Timeline for How does Windows use the TPM for BitLocker encryption without an attacker being able to do the same?
Current License: CC BY-SA 4.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 5, 2019 at 9:04 | comment | added | Shuzheng | I don't see what extra protection the VMK provides? In any case, if a key protector is leaked, then the FVEK is obtained. In any case, the FVEK cannot be changed without re-encrypting the whole disk? | |
| Jul 16, 2019 at 11:08 | comment | added | Andrew | I think we might mean the same thing, but the value of each PCR is a single hash. Each time you extend a PCR with a new piece of data, the result is: hash(old hash, new data). The bank of PCRs are therefore read as a list of hashes. | |
| Jul 16, 2019 at 11:06 | comment | added | Andrew | The TPM Encrypts the Volume Master Key (VMK) with its Storage Root Key (SRK) inside the TPM, which is never revealed. So TPM PCRs + SRK = decrypted VMK. link | |
| Jul 16, 2019 at 11:04 | comment | added | Andrew | The Full Volume Encryption Key (FVEK) is used to encrypt the data on disk; the FVEK is then encrypted again by the Volume Master Key (VMK). The benefit is that the VMK can be changed as it is just encrypting the FVEK. If the FVEK was used directly, to change it you'd need to re-encrypt all the data on-disk. | |
| Jul 11, 2019 at 5:58 | comment | added | Shuzheng | Might be out of scope, but of course the TPM includes some random value that it only knows about in the symmetric key for encryption/decryption; otherwise, the key could be derived from PCRs alone? | |
| Jul 11, 2019 at 4:34 | comment | added | Shuzheng | But thanks for all your help! I would correct your sentence "It stores a hash of the measurements in the PCRs using the 'extend' function." to "It stores hashes of the measurements in the PCRs using the 'extend' function." | |
| Jul 11, 2019 at 4:23 | comment | added | Shuzheng | Last question: Why do BitLocker has two keys, Volume Master Key and Full Volume Encryption Key - I don't see why two keys in this case should provide much better security than one? | |
| Jul 11, 2019 at 4:20 | vote | accept | Shuzheng | ||
| Jul 10, 2019 at 12:56 | comment | added | Andrew | Windows stores multiple copies of the Volume Master Key (VMK) on the encrypted drive, one copy of which will represent the TPM key protector. The TPM does not store the VMK itself. Windows send the VMK to the TPM to unseal (decrypt) it. The TPM feeds the PCR values into this operation, if they do not match exactly the unseal operation will fail. It's relatively cheap and easy to intercept the returned clear-text VMK and defeat BitLocker - see Pulse Security - which makes pre-boot authentication critical to BitLocker's security. | |
| Jul 10, 2019 at 12:40 | comment | added | Andrew | The BIOS boot block, as the Core Root of Trust for Measurements (CRTM), takes a number of measurements of the system starting with the BIOS itself and continuing the chain of boot up to the OS. It stores a hash of the measurements in the PCRs using the 'extend' function. If you are booting from a CD, or change the boot order itself, the resulting hash of one or more of the PCRs will change. PCRs are not specific to Windows but are a property of the TPM. The TPM PCRs are reset on each boot, and cannot be set/manipulated - only extended by a hash. The last link has some good reading. | |
| Jul 9, 2019 at 14:53 | comment | added | Shuzheng | Does the TPM actually encrypts the volume master key, or does it only store it? | |
| Jul 9, 2019 at 14:49 | comment | added | Shuzheng | I guess, a TPM can only be manipulated/reconfigured, if it's first reset - otherwise, malicious boot code would be able to tamper with it and possibly obtain the key by e.g. not resetting the original key first. | |
| Jul 9, 2019 at 14:46 | comment | added | Shuzheng | Awesome answer, @Andrew. So, if I boot from a CD, then the CD's boot code will be compared to that stored in the PCR for the hard drive's boot code - and the comparison will fail? Are PCRs specific to Windows and created from storage within the TPM - or are TPMs manufactured with a fixed number of PCRs? | |
| Jul 9, 2019 at 8:38 | history | answered | Andrew | CC BY-SA 4.0 |
