM.

What's bothering me is this: what's to stop another bit of code (e.g. Linux) from asking the TPM for the HDD encryption key? Even assuming a secret MS key is required, this key surely must be present in the boot partition somewhere, and my simplistic idea of how this might be achieved would be for a VM (on a USB key?) to execute the boot loader until the boot sequence interacts with the TPM and bingo the encryption key is no longer secret... This isn't rocket science though, and clearly it can't be this easy or Bitlocker+TPM would be an utter waste of time. So - I can't have a correct picture of what's going on, but I've tried and failed to find out how it really works...

Can anyone provide the insight I'm missing? Thanks in advance!

I've googled the heck out of this, and have read multiple related questions on this site, but I'm still missing a crucial piece of the puzzle.

I have a (work) laptop with Win10 Pro which is encrypted with Bitlocker. For quite a while I didn't even realise it was encrypted because it doesn't ask for a password on a cold boot. (We used to use TrueCrypt on all of our laptops, so I was accustomed to using a password.) I then decided to check the system and booted it with a Linux live CD. I was able to see the partitions on the disk but was unable to mount the main one - a quick bit of hex dumping showed me that the main NTFS partition was indeed encrypted.

Now, the OS will happily cold-boot all the way to the Windows login screen with NO input from the user (i.e. no PIN/password), which from my googling I have learned happens by dint of the OS automagically extracting the encryption key from the TPM.

What's bothering me is this: what's to stop another bit of code (e.g. Linux) from asking the TPM for the HDD encryption key? Even assuming a secret MS key is required, this key surely must be present in the boot partition somewhere, and my simplistic idea of how this might be achieved would be for a VM (on a USB key?) to execute the boot loader until the boot sequence interacts with the TPM and bingo the encryption key is no longer secret... This isn't rocket science though, and clearly it can't be this easy or Bitlocker+TPM would be an utter waste of time. So - I can't have a correct picture of what's going on, but I've tried and failed to find out how it really works...

Can anyone provide the insight I'm missing? Thanks in advance!

[Edit: for clarity, I'm mainly thinking about the case where the laptop gets stolen. Like many people, my laptop spends a lot of its time in my bag in sleep mode, so let's assume it's sleeping when stolen - this has implications for how much a move to TPM+PIN would help, but I don't think it directly changes the fundamentals of the actual question.]

    Tweeted twitter.com/StackSecurity/status/1023312296695750656
1
source | link

How does Bitlocker + TPM prevent me seeing the HDD contents with another OS?

I've googled the heck out of this, and have read multiple related questions on this site, but I'm still missing a crucial piece of the puzzle.

I have a (work) laptop with Win10 Pro which is encrypted with Bitlocker. For quite a while I didn't even realise it was encrypted because it doesn't ask for a password on a cold boot. (We used to use TrueCrypt on all of our laptops, so I was accustomed to using a password.) I then decided to check the system and booted it with a Linux live CD. I was able to see the partitions on the disk but was unable to mount the main one - a quick bit of hex dumping showed me that the main NTFS partition was indeed encrypted.

Now, the OS will happily cold-boot all the way to the Windows login screen with NO input from the user (i.e. no PIN/password), which from my googling I have learned happens by dint of the OS automagically extracting the encryption key from the TPM.

What's bothering me is this: what's to stop another bit of code (e.g. Linux) from asking the TPM for the HDD encryption key? Even assuming a secret MS key is required, this key surely must be present in the boot partition somewhere, and my simplistic idea of how this might be achieved would be for a VM (on a USB key?) to execute the boot loader until the boot sequence interacts with the TPM and bingo the encryption key is no longer secret... This isn't rocket science though, and clearly it can't be this easy or Bitlocker+TPM would be an utter waste of time. So - I can't have a correct picture of what's going on, but I've tried and failed to find out how it really works...

Can anyone provide the insight I'm missing? Thanks in advance!